Jakub Zych 30f7a01d3d fix: a self-service password change revokes every OAuth grant, however recently refreshed ...

ChangePassword fired the access-revoked event with Before = the calling
session's iat, so an OAuth/MCP grant whose client refreshed it after that
instant kept working. Before is now the instant of the request; the stored
tokens_valid_after still keeps the calling session.

2026-10-23 20:48:38 +02:00

9.8 KiB

Raw Blame History

View Raw