Repository navigation

fix(security): enforce strict revocable sessions on every JWT transport - #414

Closed

seonghobae wants to merge 45 commits into

developfrom

fix/session-revocation-url-token-endpoints

Commits on Aug 4, 2026
- ⚡ 병렬 외부 네트워크 호출을 위한 Promise.all 적용
  seonghobae
  committed
  38b67fc
- ⚡ 병렬 외부 네트워크 호출을 위한 Promise.all 적용 및 CVE 패치
  seonghobae
  committed
  5a9dfaa
- fix(review): bound job-status refresh concurrency to chunks of 5
  
  seonghobae
  and
  claude
  committed
  a3c76d5
- ci: run one-shot attachment refresh hardening
  seonghobae
  committed
  99ff6dd
- ci: remove inactive one-shot repair workflow
  seonghobae
  committed
  f5ecb72
- ci: validate and apply attachment refresh hardening
  seonghobae
  committed
  63a8f18
- perf(attachments): add bounded status refresh engine
  seonghobae
  committed
  bcdb27f
- test(attachments): cover bounded refresh engine
  seonghobae
  committed
  d705f23
- test(clearfolio): cover status cancellation signal
  seonghobae
  committed
  f8077e0
- test(api): cover attachment status refresh contract
  seonghobae
  committed
  f455f99
- feat(clearfolio): make status lookups abortable
  seonghobae
  committed
  0d6b439
- test(attachments): wire refresh coverage and API regressions
  seonghobae
  committed
  ff15fca
- docs(changelog): record bounded attachment refresh
  seonghobae
  committed
  0cc3809
- ci: make attachment repair marker-based
  seonghobae
  committed
  ee4930b
- Restore scorecard-analysis.yml for branch protection rule
  seonghobae
  committed
  62da5d0
- docs(attachments): document refresh worker
  seonghobae
  committed
  8ebd8cd
- ci: make attachment repair atomic and marker-based
  seonghobae
  committed
  9f37f79
- ci: patch attachment repair browser setup
  seonghobae
  committed
  8fdffb1
- test(e2e): install Chromium for cloud validation
  seonghobae
  committed
  a0e53d3
- ci: remove browser bootstrap workflow
  seonghobae
  committed
  0caf4eb
- perf(attachments): bound status refresh and remove N+1 queries
  github-actions[bot]
  committed
  0e3cd25
- chore: remove unrelated scorecard workflow
  seonghobae
  committed
  4f6565f
- chore: keep attachment change focused
  seonghobae
  committed
  dddfd60
- fix(attachments): enforce request-wide refresh budget
  seonghobae
  committed
  bb45a51
- fix(clearfolio): preserve status on HTTP failures
  seonghobae
  committed
  f46c36a
- test(attachments): prove deadline and failure categories
  seonghobae
  committed
  d0a1b44
- test(clearfolio): enforce status endpoint HTTP contract
  seonghobae
  committed
  4f1dfe1
- test(attachments): use behavior-only list assertions
  seonghobae
  committed
  609c78c
- test(coverage): include Clearfolio status paths
  seonghobae
  committed
  73603cd
- ci: repair exact-head coverage evidence for PR 419
  seonghobae
  committed
  e883548
- ci: stage PR 419 review repair script
  seonghobae
  committed
  e34b138
- ci: arm ready-event repair for PR 419
  seonghobae
  committed
  230bafa
- fix(ci): make test coverage produce Istanbul evidence
  seonghobae
  committed
  afeb3c0
- test(ci): lock coverage-producing script contract
  seonghobae
  committed
  8da3b0e
- fix(ci): make coverage evidence deterministic
  github-actions[bot]
  committed
  64b7ed5
- test(ci): document coverage evidence contract
  seonghobae
  committed
  140bf95
- test: reject malformed Clearfolio status responses
  seonghobae
  committed
  ba5294d
- fix: preserve attachment status on malformed Clearfolio payloads
  seonghobae
  committed
  a4dd487
- docs: record malformed status response isolation
  seonghobae
  committed
  13f2402
- fix(security): enforce strict revocable sessions on every JWT transport
  seonghobae
  committed
  02c8d84
- test(security): reject excessive session lifetimes
  seonghobae
  committed
  285efef
- fix(security): cap general session lifetime at seven days
  seonghobae
  committed
  94f819b
- docs(doctoring): record session revocation evidence
  seonghobae
  committed
  ae63ea1
- docs: record bounded general session lifetime
  seonghobae
  committed
  88f59ac
- docs(doctoring): remove superseded session verification note
  seonghobae
  committed
  c2c3ad5

Commits

Commits on Aug 4, 2026