curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
kite/.planning/phases/07.1-security-session-revocation-on-privilege-change/07.1-02-SUMMARY.md
T
curo1305andClaude Sonnet 4.6 c38c6b1c01 feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03 
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-05 12:47:16 +02:00

1.6 KiB
Raw Permalink Blame History

Plan 07.1-02 Summary — Tests + frontend toasts

Status: Complete
Wave: 2

What was done

backend/tests/test_auth_api.py

  • Added RefreshToken to imports from db.models
  • Appended 3 new @pytest.mark.asyncio tests:
    • test_change_password_revokes_other_sessions: inserts a second RefreshToken, calls change-password, asserts sessions_revoked >= 1 and the row is revoked
    • test_enable_totp_revokes_other_sessions: same pattern for totp/enable (mocks verify_totp and store_backup_codes)
    • test_disable_totp_revokes_other_sessions: same pattern for DELETE /api/auth/totp

frontend/src/components/settings/SettingsAccountTab.vue

  • Added sessionRevokedToast = ref(false)
  • Added a fixed top-right toast (same visual pattern as SettingsView OAuth toast)
  • changePassword(): captures API response, shows toast for 5s when sessions_revoked > 0
  • disableTotp(): captures API response, shows toast for 5s when sessions_revoked > 0

frontend/src/components/auth/TotpEnrollment.vue

  • Added sessionRevokedToast = ref(false)
  • Added an inline (non-fixed) alert block at the top of the component template
  • confirmEnrollment(): checks data.sessions_revoked > 0 and shows the inline alert for 5s

Verification

pytest tests/test_auth_api.py -k "revokes_other_sessions" -v   → 3 PASSED
pytest -q --ignore=tests/test_extractor.py                     → 373 passed, 0 failed
npm run build (frontend)                                        → exits 0
grep -c "sessions_revoked" SettingsAccountTab.vue              → 2
grep -c "sessions_revoked" TotpEnrollment.vue                  → 1
Reference in New Issue View Git Blame Copy Permalink