mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-19 10:48:17 -05:00
kolaente
dbe664dec5
GetUserFromClaims read the id claim straight into User.ID without checking the token type. A link share JWT carries the raw, positive share id in that claim and reaches every authenticated route, so the only thing preventing impersonation was the incidental absence of a username claim in link share tokens. Adding one would have reintroduced the confusion with a positive id, bypassing the GetID negation entirely. AuthTypeUser moves to pkg/user, which parses the claims and cannot import pkg/modules/auth, so the value exists once.