phase 121: update server's HS256 rejection test for new dual-verify semantics

assertPhase0LegacyHs256Algorithm used to assume the SDK verifier would
reject any HS256 token as an unsupported algorithm. With dual-verify
(this PR), HS256 is accepted by default, so the old assertion now sees
'jwks_fetch_failed' (the verifier looks for a matching HS256 JWK that
the test harness doesn't publish) instead of 'invalid_token'.

Fix: set RELAYAUTH_VERIFIER_ACCEPT_HS256=false around the verify call
so the test asserts the post-sunset posture that phase 122 flips in
production. Test intent ("spec-compliant verifier rejects legacy
HS256") is preserved; the fixture just scopes to the correct flag
state.

Env var is restored in a finally block to avoid cross-test leakage.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: kjgbot

packages/server/src/__tests__/tokens-route.test.ts

@@ -259,21 +259,35 @@ async function assertPhase0LegacyHs256Algorithm(token: string, audience: string[
     kid: "dev-key",
   });
 
-  const verifier = new TokenVerifier({
-    jwksUrl: "https://relayauth.test/.well-known/jwks.json",
-    issuer: "https://relayauth.dev",
-    audience,
-  });
-
-  await assert.rejects(
-    () => verifier.verify(token),
-    (error: unknown) => {
-      assert.ok(error instanceof RelayAuthError);
-      assert.equal(error.code, "invalid_token");
-      return true;
-    },
-    "spec-compliant verifiers should reject legacy HS256 tokens until RS256 lands",
-  );
+  // Phase 121 added dual-verify to @relayauth/sdk: HS256 is accepted by default
+  // during the migration window. This assertion is checking the *post-sunset*
+  // posture — that a verifier with HS256 acceptance disabled rejects these
+  // legacy tokens. That matches what phase 122 flips in production.
+  const previousFlag = process.env.RELAYAUTH_VERIFIER_ACCEPT_HS256;
+  process.env.RELAYAUTH_VERIFIER_ACCEPT_HS256 = "false";
+  try {
+    const verifier = new TokenVerifier({
+      jwksUrl: "https://relayauth.test/.well-known/jwks.json",
+      issuer: "https://relayauth.dev",
+      audience,
+    });
+
+    await assert.rejects(
+      () => verifier.verify(token),
+      (error: unknown) => {
+        assert.ok(error instanceof RelayAuthError);
+        assert.equal(error.code, "invalid_token");
+        return true;
+      },
+      "spec-compliant verifiers (HS256 acceptance disabled) should reject legacy HS256 tokens",
+    );
+  } finally {
+    if (previousFlag === undefined) {
+      delete process.env.RELAYAUTH_VERIFIER_ACCEPT_HS256;
+    } else {
+      process.env.RELAYAUTH_VERIFIER_ACCEPT_HS256 = previousFlag;
+    }
+  }
 }
 
 async function createHarness({