mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-11-10 15:16:20 -06:00
kolaente
46ae983554
The socket only checked the token's signature and expiry. A token of a deleted session or of a disabled user still authenticated, and an open socket kept receiving notifications after logout, session revocation, password change or account deletion. Auth now requires the token's session to exist for that user and the user to be active; the connection registers first and is checked once, so a concurrent revocation can't slip in between. Transient errors close with try-again-later instead of invalid_token. Each socket closes when its token expires, which bounds exposure even on nodes that miss a revocation event. Deleting sessions dispatches SessionsRevokedEvent on commit, every caller flushes it after committing, and the hub closes the matching sockets. Disabling or locking a user and deleting a user revoke their sessions, also from the CLI.