Changeset 2d66d66 in Klonkt for CHANGELOG.nl.md

Timestamp:

07/19/2026 04:17:44 PM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

33e1dbd

Parents:

4407c67

git-author:

Robin <roboburr@…> (07/19/2026 04:17:27 PM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:17:44 PM)

Message:

Feature: revoke connected OAuth apps from the account page

You issue C2S bearer tokens (Shaer, etc.) but had no way to see or revoke them.
The account page now has a 'Connected apps' section listing every authorization
(app name via the client join, site, scope, last used) with a Revoke button.
Already-issued tokens appear because they were always stored (hashed) with the
user/client/site; the bearer is never kept, so revocation is keyed on the safe
token_hash and scoped to the owner (you cannot revoke someone else's).

• OAuthService.listAuthorizations(userId) / revokeAuthorization(userId, hash).
• account.js: authorizations passed to the page; POST /account/oauth/revoke.
• account.ejs: the section + styles; i18n NL/EN/DE. Visible to viewers too (revoking your own app access is a safety action).

83 tests green. Live-verified: two apps listed on /account, revoke one -> it is
gone and the other stays, token count drops in the DB.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• CHANGELOG.nl.md (modified) (1 diff)

CHANGELOG.nl.md

@@ -7 +7 @@
 
 ### Toegevoegd
+- **Trek verbonden apps in vanaf je accountpagina.** Een sectie "Verbonden apps"
+  toont elke app die je via OAuth toegang gaf (naam, site, scope, laatst
+  gebruikt) met een Intrekken-knop. Al eerder uitgegeven tokens verschijnen ook,
+  want die stonden altijd al (gehasht) opgeslagen; het token zelf bewaren we
+  nooit, dus intrekken gaat op de token-hash.
 - **De account-eigenaar kan zijn eigen followers en following lezen via C2S.** De
   `followers`- en `following`-collecties blijven count-only voor het publiek