2 Commits

Author	SHA1	Message	Date
Evan	4415b8a400	feat(security): terminate active sessions when an account is disabled ... Disabling a user account (active=False) terminates that user's outstanding sessions on their next request via a per-user invalidation epoch (user_attribute.sessions_invalidated_at). Works for both client-side cookie sessions and server-side session stores. Inert for users that were never disabled (NULL epoch). The migration backfills the epoch for accounts already disabled at upgrade time. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-10 11:24:30 -07:00
Daniel Vaz Gaspar	5815665cc6	feat: role/user CRUD events and login/logout tracking in the action log (#39121) ... Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-09 15:55:25 +01:00