Changeset 2d66d66 in Klonkt for CHANGELOG.de.md

Timestamp:

07/19/2026 04:17:44 PM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

33e1dbd

Parents:

4407c67

git-author:

Robin <roboburr@…> (07/19/2026 04:17:27 PM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:17:44 PM)

Message:

Feature: revoke connected OAuth apps from the account page

You issue C2S bearer tokens (Shaer, etc.) but had no way to see or revoke them.
The account page now has a 'Connected apps' section listing every authorization
(app name via the client join, site, scope, last used) with a Revoke button.
Already-issued tokens appear because they were always stored (hashed) with the
user/client/site; the bearer is never kept, so revocation is keyed on the safe
token_hash and scoped to the owner (you cannot revoke someone else's).

• OAuthService.listAuthorizations(userId) / revokeAuthorization(userId, hash).
• account.js: authorizations passed to the page; POST /account/oauth/revoke.
• account.ejs: the section + styles; i18n NL/EN/DE. Visible to viewers too (revoking your own app access is a safety action).

83 tests green. Live-verified: two apps listed on /account, revoke one -> it is
gone and the other stays, token count drops in the DB.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• CHANGELOG.de.md (modified) (1 diff)

CHANGELOG.de.md

@@ -7 +7 @@
 
 ### Hinzugefügt
+- **Verbundene Apps auf deiner Kontoseite widerrufen.** Ein Abschnitt
+  "Verbundene Apps" listet jede App auf, der du per OAuth Zugriff gegeben hast
+  (Name, Seite, Scope, zuletzt genutzt), mit einem Widerrufen-Knopf. Bereits
+  vergebene Tokens erscheinen ebenfalls, da sie immer (gehasht) gespeichert
+  waren; das Token selbst wird nie behalten, daher erfolgt der Widerruf über den
+  Token-Hash.
 - **Der Kontoinhaber kann seine eigenen Follower und Gefolgten über C2S lesen.**
   Die `followers`- und `following`-Sammlungen bleiben für die Öffentlichkeit