chore: reset datadog and posthog on logout - #13
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
This change ensures no state is left behind for PostHog and DataDog RUM after users log out.
disintegrator
force-pushed
the
logout-telemetry-wipe
branch
from
August 7, 2025 15:35
662503a to
c162783
Compare
ryan-timothy-albert
approved these changes
Aug 7, 2025
qstearns
added a commit
that referenced
this pull request
May 12, 2026
…dings Security: - Sec #1: Auth-code redemption is now atomic via Redis GETDEL (new Cache.GetAndDelete). Two clients racing on the same code can't both win. - Sec #14: Consent-state consumption uses the same GETDEL primitive, preventing parallel POSTs from minting multiple grants per /authorize. - Sec #13: ValidateBearer fails closed on revocation-cache errors (Redis outage → tokens reject, not admit). - Sec #4: /revoke verifies the presented token belongs to the authenticated client (RFC 7009 §2.1). Ownership mismatches look like the "unknown token" silent-no-op per §2.2. New GetUserSessionByJTI and GetUserSessionByRefreshTokenHash peek queries support this. - Sec #9: JWT audience is now urn.NewToolset(toolset.ID) — globally unique even when slugs collide across projects. No cross-project token replay. - Sec #11: JWT iss claim honours custom domains (matches the AS metadata document's issuer). Correctness: - Bug #2: Access-token lifetime is hardcoded (1h). issuer.SessionDuration is now the refresh-token (i.e. total session) lifetime — the value the IDP-driven session window was meant to control. - Bug #5: HandleIDPCallback forwards IDP error responses back to the MCP client's redirect_uri instead of swallowing them as a generic 400. - Bug #6: Consent POST refuses to mint an anonymous session for a private toolset — IDP authentication is required first. - Bug #8: Consent approve path requires action=approve explicitly. Missing or unknown values 400, not fail-open into the approval branch. - Bug #10: HandleToken now calls requireUserSessionIssuer like the other authn-dance handlers. - Bug #15: Consent POST → GET redirects use 303 See Other (was 302 Found, which leaves the verb implementation-defined). Hardening: - Hard #3: isUniqueViolation uses errors.As + *pgconn.PgError.Code instead of strings.Contains on the error message. - Hard #7: Migrate the remaining "jwt-signing-key" literal callsites (chatsessions/assistanttokens/assets) to usersessions.JWTSigningKeyFlag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change ensures no state is left behind for PostHog and DataDog RUM after users log out.