Timestamp:
07/19/2026 04:17:44 PM (7 weeks ago)
Author:
Robin <roboburr@…>
Branches:
main
Children:
33e1dbd
Parents:
4407c67
git-author:
Robin <roboburr@…> (07/19/2026 04:17:27 PM)
git-committer:
Robin <roboburr@…> (07/19/2026 04:17:44 PM)
Message:

Feature: revoke connected OAuth apps from the account page

You issue C2S bearer tokens (Shaer, etc.) but had no way to see or revoke them.
The account page now has a 'Connected apps' section listing every authorization
(app name via the client join, site, scope, last used) with a Revoke button.
Already-issued tokens appear because they were always stored (hashed) with the
user/client/site; the bearer is never kept, so revocation is keyed on the safe
token_hash and scoped to the owner (you cannot revoke someone else's).

  • OAuthService.listAuthorizations(userId) / revokeAuthorization(userId, hash).
  • account.js: authorizations passed to the page; POST /account/oauth/revoke.
  • account.ejs: the section + styles; i18n NL/EN/DE. Visible to viewers too (revoking your own app access is a safety action).

83 tests green. Live-verified: two apps listed on /account, revoke one -> it is
gone and the other stays, token count drops in the DB.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

(No files)

Note: See TracChangeset for help on using the changeset viewer.