Fix - #68

Draft

Tyjfre-j wants to merge 25 commits into

Commits on Jul 24, 2026

Move blocked-user re-check under row lock to close login race with block_user
Tyjfre-j
committed
Add tests for blocked-user race fix: unit branch coverage and real concurrent block-vs-login trial
Tyjfre-j
committed
chore: removed unused test variables
Tyjfre-j
committed

Commits on Jul 26, 2026

refactor(container): constructor-inject SessionService, wire in refresh_token_querier
Tyjfre-j
committed
test: pass refresh_token_querier through auth_service fixture
Tyjfre-j
committed
test: wire refresh_token_querier into all AuthService construction sites, fix over-escaped docstring
Tyjfre-j
committed
test: add refresh_token_querier fixture and wire into auth_service
Tyjfre-j
committed
test: update fixtures for opaque refresh tokens, wire refresh_token_querier
Tyjfre-j
committed
test: add refresh_token_querier to AuthService construction
Tyjfre-j
committed
test(auth): add coverage for rate-limit fail-open, block/delete locking, and refresh-token grace-window behavior
Tyjfre-j
committed
fix(auth): close session/token security gaps in refresh, block, and rate-limit flows
Tyjfre-j
committed
docs(env): add generation instructions for jwt_secret and encryption_key
Tyjfre-j
committed
feat(db): add refresh_token queries and generated querier
Tyjfre-j
committed
fix: switched encryption key to valide base 64 key
Tyjfre-j
committed