Skip to content

[codex] Enforce single active user session#322

Merged
jjoonleo merged 1 commit into
mainfrom
dev
Jun 26, 2026
Merged

[codex] Enforce single active user session#322
jjoonleo merged 1 commit into
mainfrom
dev

Conversation

@jjoonleo

Copy link
Copy Markdown
Contributor

Summary

  • enforce a single active user session by invalidating older refresh sessions when a new login succeeds
  • validate access credentials against the user's current stored access token so previous devices stop working immediately
  • add regression coverage for stale access and refresh credentials after a second login

Why

Multiple devices could stay logged in after the refresh-token session work. The intended product behavior is to prevent simultaneous logins across devices, so a new login must invalidate the previous device's credentials.

Validation

  • ./gradlew check
  • manual dev-server retry after Apple login flow: confirmed login succeeds after re-test

@jjoonleo jjoonleo merged commit ab5fc7f into main Jun 26, 2026
3 checks passed
@jjoonleo jjoonleo deleted the dev branch June 26, 2026 16:50
@jjoonleo jjoonleo restored the dev branch June 28, 2026 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant