vacuum-wall

Files

T

mteehan 6404508519 fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

2026-08-12 15:53:17 +00:00

applyconfirm.js

Remove query-string cache-busting from static assets

2026-07-28 13:50:22 +00:00

auth.js

fix: harden auth with refresh token session binding, logging, and router state

2026-08-12 15:53:17 +00:00

data.js

refactor: extract shared utilities and standardize page patterns

2026-07-28 17:32:51 +00:00

layout.js

Remove query-string cache-busting from static assets