[antosubash]

Summary

• users admin UI: error toasts drop the server's detail message #653: users admin refusals (self-demote, last admin, more-privileged account, …) show the server's reason, translated (en/de), instead of a generic failure.
• OIDC sign-in refusal renders a raw JSON page instead of a login-page message #654: OAuth sign-in refusals redirect a browser to /users/login?oauth_error=<code>. The codes are allowlisted (account_not_verified, signup_disabled, signin_failed) and the login page shows a translated message for each. API and XHR callers keep the JSON error. Provider and token-exchange errors are caught as well.
• test harness: tenant teardown integration test is order-sensitive (HandlerCommitError on shared in-memory SQLite) #655: OutboxTransport serializes eager dispatches, so chained durable publishes no longer overlap on one connection. This fixes the order-dependent HandlerCommitError in the tenant-teardown test, which now runs under both module orders.
• users: refresh-token families keep every revoked row while the family is live #656: refresh-token families get an absolute lifetime: a new users setting, refresh_token_family_max_age_days, default 90. A refresh in an older family is refused and the whole family is revoked; pruning revokes, then removes, expired families. Reuse evidence for live families is unchanged.
• api_tokens: personal tokens of a deleted user are not purged on UserDeleted #657: api_tokens purges a deleted user's personal tokens on the durable UserDeleted. Service keys and other users' tokens are kept.
• users: GET /api/users/auth/me rejects Bearer tokens while other APIs accept them #658: GET/PATCH /api/users/me resolve the request principal, so a session or a Bearer access token both work. Tests that used /me to probe the cookie strategy now call the strategy directly.

Closes #653
Closes #654
Closes #655
Closes #656
Closes #657
Closes #658

Verification

• Browser QA on port 8220, all five scenarios clean:
  • The OAuth error codes show their messages, and an injected code shows nothing.
  • Self-demote shows the translated reason.
  • Bearer /me returns 200, and 401 without credentials.
  • Deleting a user purges their tokens once the outbox worker runs.
  • The new setting appears in /admin/settings.
• Local CI: make lint, make test-py (6330 passed) and make test-js (835 passed) are green.
• Verification report: https://claude.ai/artifact/XbdnMrrwXeELVERk9reUtC

QA Report

• Full QA cycle completed (1 iteration), depth shallow
• 0 bugs found, 0 fixed
• Full QA report: https://claude.ai/artifact/VYYriZVUmXwYpWU215SahY

Report links are Claude Artifacts and start private — the author can share them
from claude.ai/code/artifacts if reviewers need access.

Test plan

• A refused OAuth sign-in lands on the login page with a readable message
• CI is green

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-24T20:42:32.189574Z	a0f5db6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	a0f5db6
Status:	✅  Deploy successful!
Preview URL:	https://9630d3d7.simple-module-python.pages.dev
Branch Preview URL:	https://fix-debt-batch-20.simple-module-python.pages.dev

View logs