fischer-agentkit

Commit Graph

Author	SHA1	Message	Date
chiguyong	698a8fafba	fix(review): U7 refresh token hash verification on whoami The whoami route accepted rotated/old refresh tokens for cold-start because it only checked session revocation status, not the token hash. Now when token_type == "refresh", the route computes hash_token(token) and compares it with the session's stored refresh_token_hash using hmac.compare_digest (constant-time). Mismatch returns 401. - Add SessionService.get_stored_refresh_hash(session_id) helper - Add hash verification in whoami route (R9) - Add TestWhoamiTokenHash with 5 integration tests	2026-06-22 16:55:20 +08:00
chiguyong	67c0d67262	fix(auth,chat): P0 security fixes + stop-generation button + doc sync U1: whoami cold-start security — add is_active check (disabled users now get 401, not 200) and replace create_token_pair with create_access_token to avoid minting a discarded refresh token (token-amplification risk). U2: list_active_by_provider now filters expired sessions (expires_at > now) matching its docstring promise; previously only checked revoked = 0. U3: Fix asyncio.run() crash in test_revoke_other_user_session_returns_404 (converted to async). Add U1/U2 verification tests (disabled-user whoami, no-refresh-leak, expired-session filtering, provider filtering) and strengthen admin route tests (404 boundary, non-admin 403 on /admin/sessions). U4: Update CLAUDE.md/AGENTS.md Request Flow — CostAwareRouter 3-layer diagram replaced with actual RequestPreprocessor architecture (@board/@team prefix intercepts then @skill: prefix then trivial-input regex then default REACT). ExecutionMode list expanded to all 7 values. U5: Frontend stop-generation button — ChatInput.vue shows a stop button when isGenerating is true; chat store gains stopGeneration() that sends {type:"cancel"} over WebSocket (backend portal.py already handles cancel). Tests: 120 auth tests pass (unit + integration). ruff clean. vue-tsc clean.	2026-06-21 11:36:58 +08:00
chiguyong	aee7362665	feat(auth): U3/U4/U9 logout-others + whoami cold-start + admin UI + integration tests	2026-06-21 09:08:34 +08:00

Author

SHA1

Message

Date

chiguyong

698a8fafba

fix(review): U7 refresh token hash verification on whoami

The whoami route accepted rotated/old refresh tokens for cold-start
because it only checked session revocation status, not the token hash.
Now when token_type == "refresh", the route computes hash_token(token)
and compares it with the session's stored refresh_token_hash using
hmac.compare_digest (constant-time). Mismatch returns 401.

- Add SessionService.get_stored_refresh_hash(session_id) helper
- Add hash verification in whoami route (R9)
- Add TestWhoamiTokenHash with 5 integration tests

2026-06-22 16:55:20 +08:00

chiguyong

67c0d67262

fix(auth,chat): P0 security fixes + stop-generation button + doc sync

U1: whoami cold-start security — add is_active check (disabled users
now get 401, not 200) and replace create_token_pair with create_access_token
to avoid minting a discarded refresh token (token-amplification risk).

U2: list_active_by_provider now filters expired sessions (expires_at > now)
matching its docstring promise; previously only checked revoked = 0.

U3: Fix asyncio.run() crash in test_revoke_other_user_session_returns_404
(converted to async). Add U1/U2 verification tests (disabled-user whoami,
no-refresh-leak, expired-session filtering, provider filtering) and
strengthen admin route tests (404 boundary, non-admin 403 on /admin/sessions).

U4: Update CLAUDE.md/AGENTS.md Request Flow — CostAwareRouter 3-layer
diagram replaced with actual RequestPreprocessor architecture (@board/@team
prefix intercepts then @skill: prefix then trivial-input regex then default
REACT). ExecutionMode list expanded to all 7 values.

U5: Frontend stop-generation button — ChatInput.vue shows a stop button
when isGenerating is true; chat store gains stopGeneration() that sends
{type:"cancel"} over WebSocket (backend portal.py already handles cancel).

Tests: 120 auth tests pass (unit + integration). ruff clean. vue-tsc clean.

2026-06-21 11:36:58 +08:00

chiguyong

aee7362665

feat(auth): U3/U4/U9 logout-others + whoami cold-start + admin UI + integration tests

2026-06-21 09:08:34 +08:00

3 Commits