chore: JWT unification (jose everywhere) + logout cache clear

[BODMAT]

What

Two tech-debt items deferred from Week 3 AC 2 review. Unifies JWT signing and verification under a single library (jose), removes jsonwebtoken, and clears TanStack cache on logout to prevent stale data flash when switching accounts.

Changes

Code

• dashboard/server/auth.ts — issueJWT ported to new SignJWT(...).sign() from jose
• dashboard/server/jwt.ts — requireUser made async, now delegates to existing verifyJwt (jose); removed jsonwebtoken import
• dashboard/app/api/v1/** (10 route handlers) — added await before requireUser(req) calls
• dashboard/app/dashboard/logout-button.tsx — added queryClient.clear() before router.replace("/login")

Tooling / config

• dashboard/package.json — removed jsonwebtoken and @types/jsonwebtoken (10 packages, 91 lines from lock file)

Docs / plan

• plans/week4/jwt-unification-and-logout-cache.md — moved from backlog, decomposed into commits
• plans/backlog/email-password-auth.md — deleted, out of scope for Week 4

Design decisions

• jose only, no dual-library — jsonwebtoken had two call sites (issueJWT + requireUser); now everything goes through verifyJwt / SignJWT from jose. Single place to update if algorithm or rotation logic changes
• HS256 backward-compatible — JWT_SECRET is base64 (ASCII only), so TextEncoder().encode() produces identical bytes. Existing tokens in extension remain valid
• requireUser async — breaking change within the codebase only; all callers were already async, only needed await added
• queryClient.clear() before redirect — ensures zero stale cache before the new user's data arrives; one line, zero risk

Verification

• npx tsc --noEmit (dashboard) — clean
• npm run lint (dashboard) — clean
• Bearer flow: POST /api/v1/events with extension JWT → 201 ✓
• Cookie flow: Google login → /dashboard loads with data → 200 on all API calls ✓
• Logout → re-login → dashboard loads cleanly ✓

Out of scope (future PRs)

• jose for middleware (already used jose there before this PR — no change needed)
• Forgot password / email auth — removed from backlog, not required by spec

Closes

• Week 4 tech debt (plans/week4/jwt-unification-and-logout-cache.md)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worktrace	Ready	Preview, Comment	Jun 2, 2026 10:02am