Matthew Meszaros e0a97ef520 feat: end other sessions before a signed-in password change is stored and refuse the change when that fails, add an optional revoke_api_credentials to the change and reset that also revokes the user's OAuth grants and the API keys they created, exchange the emailed reset link for an opaque reset session through POST /auth/reset-password/session so the confirm step carries no token in its URL, and add the sign-out-apps checkbox to the dashboard's change-password dialog

2026-10-23 15:45:51 +02:00

..

docs

feat: end other sessions before a signed-in password change is stored and refuse the change when that fails, add an optional revoke_api_credentials to the change and reset that also revokes the user's OAuth grants and the API keys they created, exchange the emailed reset link for an opaque reset session through POST /auth/reset-password/session so the confirm step carries no token in its URL, and add the sign-out-apps checkbox to the dashboard's change-password dialog

2026-10-23 15:45:51 +02:00