mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
b73c14a51a
A negative row presented the token as "Basic <jwt>", six characters where Bearer is seven, so a verifier that never compared the scheme would still have refused it — on a token it had read one character into. Digest is exactly as long, so the row now fails for the reason it claims to test. Killing that mutant is what showed the test was passing on the wrong evidence. The issuer pin stops another brand's token; it does not make org names unique across issuers, and the tenant here IS the org name. Stated where the decision lives: one record plane serving several brands has to scope by brand as well as by org, one plane per brand does not. Co-authored-by: Hanzo Dev <[email protected]>