Fluxzero 1.165.1

1.165.1 (2026-05-14)

Bug Fixes

• fix(websocket): reuse session users after open (212f060)

  Pin the user accepted during socket creation for established websocket frames, while keeping handshake and open authorization tied to the current request. Refresh-capable user providers can update the pinned identity before authorization without re-authenticating every socket frame.

  Also preserves web request invocation semantics so missing request users do not fall back to active users during handler execution.

  Tests: ./mvnw -pl sdk -am test; dashboard UiUpdaterTest#impersonationVisible; dashboard SystemEndpointTest#missingTokenGives401; dashboard AlertsEndpointTest#missingTokenGives401

• fix(websocket): authorize automatic handshakes (b8cbb51)

  Use handler metadata on synthetic automatic handshake invokers so the existing authentication interceptor can enforce requirements before a socket is established. Split websocket handling into handshake and lifecycle decorators so handshake authorization still flows through the normal handler chain while open failures continue to close the socket.

  Tests: ./mvnw -pl sdk -am test