- AccessRevokedEvent and FireAccessRevoked: fired in the write's transaction
by the ban action (newly banned users only), the password reset, an
administrator setting a password and the self-service password change;
a revoked subject event per user after commit
- LinkedBackendUser answers no administrator for a banned user
- FireSubjectEvent / FireSubjectEventAfterCommit carry TokenID or ClientID;
DELETE /tokens/{id} ends only that token's MCP sessions
- the MCP personal-token path stamps last_used_ip from towel.ClientIP
- BackendLinksFor replaces the duplicate lookups; requestUsable uses
IsUsableAt
- classes.FrontendPermissionCatalog: the seeded rows, then codes activated
plugins declare through pact.HasFrontendPermissions (seeded row wins);
both permission editors offer it
- classes.MCPUserGuard (guard "user"): reads user.api_token, user.scope:*
and user.permission:*, allows with the route's checks (session scopes,
group grants, every code), dispatches with an in-memory token credential,
resolves usr_ personal tokens; registered in *pact.MCPGuards and published
as pact.MCPPersonalTokenResolver
- GET /_user/api/v1/token/me (user.api_token, user.scope:read) and the MCP
tool me (user_me)
- pact.MCPSubjectChanged on token revoke, Users saves and User Groups saves
and deletes
