[jois-code]

Description

Restricts OAuth authentication strictly to valid student accounts by verifying the presence of official student metadata (nameAsInSSLC) in the Academy dispatcher response.

Previously, if a non-student account authenticated at /mobilelogin/auth, the dispatcher lookup for student records returned no record, but the system swallowed this and returned null. This allowed non-students to log in with empty academic fields (Program: N/A, Branch: N/A, Semester: -).

With this change:

• fetchProfileDetails validates that data.MESSAGE contains 'SUCCESS', STUDENT_PHOTO is present, and nameAsInSSLC is a non-empty string.
• If these conditions are not met, an AcademyAuthError('Only student accounts are supported') is thrown, halting login with HTTP 400.
• Unit tests have been updated and extended to cover rejection scenarios for missing student records and missing SSLC names.

Fixes #5

---

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Tests
• CI/CD
• Refactor
• Security

---

Testing

• Unit tests (pnpm test)
• TypeScript typecheck (pnpm typecheck)
• Production build (pnpm build)
• Manual local run (pnpm dev)
• CI green
• Docker build (PR workflow)

---

Checklist

• Targets main
• Follows CONTRIBUTING.md
• No secrets or credentials committed
• Docs updated if behavior or setup changed
• ESLint clean (pnpm lint)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot review overview

🟡 Changes recommended

Incomplete session metadata can bypass student verification, and whitespace-only SSLC names lack test coverage.

Review effort: Lite
Findings: 1

Open (1)

• Require student verification before creating a session · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

The new mandatory userId check conflicts with nullable session flows and should be relaxed.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Require student verification before creating a session

[jois-code]

@sach-12 LGTM merge after review

[Copilot]

🟢 Approval recommended

No blocking issues remain; only a minor naming nit was identified.

0 open findings

🧠 Review effort: Lite

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

done