Linus Rath 4db88255e8 fix: stop a sixth sso account from overwriting the first account's sign-in ...

`/api/auth/sso/complete` only accepted cookie slots 0-4 and quietly
used slot 0 for anything higher. Since the account limit rose to
`MAX_ACCOUNT_SLOTS` (50) on HTTP/2, adding a sixth account through
server-side SSO wrote its refresh token over the first account's cookie,
while the new account was registered on slot 5 with no cookie behind it.

The route and the OAuth callback's pending-slot check now use the same
bound as every other auth route.

2026-09-30 19:31:03 +02:00

..

complete

fix: stop a sixth sso account from overwriting the first account's sign-in

2026-09-30 19:31:03 +02:00

start

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00