Jakub Zych be4a923f36 fix(cabana): enforce tokens_valid_after and is_activated on admin refresh ...

Fixes review finding CR-01 (quick 260927-q23): POST {prefix}/api/v1/auth/refresh
minted a new token without loading the admin, so a session kept alive by the
SPA's refresh-on-401 survived admin:reset-password, deactivation and deletion.
This broke Phase 9 truth T-09-04.

- bouncer: extract the JWT guard's subject lookup into subjectPrincipal and
  issuedBeforeCutoff (same order and messages), add ErrSubjectRejected
- bouncer: add RefreshAudienceFor, which runs the guard's subject checks
  after the token-only checks and before minting; Refresh and
  RefreshAudience are unchanged (nil hook)
- cabana: share one lazyBackendUsers provider between the backend guard and
  refresh; a cookie refresh refused for its subject expires summer_admin
- test: TestAdminRefreshRevocation (Postgres, real admin:reset-password)

2026-09-27 18:58:15 +02:00

..

audience_test.go

test(09-01): add failing audience crossover and authorization-order tests

2026-09-24 17:19:57 +02:00

backend_guard_test.go

test(09-12): add the phase 9 security matrix

2026-09-27 03:01:54 +02:00

blacklist_test.go

test(07-01): add failing tests for JWT lifecycle primitives

2026-09-22 13:33:37 +02:00

blacklist.go

feat(07-01): add JWT mint, refresh, and blacklist primitives

2026-09-22 13:34:58 +02:00

context_test.go

test(07-01): add failing tests for JWT lifecycle primitives

2026-09-22 13:33:37 +02:00

context.go

feat(09-11): add permissioned admin metadata and settings

2026-09-26 23:06:22 +02:00

cookie_guard_test.go

test(10-05): cover every Phase 10 Go change with branch-level tests

2026-09-27 18:05:28 +02:00

guard.go

feat(06-01): grow router verbs, factories, and guard registry

2026-09-19 18:59:12 +02:00

jwt_guard_test.go

test(07-01): add failing tests for JWT lifecycle primitives

2026-09-22 13:33:37 +02:00

jwt_test.go

test(06-14): regression coverage for surf and bouncer gap closure

2026-09-21 19:47:16 +02:00

jwt.go

fix(cabana): enforce tokens_valid_after and is_activated on admin refresh

2026-09-27 18:58:15 +02:00

mint_test.go

test(07-01): add failing tests for JWT lifecycle primitives

2026-09-22 13:33:37 +02:00

mint.go

feat(09-01): implement separate-admin genre list tracer

2026-09-24 17:17:19 +02:00

password_test.go

test(07-01): add failing tests for passwords, locale, and validation

2026-09-22 13:36:08 +02:00

password.go

feat(07-01): add bcrypt, locale override, and validation rules

2026-09-22 13:39:25 +02:00

phase07_coverage_test.go

feat(07-06): prove mint, refresh, and blacklist under concurrency

2026-09-22 19:20:14 +02:00

refresh_test.go

test(07-01): add failing tests for JWT lifecycle primitives

2026-09-22 13:33:37 +02:00

refresh.go

fix(cabana): enforce tokens_valid_after and is_activated on admin refresh

2026-09-27 18:58:15 +02:00

registry_coverage_test.go

test(06-05): close framework coverage gaps in bouncer, surf, wire, fetchguard

2026-09-19 21:08:04 +02:00

registry_test.go

test(10-05): cover every Phase 10 Go change with branch-level tests

2026-09-27 18:05:28 +02:00

registry.go

fix(06-12): reject typed-nil guards and fractional JWT subjects

2026-09-21 19:43:35 +02:00