Jakub Zych cc3636cea9 fix: a device revoke cannot lose to a concurrent refresh ...

The revoke now reads the device's jti with UPDATE ... RETURNING under the
row lock, and the refresh's hand-over (classes.FollowDeviceJTI) reports a
session revoked meanwhile, so the refresh answers the blacklisted-token
401 without a token. A hand-over error fails the refresh closed instead
of leaving the session on a stale jti.

2026-10-26 16:00:43 +01:00

..

organisations

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

usergroups

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

users

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

admin_registry.go

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

api_controller.go

fix: a device revoke cannot lose to a concurrent refresh

2026-10-26 16:00:43 +01:00

api_tokens.go

feat: plugin-declared member token scopes (pact.HasFrontendTokenScopes)

2026-10-23 17:00:12 +02:00

app_access.go

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

backend_link_controller.go

fix: the backend link show and confirm POSTs ignore a code in the query string

2026-10-23 21:08:00 +02:00

devices.go

fix: a device revoke cannot lose to a concurrent refresh

2026-10-26 16:00:43 +01:00

logger.go

feat: console help, examples and named loggers (SummerCMS v0.4.0)

2026-10-21 18:03:50 +02:00

login_gates.go

feat: login gates and the login event

2026-10-26 09:55:48 +01:00

oauth_identities.go

fix: atomic unlink with the PHP last-identity rule

2026-10-20 23:05:14 +02:00

organisations_admin_controller.go

fix: organisation attachment cleanup runs in FormAfterDelete

2026-10-23 18:40:59 +02:00

registration.go

feat: login gates and the login event

2026-10-26 09:55:48 +01:00

request_db.go

feat: register the Users admin screen with the privileged-member guard

2026-10-05 13:01:48 +02:00

token_me.go

feat: user MCP guard provider, plugin frontend permissions and the user_me tool

2026-10-23 12:08:38 +02:00

usergroups_admin_controller.go

fix: user groups delete keeps FormAfterDelete's declaration; members' subject events fire from FormBeforeDelete

2026-10-23 12:16:53 +02:00

users_admin_controller.go

feat: password-change hook and the reset-2FA admin slot

2026-10-26 10:03:59 +01:00

winter_error_page.html

feat(07-07): replay the 15 user-api routes and both nuxt auth flows

2026-09-22 23:57:00 +02:00