curo1305andClaude Sonnet 4.6
c38c6b1c01
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
derived from refresh cookie; return sessions_revoked in response and
write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
— all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
"Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# Plan 07.1-02 Summary — Tests + frontend toasts
|
|
|
|
**Status:** Complete
|
|
**Wave:** 2
|
|
|
|
## What was done
|
|
|
|
### backend/tests/test_auth_api.py
|
|
- Added `RefreshToken` to imports from `db.models`
|
|
- Appended 3 new `@pytest.mark.asyncio` tests:
|
|
- `test_change_password_revokes_other_sessions`: inserts a second RefreshToken, calls change-password, asserts `sessions_revoked >= 1` and the row is revoked
|
|
- `test_enable_totp_revokes_other_sessions`: same pattern for totp/enable (mocks `verify_totp` and `store_backup_codes`)
|
|
- `test_disable_totp_revokes_other_sessions`: same pattern for DELETE /api/auth/totp
|
|
|
|
### frontend/src/components/settings/SettingsAccountTab.vue
|
|
- Added `sessionRevokedToast = ref(false)`
|
|
- Added a fixed top-right toast (same visual pattern as SettingsView OAuth toast)
|
|
- `changePassword()`: captures API response, shows toast for 5s when `sessions_revoked > 0`
|
|
- `disableTotp()`: captures API response, shows toast for 5s when `sessions_revoked > 0`
|
|
|
|
### frontend/src/components/auth/TotpEnrollment.vue
|
|
- Added `sessionRevokedToast = ref(false)`
|
|
- Added an inline (non-fixed) alert block at the top of the component template
|
|
- `confirmEnrollment()`: checks `data.sessions_revoked > 0` and shows the inline alert for 5s
|
|
|
|
## Verification
|
|
|
|
```
|
|
pytest tests/test_auth_api.py -k "revokes_other_sessions" -v → 3 PASSED
|
|
pytest -q --ignore=tests/test_extractor.py → 373 passed, 0 failed
|
|
npm run build (frontend) → exits 0
|
|
grep -c "sessions_revoked" SettingsAccountTab.vue → 2
|
|
grep -c "sessions_revoked" TotpEnrollment.vue → 1
|
|
```
|