Bound JWT to its scope by embedding scope claim in payload

[VarunSriram99]

Description

Checklist

• I have made corresponding changes to the documentation.
• I have added the necessary label (js or js with
  patch/minor/major - If publish is required).

patch _t

[neeto-bugwatch]

🤖 NeetoBugWatch Review

I've analyzed your pull request and found some potential improvements that might be worth considering. Please review the specific line comments below for helpful suggestions.

💡 To trigger a re-review of this PR, add a comment with neeto-bugwatch-run on its own line (not inside a code block or blockquote).

Warning

Verdict: Needs review — 2 comments found, including major issues

Click to copy prompt for AI agent

Verdict: review_required

The following are code review comments from an AI reviewer that only has access
to the PR diff, not the full codebase. Treat every comment as a hypothesis,
not a fact. For each comment:

1. Investigate the verification questions against the full codebase first.
2. Go beyond the provided questions. Use your full codebase access to ask your
   own questions, check related code paths, and consider edge cases that the
   reviewer could not have seen from the diff alone.
3. Only implement the suggested fix if your investigation confirms the issue is real.
4. If the issue is not real, skip it entirely. Do not implement speculative fixes.

Prioritize by severity (critical > major > minor > trivial) and confidence score.
Only attend to comments with confidence below 0.5 if your investigation proves them valid.

[
  {
    "file_path": "js/test/index.test.ts",
    "line_number": 59,
    "comment": "The test expects decoded.workspace to be 'app', but 'workspace' is omitted in the NeetoJWT constructor above. This may cause a test failure if 'workspace' does not default to 'app'.",
    "confidence": 0.9,
    "severity": "major",
    "suggested_fix": "Add 'workspace: \"app\"' to the NeetoJWT instantiation options, or correct the assertion to expect undefined.",
    "verification_questions": [
      "Does the NeetoJWT class assign a default workspace value of 'app' when scope is 'consumer'?",
      "Will this test fail in CI due to a missing workspace initialization parameter?"
    ]
  },
  {
    "file_path": "js/test/index.test.ts",
    "line_number": 45,
    "comment": "The assertion expects decoded.scope to be 'user', but scope was not explicitly provided in the visible test setup. Verification is needed to ensure scope defaults appropriately to prevent brittle tests.",
    "confidence": 0.8,
    "severity": "minor",
    "suggested_fix": "Verify that scope defaults to 'user' in the NeetoJWT class, or explicitly pass it in the test setup.",
    "verification_questions": [
      "Does NeetoJWT set a default scope of 'user'?",
      "Should the test explicitly pass the scope parameter to ensure isolated testing?"
    ]
  }
]