Nick SzaunigandClaude Opus 5.5 2de93bc087 fix(auth): atomic refresh rotation and a 7-day absolute session limit ...

- Rotation claims the old token with a conditional update; of two
  concurrent refreshes only one gets a successor, so a stolen token cannot
  fork into two live sessions.
- A token rotated out less than 10 s ago (parallel tab) is refused without
  revoking every session; later reuse still revokes them all.
- Sessions end at most SESSION_MAX_AGE (default 7 days) after login: the
  login time is inherited by every rotated token and caps its expiry.
- The refresh cookie is cleared with the same attributes it was set with.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 02:30:32 +02:00

..

migrations

fix(auth): atomic refresh rotation and a 7-day absolute session limit

2026-10-01 02:30:32 +02:00

schema.prisma

fix(auth): atomic refresh rotation and a 7-day absolute session limit

2026-10-01 02:30:32 +02:00

seed.ts

feat: seed a starter annual task-template calendar

2026-09-05 17:58:28 +02:00