Repository navigation

Harden token lifecycle: shared JWT validation, persisted revocation, hashed API keys - #1459

Merged

Tim020 merged 6 commits into

devfrom

feature/security-token-lifecycle

Oct 21, 2026

Merged

Harden token lifecycle: shared JWT validation, persisted revocation, hashed API keys#1459
Tim020 merged 6 commits into
devfrom
feature/security-token-lifecycle

Commits on Oct 19, 2026
- Harden token lifecycle: shared JWT validation, persisted revocation, session cap, hashed API keys
  
  Tim020
  and
  claude
  committed
  bcbf014
- Keep existing API keys working: lazy bcrypt-to-SHA-256 upgrade with rate-limited legacy scan
  
  Tim020
  and
  claude
  committed
  9942f2a
Commits on Oct 21, 2026
- Merge origin/dev into feature/security-token-lifecycle
  Tim020
  committed
  f73adec
- Remove absolute session cap (auth_time) from token lifecycle changes
  
  Tim020
  and
  claude
  committed
  30cc1a5
- Address review: fail-safe revocation load, verified-only revoke, bounded legacy scans, conditional key upgrade
  
  Tim020
  and
  claude
  committed
  51cf770
- Guard release of the rate-limit reservation when it already aged out
  
  Tim020
  and
  claude
  committed
  0411384