2 Commits

Author	SHA1	Message	Date
Jakub Zych	cc3636cea9	fix: a device revoke cannot lose to a concurrent refresh ... The revoke now reads the device's jti with UPDATE ... RETURNING under the row lock, and the refresh's hand-over (classes.FollowDeviceJTI) reports a session revoked meanwhile, so the refresh answers the blacklisted-token 401 without a token. A hand-over error fails the refresh closed instead of leaving the session on a stale jti.	2026-10-26 16:00:43 +01:00
Jakub Zych	1f3266a417	test: device authorization flow and its migration ... - TestDeviceCodes (classes, short): tokens, short-code alphabet and distribution, normalization - TestDeviceAuthURL, TestDeviceDisplayName (short): auth_url template, TTL, PHP's user-agent order - TestDeviceInitiate, TestDeviceStatus, TestDeviceAuthorize: PHP bodies for every state and refusal, bounded cleanup, short-code collision retry, concurrent authorizes binding one user - TestDeviceHandOverConcurrent, TestDeviceListAndRevoke, TestDeviceRevokeAfterRefresh, TestDeviceTokensAtRest - TestDeviceAuthSessionsMigration (updates): columns, constraints, indexes, cascade, rollback and re-up	2026-10-26 14:15:54 +01:00