copilot-swe-agent[bot] a4588a57cb feat(auth): add server-side session management and QR code login backend ...

- Add UserSession and QRLoginChallenge models for session tracking
  and mobile QR authentication
- Add session_manager utility with create/validate/revoke/cleanup
  functions and QR challenge helpers
- Add /api/sessions endpoints for listing, revoking, and
  'log off everywhere' functionality
- Add /api/qr-auth endpoints for challenge creation, polling, and
  claiming with API token issuance
- Add session config fields (lifetime, custom override, QR TTL)
- Update get_current_user to validate server-side sessions
- Create server-side sessions on all login paths (local, OAuth,
  social, admin)
- Revoke server-side session on logout
- Configure SessionMiddleware max_age from session lifetime settings
- Graceful degradation: old sessions without _session_token continue
  to work

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-03-16 22:29:04 +00:00

..

__init__.py

feat(auth): add server-side session management and QR code login backend

2026-03-16 22:29:04 +00:00

admin_users.py

fix(auth): activate account on password reset and fix is_active check order

2026-03-08 12:07:25 +00:00

api_tokens.py

fix(security): address CodeQL clear-text logging and weak hashing alerts

2026-03-08 19:33:55 +00:00

audit_logs.py

fix(security): remove clear-text logging of sensitive data and fix Annotated+Depends pattern

2026-03-16 12:07:04 +00:00

azure.py

style: fix all flake8 linter errors across app/ directory

2026-02-08 17:42:33 +00:00

backup.py

feat(backup): extend backup and restore to PostgreSQL and MySQL/MariaDB

2026-03-08 09:56:58 +00:00

billing.py

fix(security): clarify billing log message wording

2026-03-16 12:23:07 +00:00

common.py

refactor: consolidate get_db into single module

2026-02-09 15:37:23 +00:00

compliance.py

fix(compliance): address code review feedback - add aria-busy, input validation, use IntegrityError

2026-03-10 00:09:08 +00:00

database.py

fix: address code review feedback

2026-03-05 22:22:49 +00:00

diagnostic.py

feat(api): add GET /api/diagnostic/health endpoint for monitoring

2026-03-01 18:36:38 +00:00

dropbox.py

perf: optimize dropbox token refresh by replacing blocking requests with httpx

2026-03-16 09:19:55 +00:00

duplicates.py

perf(duplicates): fix N+1 query in group listing

2026-03-16 09:16:31 +00:00

files.py

fix(security): remove clear-text logging of sensitive data and fix Annotated+Depends pattern

2026-03-16 12:07:04 +00:00

google_drive.py

Fix naming inconsistency in Google Drive API

2026-03-16 08:59:13 +00:00

graphql_api.py

feat(api): add GraphQL endpoint at /graphql with Strawberry

2026-03-11 22:17:25 +00:00

i18n.py

fix(migrations): re-chain mobile devices migration against main and restore merge conflicts

2026-03-11 20:43:29 +00:00

imap_accounts.py

feat(imap): add ImapIngestionProfile model, API, migration and UI

2026-03-12 01:14:19 +00:00

imap_profiles.py

fix(imap): address code review feedback on ingestion profiles

2026-03-12 01:19:32 +00:00

integrations.py

style: apply ruff auto-fix

2026-03-15 04:10:28 +00:00

local_auth.py

fix(i18n): register _ in all Jinja2 template instances, sync translation files, fix pipelines.html

2026-03-12 12:46:11 +00:00

logs.py

feat(security): add comprehensive input validation and sanitization (#172)

2026-02-22 16:02:00 +00:00

mobile.py

feat(mobile): add iOS/Android mobile app with SSO login, camera upload, and push notifications

2026-03-10 09:52:02 +00:00

notifications.py

perf(api): fix n+1 query issue in user notification preferences update

2026-03-16 09:20:41 +00:00

onboarding.py

feat(notifications): admin push notifications and webhooks for user signup, plan changes, and payment issues

2026-03-07 20:15:39 +00:00

onedrive.py

Merge pull request #714 from christianlouis/perf/async-onedrive-token-refresh-7215258063318287629

2026-03-16 12:15:39 +01:00

openai.py

fix(api): swap parameter order in test_ai_extraction to fix 500 error

2026-02-23 21:35:36 +00:00

pipelines.py

feat(ocr): add multi-language OCR support with per-pipeline language override

2026-03-08 21:47:12 +00:00

plans.py

perf(api): optimize reorder_plans to prevent N+1 queries

2026-03-16 09:19:50 +00:00

process.py

Apply Black and isort formatting to modified files

2026-02-07 15:00:18 +00:00

profile.py

feat(profile): expose default_document_language in profile API and UI

2026-03-16 12:13:54 +00:00

qr_auth.py

feat(auth): add server-side session management and QR code login backend

2026-03-16 22:29:04 +00:00

queue.py

refactor(queue): address code review feedback — extract constants and sync refresh interval

2026-02-27 00:47:58 +00:00

routing_rules.py

refactor(routing): address code review feedback - simplify list filter, fix docs example

2026-03-09 23:38:25 +00:00

saved_searches.py

fix(security): address CodeQL clear-text logging and weak hashing alerts

2026-03-08 19:33:55 +00:00

scheduled_jobs.py

fix: code standards audit — 100% coverage, Pydantic v2 model_config, asyncio.run(), targeted edge-case tests

2026-03-09 19:00:13 +00:00

search.py

feat(search): add content-finding filters, saved searches, and text quality to Search view

2026-03-01 13:46:15 +00:00

sessions.py

feat(auth): add server-side session management and QR code login backend

2026-03-16 22:29:04 +00:00

settings.py

feat(settings): add dynamic autocomplete for AWS/Azure regions, OCR langs, and embedding models

2026-03-05 22:00:22 +00:00

shared_links.py

⚡ fix N+1 query in list_shared_links

2026-03-16 09:14:36 +00:00

similarity.py

fix(similarity): address code review - column-only queries, configurable batch size, WCAG touch targets

2026-03-02 13:39:10 +00:00

subscriptions.py

feat(subscriptions): add subscription change management with upgrade/downgrade scheduling

2026-03-07 20:14:12 +00:00

translation.py

fix(translation): fix apply_owner_filter called with wrong arguments

2026-03-16 15:25:29 +00:00

url_upload.py

perf: optimize url upload with async i/o

2026-03-16 09:53:47 +00:00

user.py

feat(profile): add user self-service profile settings page and API

2026-03-12 13:00:19 +00:00

webhooks.py

feat(webhooks): add webhook support for external integrations

2026-03-01 20:42:57 +00:00