Maurice 1ad6ae0ebc fix(auth): keep demo visitors out of each other's sessions ...

On a demo instance every visitor signs in as the one shared demo
account, so its sessions are other people's browsers. The session
routes had no demo check, unlike the password, MFA and account
changes, so any visitor could read the User-Agent of everyone else
signed in and sign them all out with revoke-others.

For the shared demo account in demo mode, GET /api/auth/sessions now
lists only the session the request came with, and DELETE
/api/auth/sessions/:id and POST /api/auth/sessions/revoke-others answer
403 "Sessions cannot be ended in demo mode." without ending anything.
Logout still ends the visitor's own session. Other accounts on a demo
instance keep the full routes. No MCP tool covers sessions, so there is
no parallel tool to change.

The demo sign-in now records the device's User-Agent on its session
like every other sign-in, which the session list needs to tell the
visitor's own entry apart.

2026-10-08 18:43:42 +02:00

..

ephemeral-tokens.test.ts

refactor(server): fold the ephemeral-token store and the in-app action registry (#1836)

2026-08-07 22:18:14 +02:00

jwt-verify.test.ts

feat(auth): track sign-in sessions so a session can end before it expires

2026-10-08 18:43:06 +02:00

sessions.controller.test.ts

fix(auth): keep demo visitors out of each other's sessions

2026-10-08 18:43:42 +02:00