ksmithandClaude Sonnet 5 b26643527d Add per-device active sessions with revocation (#69) ...

Replaces the stateless signed-cookie session (bare user_id) with a
real server-side sessions table -- the cookie now just carries an
opaque session id, resolved against the DB on every request. Each
session records IP address (respects X-Forwarded-For), a parsed
device label, and last-seen time (throttled updates, not written on
every request).

New GET/DELETE /api/auth/sessions endpoints and an "Active sessions"
section in Profile settings let a user see every device they're
logged in from and revoke one they don't recognize -- including their
own current session, which just signs them out.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-28 20:22:50 -06:00

..

__init__.py

Phase 1: auth, room CRUD, WebSocket chat, PWA frontend

2026-08-13 20:01:17 -06:00

broadcaster.py

Push a live signal when a user is added to a room (#26)

2026-08-16 10:29:06 -06:00

chat.py

Add per-device active sessions with revocation (#69)

2026-08-28 20:22:50 -06:00

connection_manager.py

Push a live signal when a user is added to a room (#26)

2026-08-16 10:29:06 -06:00

focus_presence.py

Fix desktop messages not appearing live until refocus (#59)

2026-08-19 18:08:04 -06:00

global_presence.py

Add presence indicators and a manual "appear offline" override (#36)

2026-08-16 15:39:56 -06:00

presence.py

Phase 5: Redis pub/sub for horizontal scaling

2026-08-14 07:13:06 -06:00