fix(auth): accept only access tokens as bearer credentials (MFA bypass)

All JWTs (access, MFA setup, MFA challenge, SSO completion) were signed
with the same secret and the access-token strategy checked only signature
and expiry. The MFA challenge token returned after the password step
therefore worked as a full access token: a password alone was enough to
use the API, skipping the second factor.

Every token now carries a pinned issuer, algorithm (HS256) and a
per-purpose audience; the strategy accepts only the access audience and
rejects any payload carrying a helper-token purpose. Existing access
tokens (no audience) stop working; clients renew them via the refresh
cookie.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/sso/sso.service.ts

@@ -7,6 +7,11 @@ import {
 import { JwtService } from '@nestjs/jwt';
 import * as client from 'openid-client';
 import { UsersService } from '../../users/users.service';
+import {
+  TOKEN_AUDIENCE,
+  jwtSignOptions,
+  jwtVerifyOptions,
+} from '../util/jwt-claims';
 
 const SSO_COMPLETE_TOKEN_TTL = '60s';
 const SSO_COMPLETE_TOKEN_PURPOSE = 'sso-complete';
@@ -111,10 +116,7 @@ export class SsoService {
     }
     const ssoCode = this.jwtService.sign(
       { sub: user.id, purpose: SSO_COMPLETE_TOKEN_PURPOSE },
-      {
-        secret: process.env.JWT_ACCESS_SECRET,
-        expiresIn: SSO_COMPLETE_TOKEN_TTL,
-      },
+      jwtSignOptions(TOKEN_AUDIENCE.ssoComplete, SSO_COMPLETE_TOKEN_TTL),
     );
     return { status: 'success', ssoCode };
   }
@@ -122,9 +124,10 @@ export class SsoService {
   verifySsoCode(ssoCode: string): { userId: string } {
     let payload: SsoCompleteTokenPayload;
     try {
-      payload = this.jwtService.verify<SsoCompleteTokenPayload>(ssoCode, {
-        secret: process.env.JWT_ACCESS_SECRET,
-      });
+      payload = this.jwtService.verify<SsoCompleteTokenPayload>(
+        ssoCode,
+        jwtVerifyOptions(TOKEN_AUDIENCE.ssoComplete),
+      );
     } catch {
       throw new UnauthorizedException(
         'SSO-Anmeldung abgelaufen, bitte erneut versuchen',