[thomasluizon]

A validated access token without orbit_session_id bypasses the session check. Remove the early return in src/Orbit.Api/Extensions/ServiceCollectionExtensions.cs so the existing parse guard produces an authentication failure. Replace the legacy-acceptance test in tests/Orbit.Infrastructure.Tests/Extensions/JwtSessionValidationTests.cs with a rejection assertion against the configured JWT event. Reusing the existing rejection path keeps missing, malformed, and inactive sessions under the same gate.

The WHY comment named in the ticket is already absent in this checkout. The build regenerated both OpenAPI documents without a diff.

Closes thomasluizon/orbit-tickets#660.

Deployment timing

Render service srv-d6tc2isr85hc739bf75g deployed PR #553's merge commit ad018bd2f869f8c09b2417df196519e98a58dedd as deploy dep-daquq8nf3r2c73cli720. Render reports completion at 2026-09-25T03:41:51.003508Z. The 168-hour cutoff was 2026-10-02T03:41:51.003508Z. At the read on 2026-10-19T02:17:18.902858Z, 574.59 hours had passed.

Test evidence

All commands ran with LC_ALL=en_US.UTF-8.

1. Before either edit, ValidatedLegacyToken_WithoutSessionClaim_RemainsAccepted passed with the acceptance branch present:

   LC_ALL=en_US.UTF-8 dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~ValidatedLegacyToken_WithoutSessionClaim_RemainsAccepted --verbosity minimal

   Result: exit 0, 1 passed.

2. After replacing the test and before changing production code, ValidatedToken_WithoutSessionClaim_IsRejected failed:

   LC_ALL=en_US.UTF-8 dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~ValidatedToken_WithoutSessionClaim_IsRejected --verbosity minimal

   Result: exit 1, 1 failed. Assertion: Expected context.Result to be Microsoft.AspNetCore.Authentication.AuthenticateResult, but found <null>.

3. After removing the early return, the configured-session tests passed:

   LC_ALL=en_US.UTF-8 dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~JwtSessionValidationTests --verbosity minimal

   Result: exit 0, 4 passed, including the replacement test, active and inactive sessions, and logout followed by an HTTP 401 challenge.

4. Final verification after commit: LC_ALL=en_US.UTF-8 dotnet build Orbit.slnx --verbosity minimal exited 0 with 0 errors. The full .NET suite passed across all four solution test projects, 10,037 tests total, with no failures or skips:

   Command (with LC_ALL=en_US.UTF-8)	Result
   dotnet test tests/Orbit.Domain.Tests --verbosity minimal	Exit 0, 736 passed
   dotnet test tests/Orbit.Application.Tests --verbosity minimal	Exit 0, 5581 passed
   dotnet test tests/Orbit.Infrastructure.Tests --verbosity minimal	Exit 0, 3688 passed
   dotnet test tests/Orbit.Analyzers.Tests --verbosity minimal	Exit 0, 32 passed

External interface evidence

The rejection test invokes the real configured JwtBearerEvents.OnTokenValidated callback. Its passing assertion observes an actual AuthenticateResult with a non-null Failure; it does not supply a mock result for that external type.

The Render deployment fields above were read from the live response. Reproduce the read with an authorized Render token:

curl --fail --silent --show-error \
  --header "Authorization: Bearer ${RENDER_MCP_TOKEN}" \
  'https://api.render.com/v1/services/srv-d6tc2isr85hc739bf75g/deploys/dep-daquq8nf3r2c73cli720'

Complete response, with no credentials returned:

{"id":"dep-daquq8nf3r2c73cli720","commit":{"id":"ad018bd2f869f8c09b2417df196519e98a58dedd","message":"Fix #657 logout revocation across a session family (#553)\n\n* Start #657 session family fix\n\n* Revoke the full auth session after logout (#657)\n\n* Explain temporary legacy token allowance (#657)\n\n* Handle duplicate refresh history race (#657)","createdAt":"2026-09-25T03:40:16Z"},"status":"deactivated","trigger":"new_commit","createdAt":"2026-09-25T03:40:18.436165Z","updatedAt":"2026-09-25T04:28:47.330702Z","startedAt":"2026-09-25T03:40:18.412312Z","finishedAt":"2026-09-25T03:41:51.003508Z"}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed both changed files, token issuance and refresh paths, and the web/mobile clients' HTTP 401 recovery behavior.

• Required session claim: Removes the legacy-token bypass so an absent orbit_session_id fails the existing session-validation guard without querying the session store.
• Regression coverage: Replaces the legacy-acceptance assertion with a failure assertion against the configured JWT callback. All four JwtSessionValidationTests cases passed during this review; the full solution suite was not rerun.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}