4 Commits

Author	SHA1	Message	Date
copilot-swe-agent[bot]	bd03d1971b	refactor(auth): extract _ensure_tz_aware helper, use validate_session in logout ... Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>	2026-03-17 10:17:19 +00:00
copilot-swe-agent[bot]	a022dec9c2	fix(auth): resolve timezone-naive datetime comparisons in QR challenge functions and update docs ... Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>	2026-03-17 10:13:19 +00:00
copilot-swe-agent[bot]	d5e1d92d6f	Changes before error encountered ... Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>	2026-03-16 22:54:13 +00:00
copilot-swe-agent[bot]	a4588a57cb	feat(auth): add server-side session management and QR code login backend ... - Add UserSession and QRLoginChallenge models for session tracking and mobile QR authentication - Add session_manager utility with create/validate/revoke/cleanup functions and QR challenge helpers - Add /api/sessions endpoints for listing, revoking, and 'log off everywhere' functionality - Add /api/qr-auth endpoints for challenge creation, polling, and claiming with API token issuance - Add session config fields (lifetime, custom override, QR TTL) - Update get_current_user to validate server-side sessions - Create server-side sessions on all login paths (local, OAuth, social, admin) - Revoke server-side session on logout - Configure SessionMiddleware max_age from session lifetime settings - Graceful degradation: old sessions without _session_token continue to work Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-16 22:29:04 +00:00