Jakub Zych 8e4b863a3f fix: /fetch, /refresh, /update and /change-password accept the session cookies the jwt guard reads ...

The four routes (and the other signed-in routes through authenticate) read the bearer header, then the token and auth_token cookies, through classes.SessionToken and one cookie-aware guard.
A bearer header still wins and no credentials stays 401 with the old bodies.
A cookie-carried /refresh answers the rotated token in the body and writes no cookie.

2026-10-22 21:45:52 +02:00

..

admin_actions_test.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

admin_actions.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

api_tokens.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00

authorizer_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

authorizer.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

avatar.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

codes_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

codes.go

feat: users.email_verified_at records a proved address (mail activation, reset code)

2026-10-21 13:53:19 +02:00

events_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

events.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

handle_generator_test.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

handle_generator.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

last_seen_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

last_seen.go

feat: stamp users.last_seen on login and token refresh

2026-10-05 13:26:53 +02:00

logger.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

mail_test.go

feat(07-02): serve login, logout, fetch, and refresh

2026-09-22 14:40:18 +02:00

mail.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

oauth_providers.go

feat: provider source for oauth-providers and sign-in helpers for social login

2026-10-20 23:02:37 +02:00

permissions_test.go

test: extend the permission resolver table, the admin migration history and the API token refusals

2026-10-05 15:23:23 +02:00

permissions.go

feat: frontend permissions and the merged-permission resolver

2026-10-05 13:21:51 +02:00

privileged_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

privileged.go

fix: read privileged membership and the admin actions through a clean statement (T-12.1-38, T-12.1-39)

2026-10-05 14:53:41 +02:00

registry.go

feat(05-01): restructure fonoteka plugins into Winter directories

2026-09-18 18:43:31 +02:00

session_user.go

fix: /fetch, /refresh, /update and /change-password accept the session cookies the jwt guard reads

2026-10-22 21:45:52 +02:00

throttle_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

throttle.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

user_groups_test.go

test: cover user group codes and the small class helpers

2026-10-02 16:19:06 +02:00

user_groups.go

feat: add Winter user groups

2026-10-02 11:44:01 +02:00

user_lookup.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00