rcmd/keeporg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an Account page for sign-in methods and signed-in devices

Browse Source 
/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.

The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.

Server version 0.10.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Reactorcoremeltdown
2026-11-02 15:37:47 +01:00
co-authored by Claude Opus 5.5
parent 318bd68908
commit f8f634fbf7
17 changed files with 1086 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/deb/server/changelog
+12
View File
@@ -1,3 +1,15 @@
keeporgd (0.10.0) unstable; urgency=medium
* New Account page in the web interface: every signed-in browser and
client with a button to sign each out, or all but the current one;
two-factor setup, replacement and removal; the password form, moved
from the vault page. Matching API: GET and DELETE
/api/v1/auth/sessions, DELETE /api/v1/auth/totp. Replacing or removing
an active second factor now needs the password and a current code.
Administrators can sign a user out everywhere.
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 13:27:12 +0100
keeporgd (0.9.0) unstable; urgency=medium
* A client starting a browser sign-in may pass return_url, a keeporg: