cproudlock d1a7907a2c End a user's sessions when the account is deactivated ...

There is no token denylist in this product, so the JWT user loader is
the only place a deactivated account can be stopped, and it did a bare
lookup by id. Somebody deactivated at 09:00 kept a working access token
until it expired, and a refresh token that minted fresh ones for thirty
days.

/api/auth/refresh and the API-token path already checked isactive. This
makes the loader consistent with them rather than inventing policy.

Scope: product
(cherry picked from commit 9c1848fc61)

2026-08-31 09:06:25 -04:00

..

__init__.py

Add ADR-006 generic plugin collector contract

2026-06-26 16:14:27 -04:00

test_apitokens.py

Accept managed collector service tokens on the collector API

2026-07-12 09:13:33 -04:00

test_application_uploads.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_appversion_delivery.py

Add installer/script delivery metadata to the core software model

2026-08-30 15:19:35 -04:00

test_audit_retention.py

Audit log retention: a way to purge, off by default

2026-08-26 15:05:43 -04:00

test_auth_ratelimit.py

Multi-site distribution readiness: settings-driven site config, security closeout, release engineering, v0.5.0

2026-07-10 15:02:07 -04:00

test_authz.py

Bring the wilm branch into main: endpoints plugin, agent, policies, CSV import

2026-08-28 16:17:17 -04:00

test_catalog_dedupe.py

Merge catalog rows that are the same name typed two ways

2026-08-24 14:49:24 -04:00

test_clientip.py

Stop the publication scrub failing on the rules that enforce it

2026-08-14 16:27:58 -04:00

test_collector_contract.py

computers: declare subordinate devices instead of coding each one

2026-08-11 11:13:12 -04:00

test_collector_printers.py

Stop the collector being able to set a printer assignment

2026-08-24 11:25:02 -04:00

test_dashboard_widgets.py

dashboard: overflow links somewhere, tiles say what they count, rows stay inside

2026-08-11 15:28:29 -04:00

test_dashboarddefaults.py

contract 0.18.0: one name per display role, the kiosk's own

2026-08-13 09:28:26 -04:00

test_deactivated_user.py

End a user's sessions when the account is deactivated

2026-08-31 09:06:25 -04:00

test_display_kiosks.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_email.py

Add email sending (service + 3 flows) and a general asset label generator

2026-07-12 11:58:30 -04:00

test_employees.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_guest_role.py

Decide guest grants explicitly instead of by permission name

2026-08-31 09:06:25 -04:00

test_identifiers.py

Apply skill-driven review fixes: security, hook isolation, tests, docs

2026-06-26 19:25:52 -04:00

test_import_mode.py

Add the API import surface for legacy migrations (contract 0.8.0)

2026-07-11 20:10:46 -04:00

test_knowledgebase.py

knowledgebase: include the topic (application name) in list search

2026-07-29 10:06:18 -04:00

test_list_search_identifiers.py

Match the optional identifiers in every list's search box

2026-08-17 13:16:22 -04:00

test_location_code.py

Add email sending (service + 3 flows) and a general asset label generator

2026-07-12 11:58:30 -04:00

test_map_transform.py

Buildings and levels for the floor map, and make every identifier searchable

2026-08-17 12:55:51 -04:00

test_model_image.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_no_redirecting_routes.py

Register the endpoints list without a trailing slash, and stop hiding its errors

2026-08-28 17:48:06 -04:00

test_pc_relationships.py

reports: pc-relationships matches PC<->machine links in either direction

2026-07-29 13:16:15 -04:00

test_permissions_catalog.py

Add the get_permissions plugin hook (contract 0.10.0)

2026-07-12 09:29:55 -04:00

test_plugins_enabled.py

Plugin framework maturation, reports overhaul, theming, and USB frontend repair

2026-07-11 10:01:47 -04:00

test_pluginui.py

ADR-013 Phase 3: generic asset-panels renderer (Path A)

2026-07-18 22:43:54 -04:00

test_public_read_surface.py

Add installer/script delivery metadata to the core software model

2026-08-30 15:19:35 -04:00

test_relationship_directional.py

Show the controls link from both ends, and fix the dead chip links

2026-08-29 18:58:06 -04:00

test_relationship_inverse_guard.py

relationships: refuse links that cannot both be true, and report the ones already stored

2026-08-13 12:25:24 -04:00

test_relationship_propagation.py

Add the dualpath-as-single-machine site toggle

2026-07-12 06:23:39 -04:00

test_relationship_soft_delete.py

relationships: the cleanup tools stop acting on links that were deleted

2026-08-14 13:47:01 -04:00

test_reports_hook.py

Rename the equipment domain to machines; retype the models catalog (ADR-011)

2026-07-11 15:17:42 -04:00

test_search_coverage.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_search_customfields.py

Add collector PC->printer links and searchable custom fields

2026-07-12 14:01:20 -04:00

test_search_degraded.py

Search: a domain that FAILED no longer looks like one that found nothing

2026-08-26 15:05:54 -04:00

test_search_disabled.py

Second-pass review fixes: kill last hardcoded creds, wire get_services, dedup

2026-06-26 20:18:01 -04:00

test_search_integrations.py

ADR-015: the site-literal check was matching nothing, and had been all along

2026-08-26 15:05:30 -04:00

test_search_multiword.py

search: multi-word queries match by word, not the exact phrase

2026-07-29 07:43:31 -04:00

test_search_presentation.py

ADR-013 Phase 3: search routes via get_asset_presentation, not a hardcoded map

2026-07-18 22:56:05 -04:00

test_search_settings.py

Add per-domain global-search toggles

2026-06-26 20:39:34 -04:00

test_security_headers.py

Reading anything needs a permission

2026-08-27 14:26:06 -04:00

test_setting_model.py

Multi-site distribution readiness: settings-driven site config, security closeout, release engineering, v0.5.0

2026-07-10 15:02:07 -04:00

test_settings_branding.py

ADR-015: the site-literal check was matching nothing, and had been all along

2026-08-26 15:05:30 -04:00

test_settings_plugin_declared.py

Show the kiosk label prefix, and let a plugin declare the settings it owns

2026-08-06 18:17:49 -04:00

test_singular_relationship_types.py

One printer picker for machines and PCs, and one default per asset

2026-08-19 11:22:48 -04:00

test_slides.py

slides: gate management on slides.manage permission (grantable to non-admin curator)

2026-07-29 08:41:11 -04:00

test_spellfix.py

Offer a spelling on every list, not just the global search

2026-08-21 11:14:56 -04:00

test_supportteams.py

Add application support teams with contacts

2026-07-11 20:29:12 -04:00

test_users_api.py

Add per-role badge colors

2026-07-20 10:05:58 -04:00

test_webhook_alert.py

alerts: Teams webhook fan-out (contract 0.14.0) + printedparts detail revision column

2026-07-22 11:01:53 -04:00