Access tokens for User.Read scope have audience=graph.microsoft.com,
but the backend validates audience=CLIENT_ID. ID tokens always have
audience=CLIENT_ID so they validate correctly.
Also add upn claim fallback for email extraction from ID token.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- auth.py: replace synchronous httpx.get (blocked event loop) with
async httpx.AsyncClient; add key-rotation refresh on unknown kid
- App.tsx: use onRedirectNavigate: false so Sign out clears only the
local MSAL session without redirecting to Microsoft logout endpoint
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- MSAL.js (PKCE) browser-side auth against Azure Entra ID
- Bearer token interceptor on all API calls
- Backend JWT validation middleware (python-jose + JWKS)
- All API routes protected; /api/health stays public
- vite base set to /gsb/, BrowserRouter basename=/gsb
- docker-compose: remove frontend service, lock backend to 127.0.0.1:8002, remove dev volumes
- backend: 2 workers, no --reload
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
