Linus Rath a9e33ec2d6 fix: stop a page wiping another account's plugin secrets by naming it in the desktop app ...

A wipe by name took any username and server with no session behind it. It
now needs a sealed cookie the account got while it was signed in, since a
dropped account has no session cookie left. The old wipe test asserted that
a name alone was enough, which is the behaviour being removed.

2026-11-04 03:15:35 +01:00

..

credentials.ts

feat: let plugins use accounts and API keys through the server without seeing them

2026-10-14 04:00:36 +02:00

known-plugins.ts

fix: only connect and proxy plugin credentials that a plugin known to the server declares

2026-10-19 01:07:50 +02:00

proxy.ts

Merge branch 'main' into feat/enterprise-pack

2026-11-01 13:46:59 +01:00

vault.ts

feat: let an admin wipe a lost device, and clear an account the server refuses for good

2026-11-03 13:19:44 +01:00

wipe-proof.ts

fix: stop a page wiping another account's plugin secrets by naming it in the desktop app

2026-11-04 03:15:35 +01:00