Evan
4415b8a400
feat(security): terminate active sessions when an account is disabled
...
Disabling a user account (active=False) terminates that user's
outstanding sessions on their next request via a per-user invalidation
epoch (user_attribute.sessions_invalidated_at). Works for both
client-side cookie sessions and server-side session stores. Inert for
users that were never disabled (NULL epoch). The migration backfills the
epoch for accounts already disabled at upgrade time.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-10 11:24:30 -07:00
..
2026-04-24 15:52:42 -04:00
2026-04-24 15:52:42 -04:00
2025-07-31 19:27:42 -07:00
2026-06-09 10:17:44 -07:00
2026-04-24 15:52:42 -04:00
2026-06-03 13:30:05 -04:00
2026-06-08 10:51:25 -07:00
2026-05-11 08:30:13 -04:00
2026-06-03 12:55:15 +01:00
2026-05-05 12:07:46 -04:00
2026-06-05 17:57:44 -07:00
2026-06-09 11:08:08 -07:00
2026-02-04 12:37:17 +03:00
2025-08-06 00:17:50 -04:00
2026-03-04 11:26:28 -08:00
2026-04-08 20:14:59 -04:00
2026-06-09 10:29:46 -07:00
2026-06-02 11:37:30 +03:00
2026-06-10 11:24:30 -07:00
2026-04-24 15:52:42 -04:00
2026-06-03 12:55:38 +01:00
2026-06-05 16:36:30 -07:00
2026-04-24 15:52:42 -04:00
2026-04-22 11:14:59 -07:00
2026-05-12 17:59:52 -07:00
2026-03-06 11:57:03 -05:00
2026-04-24 15:52:42 -04:00
2026-04-24 15:52:42 -04:00
2025-07-31 19:27:42 -07:00
2026-06-03 12:55:25 +01:00
2026-05-12 17:59:52 -07:00
2025-12-03 14:26:35 -05:00
2026-06-09 11:37:08 -07:00
2025-10-16 16:33:37 -04:00
2026-04-24 15:52:42 -04:00
2025-09-12 09:21:37 +01:00
2025-07-31 19:27:42 -07:00
2026-04-15 15:57:04 +03:00
2026-04-24 15:52:42 -04:00
2026-05-26 21:17:08 -03:00
2026-05-01 16:24:59 -07:00
2026-06-05 11:41:40 -07:00
2026-06-02 21:50:27 +01:00
2026-03-17 10:20:09 -04:00
2026-06-02 21:50:27 +01:00
2026-06-05 16:36:30 -07:00
2026-06-01 09:42:08 -07:00
2026-01-21 12:42:15 -08:00
2025-07-31 19:27:42 -07:00
2026-04-24 15:52:42 -04:00
2026-02-18 19:52:06 -03:00
2026-06-05 16:36:30 -07:00
2025-12-09 16:59:07 +00:00
2026-05-08 16:11:13 -07:00