Changeset 2d66d66 in Klonkt for CHANGELOG.md

Timestamp:

07/19/2026 04:17:44 PM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

33e1dbd

Parents:

4407c67

git-author:

Robin <roboburr@…> (07/19/2026 04:17:27 PM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:17:44 PM)

Message:

Feature: revoke connected OAuth apps from the account page

You issue C2S bearer tokens (Shaer, etc.) but had no way to see or revoke them.
The account page now has a 'Connected apps' section listing every authorization
(app name via the client join, site, scope, last used) with a Revoke button.
Already-issued tokens appear because they were always stored (hashed) with the
user/client/site; the bearer is never kept, so revocation is keyed on the safe
token_hash and scoped to the owner (you cannot revoke someone else's).

• OAuthService.listAuthorizations(userId) / revokeAuthorization(userId, hash).
• account.js: authorizations passed to the page; POST /account/oauth/revoke.
• account.ejs: the section + styles; i18n NL/EN/DE. Visible to viewers too (revoking your own app access is a safety action).

83 tests green. Live-verified: two apps listed on /account, revoke one -> it is
gone and the other stays, token count drops in the DB.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• CHANGELOG.md (modified) (1 diff)

CHANGELOG.md

@@ -7 +7 @@
 
 ### Added
+- **Revoke connected apps from your account page.** A "Connected apps" section
+  lists every app you authorized over OAuth (name, site, scope, last used) with
+  a Revoke button. Tokens you already granted show up too, since they were
+  always stored (hashed); the bearer itself is never kept, so revocation is keyed
+  on the token hash.
 - **The account owner can read their own followers and following over C2S.** The
   `followers` and `following` collections stay count-only for the public