Jakub Zych a1b78b80f5 fix: the MCP dispatch credential carries the personal token id ...

MCPUserGuard.MCPDispatch now sets the in-memory credential's ID to the
subject's TokenID when the subject came from a personal usr_ token (no
ClientID), so a handler running under MCP dispatch can record which
token made a change. An OAuth subject's TokenID names the OAuth
server's token row, so its credential keeps ID 0. The credential is
still never saved.

2026-10-28 11:30:44 +01:00

..

access_revoked.go

fix: access-revoked event on ban and password changes, banned users lose their link, token-specific MCP revoke

2026-10-23 16:47:56 +02:00

admin_actions_test.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

admin_actions.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

api_token_scopes.go

feat: plugin-declared member token scopes (pact.HasFrontendTokenScopes)

2026-10-23 17:00:12 +02:00

api_tokens.go

docs: mark MintAPIToken deprecated in favour of MintAPITokenFor

2026-10-23 21:16:47 +02:00

authorizer_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

authorizer.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

avatar.go

fix: the avatar and logo URL fallback follows the configured public path

2026-10-23 21:11:04 +02:00

backend_links.go

docs: state the one-second blind spot of the account link's auth_time proof

2026-10-23 21:08:12 +02:00

codes_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

codes.go

feat: users.email_verified_at records a proved address (mail activation, reset code)

2026-10-21 13:53:19 +02:00

device_auth_test.go

test: device authorization flow and its migration

2026-10-26 14:15:54 +01:00

device_auth.go

fix: keep the device polling token off the QR code

2026-10-26 16:12:08 +01:00

events_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

events.go

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

frontend_permission_catalog.go

feat: user MCP guard provider, plugin frontend permissions and the user_me tool

2026-10-23 12:08:38 +02:00

handle_generator_test.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

handle_generator.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

last_seen_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

last_seen.go

feat: stamp users.last_seen on login and token refresh

2026-10-05 13:26:53 +02:00

logger.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

login_gate.go

feat: login gates and the login event

2026-10-26 09:55:48 +01:00

mail_test.go

feat(07-02): serve login, logout, fetch, and refresh

2026-09-22 14:40:18 +02:00

mail.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

mcp_guard.go

fix: the MCP dispatch credential carries the personal token id

2026-10-28 11:30:44 +01:00

oauth_providers.go

feat: provider source for oauth-providers and sign-in helpers for social login

2026-10-20 23:02:37 +02:00

organisation_logo.go

fix: the avatar and logo URL fallback follows the configured public path

2026-10-23 21:11:04 +02:00

permissions_test.go

test: extend the permission resolver table, the admin migration history and the API token refusals

2026-10-05 15:23:23 +02:00

permissions.go

feat: frontend permissions and the merged-permission resolver

2026-10-05 13:21:51 +02:00

privileged_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

privileged.go

feat: link and unlink an administrator's frontend account on the Administrators screen

2026-10-23 12:14:21 +02:00

registry.go

feat(05-01): restructure fonoteka plugins into Winter directories

2026-09-18 18:43:31 +02:00

session_user.go

fix: a /refresh carried by the auth.cookie session cookie rewrites that cookie, so an HttpOnly session survives the rotation

2026-10-22 23:39:18 +02:00

subject_events.go

fix: access-revoked event on ban and password changes, banned users lose their link, token-specific MCP revoke

2026-10-23 16:47:56 +02:00

throttle_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

throttle.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

two_factor_admin.go

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

user_groups_test.go

test: cover user group codes and the small class helpers

2026-10-02 16:19:06 +02:00

user_groups.go

feat: add Winter user groups

2026-10-02 11:44:01 +02:00

user_lookup.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00