fix(security): enforce purpose scope validation for recovery tokens

[d-oit]

Enforced strict validation of the 'purpose' claim inside JWT magic link recovery tokens. During token generation, the payload now explicitly contains purpose: 'reader_recover'. Upon verification on the /verify-recovery endpoint, we strictly check for this claim, rejecting any tokens without or with incorrect purpose values. Updated recovery test fixtures and added unit tests covering verification with invalid/missing purposes.

---

PR created automatically by Jules for task 16229959289807015906 started by @d-oit

[cloudflare-workers-and-pages]

Deploying do-epub-studio with    Cloudflare Pages

Latest commit:	9099df9
Status:	✅  Deploy successful!
Preview URL:	https://ff81b162.do-epub-studio.pages.dev
Branch Preview URL:	https://jules-16229959289807015906-6.do-epub-studio.pages.dev

View logs

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[repowise-bot]

✅ Health of changed files: 5.1 → 5.4 (+0.3)
_{⚠️ Change risk: moderate, riskier than 61% of this repo's commits.}

📋 At a glance
2 hotspots touched · 2 files with recent fix history. Scoped to apps.

📌 Before you merge

• Run .../__tests__/middleware.test.ts, .../__tests__/routes.access.test.ts, .../__tests__/validation.test.ts: they import the changed files

🔎 More signals (2)

🗺️ Change map

flowchart LR
  subgraph PR ["Changed in this PR (1 with dependents)"]
    f_apps_worker_src_routes_access_ts[".../routes/access.ts 🔥"]:::changed
  end
  f_apps_web_src_features_admin_BooksPage_tsx[".../admin/BooksPage.tsx"]
  f_apps_worker_src_routes_access_ts --> f_apps_web_src_features_admin_BooksPage_tsx
  f_apps_web_src_features_auth_LoginPage_tsx[".../auth/LoginPage.tsx"]
  f_apps_worker_src_routes_access_ts --> f_apps_web_src_features_auth_LoginPage_tsx
  f_apps_web_src_i18n_de_ts[".../i18n/de.ts"]
  f_apps_worker_src_routes_access_ts --> f_apps_web_src_i18n_de_ts
  f_apps_web_src_i18n_en_ts[".../i18n/en.ts"]
  f_apps_worker_src_routes_access_ts --> f_apps_web_src_i18n_en_ts
  more(["+4 more dependents"])
  PR --> more
  t_apps_worker_src___tests___middleware_test_ts(["✅ .../__tests__/middleware.test.ts"]):::guard
  t_apps_worker_src___tests___middleware_test_ts -.-> f_apps_worker_src_routes_access_ts
  classDef changed fill:#dbeafe,stroke:#1d4ed8,color:#1e3a5f
  classDef warn fill:#fef3c7,stroke:#b45309,color:#78350f
  classDef guard fill:#dcfce7,stroke:#15803d,color:#14532d

Loading

_{Solid arrows: code that imports the changed files (8 direct dependents, from the last indexed snapshot). Dashed: history/tests.}

🔥 Hotspots touched (2)

• .../__tests__/recovery.test.ts: 5 commits/90d, 0 dependents · primary owner: google-labs-jules[bot] (95%)
• .../routes/access.ts: 14 commits/90d, 13 dependents

---

📊 See the full report for this PR
_{Your repo map with this PR's blast radius lit up, every caller of the contracts it changes, and health before and after. No sign-in. · ⭐ Star Repowise · 📥 Install bot · Silence on a single PR with [skip repowise] in the title · Per-repo toggle on repowise.dev/settings?tab=bot · Updated 2026-08-01 06:02 UTC (since the last push: health 8.5 to 5.4)}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 7 duplication

Metric	Results
Complexity	0
Duplication	7

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

🚀 Performance Report

⚡ Startup & Interaction

Metric	Value (ms)	Limit (ms)	Trend	Status
First Contentful Paint	244.00	1500	-	✅
Chapter Switch Latency	0.00	300	-	✅
Offline Rehydrate Time	222.20	800	-	✅
DOM Interactive	38.10	-	-	-
Load Event End	162.00	-	-	-

🛠️ CI & Workflow

Metric	Value	Limit	Status
Total CI Duration	7.40 min	15.00 min	✅
Pnpm Cache Hit	Hit	-	✅