2 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	1af3a6e90a	feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31) ... - Every login is a session (device, IP, last use); the token's jti is its ID. Sessions end on logout, per device from the profile, or after 30 idle days. - Tokens older than a day are renewed via the X-Session-Token header. - Changing password or login e-mail needs the current password; a new password logs out all other devices and mails the old address. - Demo reset keeps the demo visitors' sessions. - revoked_tokens is replaced by sessions (migration 4); everyone is logged out once after the upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 19:25:22 +01:00
sandrodachandClaude Opus 5.5	0fdf46635b	test(frontend): task dialog, sharing avatars, trash, API key scopes, passwords (FLAW-19) ... Covers opening and closing the task dialog (the former hook-order bug), date/time fields and the view-only mode for viewer lists, the avatar stack of shared items, the two-tap delete in the trash, scope selection and badges of API keys, and the shared password rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 15:03:54 +01:00