[antosubash]

Summary

• hosting/users: rotate the CSRF token (and ideally the session) on sign-in #615: signing in through users (password, OAuth, accept-invite, demo) now clears the session. It keeps only the pending post-login redirect and the keys a module registers with the new simple_module_hosting.session.preserve_across_sign_in(app, key). Site lock registers its unlock marker, so a visitor who unlocks the site is not asked again after signing in. A CSRF token minted before sign-in is refused afterwards (403). Keycloak's OIDC callback keeps the session and calls the new simple_module_hosting.csrf.rotate_csrf_token(request).
• tenants.contracts: a UsageMeter protocol next to EntitlementProvider #616: tenants.contracts.UsageMeter is an implementation-free usage-metering protocol next to EntitlementProvider. It covers check, consume, record, refund, reserve/commit/release and summary, plus UsageOutcome, UsageReservation, UsageSummaryRow and UsageExceededError. UnlimitedUsageMeter is the default on app.state.tenants.usage, and get_usage_meter(app) returns the installed one.
• Decision: switching the active tenant deliberately does not rotate the CSRF token. It keeps the same principal and session, and POST /api/tenants/{id}/switch returns a bare 204 with no new token, so rotating would 403 every open tab.
• Behaviour change: session keys a module stored before sign-in are dropped at sign-in unless the module registers them with preserve_across_sign_in. This is in the CHANGELOG.

Verification

• Local CI: all green.
  • make lint passed.
  • make test-py: 5999 passed, 39 skipped.
  • make test-js: 770 passed.
  • Postgres, targeted (users, tenants, hosting, site_lock): 1958 passed.
  • e2e: 49 passed.
• Code review: 2 review passes (the first found the site-lock regression; the second was clean) plus an independent Codex review, which found no regressions.
• Verification report: https://claude.ai/artifact/Q2dp8YBUCjzhroANQ8j1ST

QA Report

• Full QA cycle completed in 1 iteration: 0 bugs found, 0 fixed, 4 P3 observations.
• What was tested:
  • Browser (playwright-cli): login, deep-link redirect, CSRF-protected actions right after sign-in, site lock across sign-in, org create and switch, admin pages, two tabs.
  • HTTP: stale token refused, deep link honoured once, user switch, logout, the tenant switch keeping the token, missing or wrong tokens.
• Full QA report: https://claude.ai/artifact/4cW2siReW8558c2QEsYtjB

Report links are Claude Artifacts and start private. The author can share them from claude.ai/code/artifacts if reviewers need access.

Test plan

• Sign in while a pre-login CSRF token is held: protected POSTs with the old token get 403, and the token from the next page works.
• With site lock on, unlock and then sign in: no second unlock prompt.
• CI is green.

Closes #615
Closes #616

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-24T09:22:06.789689Z	a820aef	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	a820aef
Status:	✅  Deploy successful!
Preview URL:	https://13b08803.simple-module-python.pages.dev
Branch Preview URL:	https://fix-debt-batch-10.simple-module-python.pages.dev

View logs