codingetandClaude 73c4b169c5 fix(auth): invalidate session server-side on logout, not just the cookie ...

/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-02 01:43:50 +00:00

..

api-interface.test.ts

feat(tests): add unit and integration test suite (node:test)

2026-06-30 11:33:32 +00:00

auth-http.test.ts

fix(auth): invalidate session server-side on logout, not just the cookie

2026-07-02 01:43:50 +00:00

index.test.ts

fix(tests): address review gaps in test suite

2026-07-02 01:38:21 +00:00