kolaente 98abca499a fix(auth): sync OIDC and LDAP avatars after the login commits ...

Address review decision: the provider avatar was decoded inside the login
transaction after the user row was written, holding it while queued for
decode capacity, and a later rollback (TOTP, disabled user) discarded the
work. Logins now commit first; the avatar is decoded without a session
and saved in its own short transaction.

2026-10-20 23:05:30 +02:00

..

ldap

fix(auth): sync OIDC and LDAP avatars after the login commits

2026-10-20 23:05:30 +02:00

oauth2server

fix(auth): refuse email-unconfirmed accounts on every credential path

2026-10-20 15:13:02 +02:00

openid

fix(auth): sync OIDC and LDAP avatars after the login commits

2026-10-20 23:05:30 +02:00

auth_context_test.go

perf(auth): reuse the api token owner from the request context

2026-09-06 16:40:57 +02:00

auth_test.go

fix(auth): send the refresh cookie with SameSite=Lax

2026-10-02 19:08:02 +02:00

auth.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00