饺子w (Yumechi)
ad977d3d9c
feat: EdDSA token for database leakage/index mitigation ( #971 )
...
* feat: EdDSA token for database leakage/index mitigation
* [skip ci]: remove token from api output
* fix: e2e tests
* fixup! fix: e2e tests
* doc: document tokens are now optional fields for app and aclient
* fixup(doc): swagger version again
* address review comments
* address review comments
2026-06-28 14:58:20 +00:00
Jannis Mattheis
cf9a1ea32f
fix: align session client expiry with cookie max age
2026-05-18 17:16:08 +02:00
Jannis Mattheis
cbf5b07c90
feat: add created at to all models
2026-05-09 20:11:06 +02:00
Jannis Mattheis
624ab65742
fix: elevate session on login
2026-04-19 19:43:52 +02:00
Jannis Mattheis
c256025b9f
fix: return client id and elevatedUntil on /current/user
2026-04-19 19:24:18 +02:00
Jannis Mattheis
410571dd18
fix: prevent duplicate requests for apps / clients
2026-04-19 19:22:30 +02:00
Jannis Mattheis
d432900486
fix: logout to /auth/logout and swagger docs
...
With session elevation, we cannot use DELETE /client as this requires
elevation. It should be possible to logout without an elevated session.
This makes the logout endpoint public api to be used by the android app.
2026-04-19 18:00:16 +02:00
Jannis Mattheis
57878e0574
fix: make secure cookie configurable
2026-04-11 18:53:48 +02:00
Jannis Mattheis
50d0572584
feat: implement /auth/local/{login,logout}
2026-04-11 18:53:48 +02:00
