kolaente 46ae983554 fix(websocket): check the session and close sockets on revocation ...

The socket only checked the token's signature and expiry. A token of a
deleted session or of a disabled user still authenticated, and an open
socket kept receiving notifications after logout, session revocation,
password change or account deletion.

Auth now requires the token's session to exist for that user and the
user to be active; the connection registers first and is checked once,
so a concurrent revocation can't slip in between. Transient errors close
with try-again-later instead of invalid_token. Each socket closes when
its token expires, which bounds exposure even on nodes that miss a
revocation event.

Deleting sessions dispatches SessionsRevokedEvent on commit, every caller
flushes it after committing, and the hub closes the matching sockets.
Disabling or locking a user and deleting a user revoke their sessions,
also from the CLI.

2026-10-02 19:08:02 +02:00

..

cmd.go

…

doctor.go

…

dump.go

…

healthcheck.go

…

migrate.go

…

repair_file_mime_types.go

…

repair_orphan_positions.go

…

repair_projects.go

…

repair_task_positions.go

…

repair.go

…

restore.go

…

testmail.go

…

user.go

…

version.go

…

web.go

…