mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-03-17 04:20:10 -05:00
- Session struct with UUID primary key, hashed refresh token, device info, IP address, and last-active tracking - Token generation via generateHashedToken (SHA-256, 128 random bytes) - CreateSession, GetSessionByRefreshToken, GetSessionByID - Atomic RotateRefreshToken with WHERE on old hash to prevent replays - ReadAll scoped to authenticated user (link shares rejected) - Delete scoped to owning user (link shares rejected) - Hourly cleanup cron for expired sessions based on is_long_session - ErrSessionNotFound error type with HTTP 404 mapping