Spec the JWT checks in your API middleware

Your Node and TypeScript API receives access tokens from your identity provider as JWTs, signed tokens that carry claims about the caller. An agent will write the Express middleware that checks each token and attaches the caller to the request. Last year a security review found a service elsewhere in the company reading token claims without checking the signature.

Write the spec you would hand the agent.

What you know:

• Node 20, Express, and the jose library is already installed
• the provider signs with RS256 and publishes its public keys at https://login.example.com/.well-known/jwks.json, rotating them every 90 days
• your API's audience is api://orders, and the issuer is https://login.example.com/
• scopes arrive in the scp claim, and each route declares the scope it needs

Then, in a few sentences: what well-known hole does "verify the JWT and read the user from it" tend to open?