Wire the user API session loop to the JWT blacklist and a pre-password throttle gate so a logged-out token cannot be fetched again.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Verify inv_ tokens against ApiToken hash, expiry, revocation, last-used
- InvScope writes PHP TokenScope 401/403 bodies and gates on HasScope
- Register jwt and inv_token on the shared bouncer.Registry at plugin Boot
- Move models, classes, controllers, middleware, and updates into subpackages
- Add self-registering models/updates/classes registries so later plans add files
- Keep the genres route and shipped migration SQL unchanged
golem15.user registers jwt.auth, golem15.fonoteka mounts GET /_fonoteka/api/v1/genres
through that guard, and a smoke test reads the 15 migrated rows with a test-only token.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add compiled golem15.user and golem15.fonoteka plugins, squash schema
to the genre slice tables, and seed the 15 canonical genres on ICU pl-PL.
Co-authored-by: Cursor <cursoragent@cursor.com>
