Jakub Zych cc3636cea9 fix: a device revoke cannot lose to a concurrent refresh ...

The revoke now reads the device's jti with UPDATE ... RETURNING under the
row lock, and the refresh's hand-over (classes.FollowDeviceJTI) reports a
session revoked meanwhile, so the refresh answers the blacklisted-token
401 without a token. A hand-over error fails the refresh closed instead
of leaving the session on a stale jti.

2026-10-26 16:00:43 +01:00

..

access_revoked.go

fix: access-revoked event on ban and password changes, banned users lose their link, token-specific MCP revoke

2026-10-23 16:47:56 +02:00

admin_actions_test.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

admin_actions.go

fix: deactivate and ban revoke sessions and API tokens, and /refresh refuses deactivated, banned and cut-off subjects

2026-10-22 03:11:32 +02:00

api_token_scopes.go

feat: plugin-declared member token scopes (pact.HasFrontendTokenScopes)

2026-10-23 17:00:12 +02:00

api_tokens.go

docs: mark MintAPIToken deprecated in favour of MintAPITokenFor

2026-10-23 21:16:47 +02:00

authorizer_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

authorizer.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

avatar.go

fix: the avatar and logo URL fallback follows the configured public path

2026-10-23 21:11:04 +02:00

backend_links.go

docs: state the one-second blind spot of the account link's auth_time proof

2026-10-23 21:08:12 +02:00

codes_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

codes.go

feat: users.email_verified_at records a proved address (mail activation, reset code)

2026-10-21 13:53:19 +02:00

device_auth_test.go

test: device authorization flow and its migration

2026-10-26 14:15:54 +01:00

device_auth.go

fix: a device revoke cannot lose to a concurrent refresh

2026-10-26 16:00:43 +01:00

events_test.go

feat(19-04): user authorizer, user.Deleting and handle backfill

2026-10-17 21:53:21 +02:00

events.go

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

frontend_permission_catalog.go

feat: user MCP guard provider, plugin frontend permissions and the user_me tool

2026-10-23 12:08:38 +02:00

handle_generator_test.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

handle_generator.go

feat(19-04): add users.handle, HandleGenerator and user.Created

2026-10-17 21:44:59 +02:00

last_seen_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

last_seen.go

feat: stamp users.last_seen on login and token refresh

2026-10-05 13:26:53 +02:00

logger.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

login_gate.go

feat: login gates and the login event

2026-10-26 09:55:48 +01:00

mail_test.go

feat(07-02): serve login, logout, fetch, and refresh

2026-09-22 14:40:18 +02:00

mail.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

mcp_guard.go

fix: access-revoked event on ban and password changes, banned users lose their link, token-specific MCP revoke

2026-10-23 16:47:56 +02:00

oauth_providers.go

feat: provider source for oauth-providers and sign-in helpers for social login

2026-10-20 23:02:37 +02:00

organisation_logo.go

fix: the avatar and logo URL fallback follows the configured public path

2026-10-23 21:11:04 +02:00

permissions_test.go

test: extend the permission resolver table, the admin migration history and the API token refusals

2026-10-05 15:23:23 +02:00

permissions.go

feat: frontend permissions and the merged-permission resolver

2026-10-05 13:21:51 +02:00

privileged_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

privileged.go

feat: link and unlink an administrator's frontend account on the Administrators screen

2026-10-23 12:14:21 +02:00

registry.go

feat(05-01): restructure fonoteka plugins into Winter directories

2026-09-18 18:43:31 +02:00

session_user.go

fix: a /refresh carried by the auth.cookie session cookie rewrites that cookie, so an HttpOnly session survives the rotation

2026-10-22 23:39:18 +02:00

subject_events.go

fix: access-revoked event on ban and password changes, banned users lose their link, token-specific MCP revoke

2026-10-23 16:47:56 +02:00

throttle_test.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

throttle.go

refactor: rename module to git.golem15.com/golem15/sm-user-plugin

2026-10-02 10:56:06 +02:00

two_factor_admin.go

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

user_groups_test.go

test: cover user group codes and the small class helpers

2026-10-02 16:19:06 +02:00

user_groups.go

feat: add Winter user groups

2026-10-02 11:44:01 +02:00

user_lookup.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00