fix(security): enforce session revocation on URL-token endpoints - #397

Closed

seonghobae wants to merge 23 commits into

developfrom

sentinel-fix-calendar-stream-revocation-11666540507854451077

Commits on Aug 2, 2026

fix(auth): check token version in calendar and stream endpoints
seonghobae
committed
1c234bf
fix(parser): replace dynamic RegExp with safe string matching to prevent ReDoS
seonghobae
committed
9169338
fix(deps): bump @hono/node-server and prevent ReDoS in parseMsProjectXml
seonghobae
committed
51f08b3

Commits on Aug 3, 2026

test(security): cover query-token session revocation
seonghobae
committed
c4c6a5d
test(security): move revocation coverage to Node 22 API suite
seonghobae
committed
355b9e7
test(security): remove Node 22 API test from Node 20 fuzz suite
seonghobae
committed
a1aa5bb
test(security): run revocation regression in API suite
seonghobae
committed
82c8e63
chore(security): align API test manifest with security base
seonghobae
committed
f13726b
docs(security): record query-token revocation verification
seonghobae
committed
47ac0b2
ci: synchronize lockfile and supported Node runtimes
seonghobae
committed
27040a0
ci: run only tests present on session-revocation branch
seonghobae
committed
00b3c66
chore(security): remove stale vulnerable pnpm lockfile
seonghobae
committed
fbaae29
fix(security): use linear MS Project XML parsing
seonghobae
committed
7194681
ci: apply reviewed session auth refactor
seonghobae
committed
bc16089
ci(security): scope one-shot write permission to repair job
seonghobae
committed
f8ad361
ci: repair PR 397 session authorization boundary
seonghobae
committed
ce90839
ci: make PR 397 repair fail-diagnostic
seonghobae
committed
281e1cc
ci: extract PR 397 repair script
seonghobae
committed
fd8bae8
ci: simplify PR 397 repair workflow
seonghobae
committed
4088faf
fix(security): centralize revoked session validation
github-actions[bot]
committed
3590b4c
docs(changelog): record URL-token revocation coverage
seonghobae
committed
b4cc736
chore(ci): remove completed one-shot auth repair workflow
seonghobae
committed
ba9a06b
docs(security): cover every URL-token revocation path
seonghobae
committed
5ed7fa1

Navigation Menu

fix(security): enforce session revocation on URL-token endpoints - #397

fix(security): enforce session revocation on URL-token endpoints#397
seonghobae wants to merge 23 commits into
developfrom
sentinel-fix-calendar-stream-revocation-11666540507854451077

Commits on Aug 2, 2026

fix(auth): check token version in calendar and stream endpoints

fix(parser): replace dynamic RegExp with safe string matching to prevent ReDoS

fix(deps): bump @hono/node-server and prevent ReDoS in parseMsProjectXml

Commits on Aug 3, 2026

test(security): cover query-token session revocation

test(security): move revocation coverage to Node 22 API suite

test(security): remove Node 22 API test from Node 20 fuzz suite

test(security): run revocation regression in API suite

chore(security): align API test manifest with security base

docs(security): record query-token revocation verification

ci: synchronize lockfile and supported Node runtimes

ci: run only tests present on session-revocation branch

chore(security): remove stale vulnerable pnpm lockfile

fix(security): use linear MS Project XML parsing

ci: apply reviewed session auth refactor

ci(security): scope one-shot write permission to repair job

ci: repair PR 397 session authorization boundary

ci: make PR 397 repair fail-diagnostic

ci: extract PR 397 repair script

ci: simplify PR 397 repair workflow

fix(security): centralize revoked session validation

docs(changelog): record URL-token revocation coverage

chore(ci): remove completed one-shot auth repair workflow

docs(security): cover every URL-token revocation path