[antosubash]

Summary

All items are from #640:

• site_lock: AttemptLimiter evicts expired buckets once per window, so the per-process dict no longer grows without bound.
• api_tokens (behaviour change):
  • The personal and admin list APIs take limit (1–100, default 100) and offset, ordered created_at desc, id desc. A client that relied on getting every token in one response now gets the first 100.
  • The Inertia pages get a pagination prop and Previous/Next controls.
  • revoke_all_for_owner walks every page, so revoking more than 100 tokens still covers them all.
• sharing: concurrent duplicate grants recover inside a savepoint and update the winning row, instead of a 500 from an unmapped IntegrityError.
• users: UserUpdate no longer carries is_active, is_superuser or is_verified. Every call site already passed only safe fields.
• core: new simple_module_core.datetimes (utcnow, aware) replaces the per-module copies in sharing, tenants, background_tasks, api_tokens and users.

#639 was closed separately as already fixed (#605 and #646).

Closes #640

Verification

• Browser QA on port 8219:
  • Personal and admin token lists page correctly at ?limit=2, and revoking on page 2 stays on that page.
  • The API slices correctly; limit=0 and limit=101 return 422.
  • site_lock: 10 wrong passwords return 401, then 429.
  • The duplicate-share race has no shareable resource in the dev host, so unit tests cover it.
• Local CI: make lint (including API-type freshness), make test-py (6195 passed) and make test-js (771 passed) are green.
• Verification report: https://claude.ai/artifact/1N4rGcewSsbUYtPbp97ets

QA Report

• Full QA cycle completed (1 iteration), depth shallow
• 0 bugs found, 0 fixed
• Full QA report: https://claude.ai/artifact/1ArGkPXo4LhWLzNp8vrpt8

Report links are Claude Artifacts and start private — the author can share them
from claude.ai/code/artifacts if reviewers need access.

Test plan

• /api-tokens?limit=2 pages through all tokens
• CI is green

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	30c4c38
Status:	⚡️  Build in progress...

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-24T19:32:17.875024Z	0b3f746	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.