Hartmut 3452464809 fix(security): invalidate sessions on password change and remove hash from permission API responses ...

- setUserPassword and resetPassword now call activeSession.deleteMany after
  updating the passwordHash, so any pre-change sessions are immediately revoked
  (CWE-613 session fixation after credential change)
- setUserPermissions and resetUserPermissions now use explicit Prisma select to
  exclude passwordHash and totpSecret from the returned user object

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 21:37:56 +02:00

..

scripts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

src

fix(security): invalidate sessions on password change and remove hash from permission API responses

2026-04-09 21:37:56 +02:00

package.json

test(api): add assistant split regression runner

2026-04-01 00:51:23 +02:00

tsconfig.json

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

vitest.config.ts

feat: Sprint 2 — test coverage, Dependabot, coverage gates, E2E expansion

2026-03-19 21:29:58 +01:00