Marc-André BombeckandClaude Opus 4.7 b3f282adab fix(security): block force-logout from targeting the admin's own session ...

The UI already disabled the per-row force-logout button for the active
admin (user-management-section.tsx:295), but the route handler had no
matching server-side check. A direct curl/DevTools call (or a
compromised admin session) could revoke the caller's own sessions and
bounce them to /auth/login mid-action.

Mirrors the UI gate with a 422 + an `admin.user.force-logout.denied`
audit entry tagged `reason: self_target`. Admin-on-admin force-logout
remains permitted (today's intentional behaviour).

Closes H1 from .planning/phase-6-code-review-findings.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-09 17:41:46 +02:00

..

__tests__

test(coverage): real-behaviour tests for admin routes + glitchtip ingest (#141)

2026-05-08 14:29:48 +02:00

[id]

fix(security): block force-logout from targeting the admin's own session

2026-05-09 17:41:46 +02:00

route.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00