[zer0stars]

Why

/v1/telemetry/subscribe, /unsubscribe and /:vehicleTokenId/start accept any auth.dimo.zone token whose wallet is the DIMO Mobile license. The DIMO console now gives team members their own signer on a license and disables it when they're removed. dex stamps that signer on developer JWTs as signer_address, and this PR makes tesla-oracle refuse a removed member's still-valid token.

What

• The three telemetry routes check tokens carrying signer_address through token-exchange-api's SignerCheck gRPC (5 s deadline; token-exchange caches for 60 s and skips addresses that aren't licenses).
  • Disabled signer: 403 signer no longer authorized for this license.
  • gRPC failure: 503 could not verify signer.
  • Tokens without the claim, including the mobile backend's own, pass.
• New settings: TOKEN_EXCHANGE_GRPC_ADDR and SIGNER_CHECK_MODE (enforce default, log, off). The chart sets log in dev and prod for the rollout; production switches to enforce after a week.
• Metric signer_check_total{service="tesla-oracle",result}, alerted on from token-exchange-api's PrometheusRule.

Release order

token-exchange-api with SignerCheck (DIMO-Network/token-exchange-api#120) must be live in an environment before this, and dex must emit the claim (DIMO-Network/dex#332).

go.mod currently pins token-exchange-api to the #120 branch commit (24b46c9), which also raises some shared minimums (golang-jwt 5.3.0, fasthttp 1.65.0, swag 1.16.6, cloudevent 0.1.4). Re-point it to token-exchange-api main after #120 merges, before merging this.

Successor services

dauth and vt aren't live. If either takes over these routes, it needs the same check.

Tests

TestSignerCheckOnTelemetryRoutes: enforce refuses, empty mode enforces and allows an enabled signer, log never refuses, claimless tokens skip the check, an invalid mode fails startup.

The onboarding e2e test builds the app the way production does, with SIGNER_CHECK_MODE=off because it runs no token-exchange-api.