Marc-André Bombeck 09f088e8a7 fix(auth): record a self sign-out as one in the session revoke audit ...

DELETE /api/auth/me/sessions/{id} takes the session's public handle, an HMAC
of the row id, and compared that handle with the caller's row id to decide
whether the caller signed out the session it was using. The two never match,
so every revoke was audited and annotated with self: false, including the
ones where a person ended their own session. The handle is compared with the
handle of the caller's session now.

2026-10-22 05:31:51 +02:00

..

fixtures

docs: publish the UI standards in docs/contributing

2026-10-21 19:37:22 +02:00

integration

fix(auth): record a self sign-out as one in the session revoke audit

2026-10-22 05:31:51 +02:00

kit

test(kit): call route handlers through the real API kit against Postgres

2026-10-22 05:30:31 +02:00