Remove the unsubscribe-token dual-verify window early (ADR 0020 acceptance) #296

New Issue

fable-5 · 2026-07-31T20:17:19+02:00

fable-5 commented

2026-07-31 20:17:19 +02:00

Operator decision while accepting ADR 0020 (2026-07-31): the dual-verify transition window for unsubscribe tokens is unnecessary and shall be removed early — with the next milestone rather than waiting for the stated 2026-11-01 expiry.

What to remove: the legacy verification path behind LEGACY_VERIFY_UNTIL in apps/api/src/notifications/unsubscribe-token.ts (accepting the pre-#188 derivation for links in already-sent mail). Consequence, stated honestly: unsubscribe links in mails sent before the #188 deploy stop working; recipients use the in-app notification settings instead. That is acceptable — the instance population is small and non-Prod mail delivery is test-only.

Scope: delete the legacy branch and its constant, adjust/remove the covering tests, note the removal in the security documentation's key-hierarchy section if it mentions the window.

Operator decision while accepting ADR 0020 (2026-07-31): the dual-verify transition window for unsubscribe tokens is unnecessary and shall be removed early — with the next milestone rather than waiting for the stated 2026-11-01 expiry. **What to remove**: the legacy verification path behind `LEGACY_VERIFY_UNTIL` in `apps/api/src/notifications/unsubscribe-token.ts` (accepting the pre-#188 derivation for links in already-sent mail). Consequence, stated honestly: unsubscribe links in mails sent before the #188 deploy stop working; recipients use the in-app notification settings instead. That is acceptable — the instance population is small and non-Prod mail delivery is test-only. **Scope**: delete the legacy branch and its constant, adjust/remove the covering tests, note the removal in the security documentation's key-hierarchy section if it mentions the window.

fable-5 added the

backend

effort:S

labels 2026-07-31 20:17:19 +02:00

fable-5 referenced this issue from a commit

2026-07-31 20:47:29 +02:00

ADRs 0019-0027: accepted after explicit operator review (2026-07-31)

fable-5 referenced this issue

2026-07-31 20:47:40 +02:00

ADRs 0019-0027: accepted after explicit operator review #297

fable-5 referenced this issue from a commit

2026-07-31 23:03:04 +02:00

#296: remove the unsubscribe-token dual-verify window early

fable-5 referenced this issue

2026-07-31 23:03:04 +02:00

#296: remove the unsubscribe-token dual-verify window early #299

fable-5 commented

2026-07-31 23:19:54 +02:00

Done via PR #299 (merged, CI green). Verification is subkey-only; the legacy derivation and LEGACY_VERIFY_UNTIL are gone, a regression test pins that the pre-#188 derivation can never verify again, and security.md records the removal with the stated consequence (old mail links dead; in-app notification settings instead). Ships with release v0.13.0.

Done via PR #299 (merged, CI green). Verification is subkey-only; the legacy derivation and `LEGACY_VERIFY_UNTIL` are gone, a regression test pins that the pre-#188 derivation can never verify again, and `security.md` records the removal with the stated consequence (old mail links dead; in-app notification settings instead). Ships with release v0.13.0.

fable-5 closed this issue

2026-07-31 23:19:54 +02:00

Sign in to join this conversation.