Linus Rath defe4e93f3 fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time

2026-10-28 03:42:19 +01:00

..

auth-context.ts

fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time

2026-10-28 03:42:19 +01:00

credentials.ts

fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to

2026-10-26 11:36:57 +01:00

jmap-api.ts

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

jmap-passthrough.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

principal.ts

fix: let non-admin users see their name and change a TOTP password

2026-09-22 20:28:01 +02:00

server-fetch.ts

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

stored-credential-budget.ts

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00