search-service: stop trusting X-User-ID, gate index endpoints behind service token, keep auth on in deploys - #1561

Open

devin-ai-integration[bot] wants to merge 7 commits into

mainfrom

devin/1789396851-search-service-auth-bypass

Commits on Sep 14, 2026

search-service: validate JWTs, gate index endpoints behind service token, keep auth on in deploys
devin-ai-integration[bot]
committed
b6b33d0
search-service: bump PyJWT to 2.13.0 (CVE-2026-32597, CVE-2026-48526)
devin-ai-integration[bot]
committed
52fa29a
search-service: use 32-byte test JWT secrets
devin-ai-integration[bot]
committed
f459719
search-service: 48-byte test JWT secret for HS384
devin-ai-integration[bot]
committed
840ab78
search-service: remove REQUIRE_AUTH bypass, accept HS512, reject refresh tokens, provision SEARCH_SERVICE_TOKEN
devin-ai-integration[bot]
committed
184962d
search-service: wire SQS indexing queue into the golden deploy, roll pods on secret change
devin-ai-integration[bot]
committed
dbed93c
search-service: keep SQS_ENABLED=false in the golden deploy
devin-ai-integration[bot]
committed
94f7e40