Jakub Zych c3712dc0d4 fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects ...

classes.RevokeUserAccess stamps users.tokens_valid_after (whole seconds) and
revokes the users' personal API tokens; DeactivateUsers and BanUsers call
it for every selected user. Restore and unban revive nothing, and a
deactivated user who signs in again gets a fresh working token.

POST /refresh now loads the token's subject after bouncer.Refresh and
refuses a missing, deactivated or banned user and a token issued before
tokens_valid_after with the existing 401 body; a refused refresh stamps no
last_seen. Suspension is deliberately not checked.

2026-10-22 03:11:32 +02:00

..

organisations

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

usergroups

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

users

feat: create users with a password and an invitation in the admin

2026-10-05 13:21:51 +02:00

admin_registry.go

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

api_controller.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

api_tokens.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00

app_access.go

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

logger.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

oauth_identities.go

fix: atomic unlink with the PHP last-identity rule

2026-10-20 23:05:14 +02:00

organisations_admin_controller.go

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

registration.go

fix: log /register listener failures instead of discarding them

2026-10-22 03:07:22 +02:00

request_db.go

feat: register the Users admin screen with the privileged-member guard

2026-10-05 13:01:48 +02:00

usergroups_admin_controller.go

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

users_admin_controller.go

fix: an email change drops the address proof

2026-10-21 14:01:52 +02:00

winter_error_page.html

feat(07-07): replay the 15 user-api routes and both nuxt auth flows

2026-09-22 23:57:00 +02:00