{
  "context": "Tests whether the agent implements JWT validation and route protection according to the Fastify OAuth skill's prescribed packages, algorithm choices, claim validation requirements, hook patterns, and refresh token rotation semantics.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "@fastify/jwt package",
      "description": "Imports or requires '@fastify/jwt' for JWT operations (not jsonwebtoken, jose, or another JWT library as the primary verification mechanism)",
      "max_score": 10
    },
    {
      "name": "Asymmetric algorithm used",
      "description": "JWT verification is configured to use RS256 or ES256 (asymmetric algorithm), NOT HS256 (symmetric secret)",
      "max_score": 15
    },
    {
      "name": "exp claim validated",
      "description": "The hook explicitly checks the exp claim and returns a 401 response when the token is expired (not relying solely on jwtVerify's default behavior without an explicit check)",
      "max_score": 10
    },
    {
      "name": "iss claim validated",
      "description": "The hook explicitly compares payload.iss to the expected issuer (e.g. process.env.EXPECTED_ISSUER) and returns 401 on mismatch",
      "max_score": 10
    },
    {
      "name": "aud claim validated",
      "description": "The hook explicitly compares payload.aud to the expected audience (e.g. process.env.EXPECTED_AUDIENCE) and returns 401 on mismatch — audience validation is NOT skipped",
      "max_score": 15
    },
    {
      "name": "onRequest hook pattern",
      "description": "Route protection is implemented via fastify.addHook('onRequest', verifyToken) rather than per-route preHandler or manual calls inside route handlers",
      "max_score": 10
    },
    {
      "name": "401 with error field",
      "description": "All validation failure paths return HTTP 401 with a JSON body containing an 'error' field (e.g. { error: 'invalid_token' } or { error: 'token_expired' })",
      "max_score": 10
    },
    {
      "name": "Refresh token rotation",
      "description": "The refresh utility returns the new refresh_token from the response if present, and falls back to the old refresh token using the ?? operator or equivalent null-coalescing logic",
      "max_score": 15
    },
    {
      "name": "sub claim used",
      "description": "The sub claim from the validated token payload is accessed and used (e.g. returned in the /me route or stored in request context)",
      "max_score": 5
    }
  ]
}