PREWAVE-BE-097 — Replace Predictable Unsubscribe Values with Single-Use Signed Tokens #798

Problem context

EmailChannel.generateUnsubscribeToken() currently returns ${userId}-${Date.now()}. This is predictable, embeds the user identifier, and has no demonstrated expiry, integrity protection, or replay policy.

Technical scope

Implement cryptographically secure, opaque unsubscribe tokens with bounded expiry, purpose binding, single-use/replay protection, and server-side verification or an equivalently reviewed authenticated-token design. Do not expose user IDs or other account identifiers in the token. Ensure unsubscribe actions only affect the intended channel and user, and are idempotent.

Required tests

• Entropy and token unpredictability tests.
• Expiry, tampering, cross-user substitution, replay, and duplicate unsubscribe cases.
• Token redaction in logs and telemetry.
• Email unsubscribe URL parsing and safe failure behavior.

Security and architecture constraints

• Contracts and finalized canonical events remain authoritative for protocol state.
• The API remains a projection/read and notification-delivery layer; it must not invent protocol outcomes.
• Fail closed on missing, stale, ambiguous, unauthorized, or incomplete state.
• Do not expose secrets, device tokens, email verification tokens, private evidence, or unnecessary personal data.
• Preserve strict typing, idempotency, privacy, observability redaction, and existing CI/security gates.

Acceptance criteria

• The identified placeholder or unsafe behavior is replaced by a production-quality implementation.
• Provider/recipient/ownership behavior is explicit and documented.
• Every required failure mode is covered by automated tests.
• No synthetic success, cross-user data exposure, or secret leakage remains in the affected path.
• The pull request links exactly this issue and maps evidence to every acceptance criterion.
• Exact-head required CI passes and independent human review is recorded.

Dependencies

• API PREWAVE-BE-025 — Validate Optional Notification Channel Configuration Fail Closed #621 — notification channel configuration and preference enforcement.

Non-goals

Changing global account deletion or authentication session tokens.

Complexity and points

• High — 200 points

Candidate only. Activation remains maintainer-controlled; do not apply Stellar Wave as part of implementation.