Linus Rath a5583aa8e8 fix: re-check a paired phone's token endpoint against the current config ...

The token proxy trusted the endpoint sealed into a phone's refresh token
for good: after a server was removed or its provider moved, it kept
posting there with the plain fetch and whichever secret the server id
now maps to. Trust is now re-derived on every renewal; an endpoint the
webmail is no longer configured for gets neither the secret nor the
unguarded fetch.

2026-09-27 04:50:38 +02:00

..

route.ts

fix: re-check a paired phone's token endpoint against the current config

2026-09-27 04:50:38 +02:00