Release govoplan-access v0.1.25: harden authentication and repair identity mappings

2026-09-08 01:32:20 +02:00
parent 0f8a05f8b9
commit 8f8072b4ae
25 changed files with 742 additions and 38 deletions
@@ -11,6 +11,21 @@ session is deliberately protected by these operations; use normal logout to end
 it. Repeating a revocation is safe. Revoked sessions fail authentication on the
 next request, including when a principal summary was previously cached.

+The shared WebUI clears reusable API response data on explicit authentication,
+account, tenant, and permission transitions, changed session/CSRF cookies, and
+authentication-expiry responses. Late reads cannot repopulate caches after those
+transitions or after a write finishes. `no-store` responses are not retained;
+`no-cache` responses require server revalidation, with ETags retained only where
+storage is allowed. Reload bypasses older cached responses. These safeguards do
+not erase content already displayed by a page: reload that page to reflect
+remote changes. The server remains authoritative for every permission check.
+
+Successful interactive sign-in, including re-login, and local sign-out clear
+the saved automation API key. It must not shadow the newly established cookie
+session with a different principal. Explicitly applying an API key in connection
+settings still selects that credential's identity and triggers a new shell
+authentication check. Ordinary profile updates in API-key mode retain the key.
+
 Tenant administrators may list sessions only for a membership in their governed
 tenant and may revoke only a session belonging to that membership and tenant.
 The mutation requires both the central membership-update permission and an