Linus Rath 3f01e94319 fix: key synced settings on the account a bearer token belongs to ...

A Bearer login may claim a bare local part, which is accepted when the
server's `Session.username` has the same local part (TOTP users who
type `john` log in this way). Settings were keyed on that claim, so on a
multi-domain server `john@b.example` could claim `john` and read and
overwrite the synced settings of the `john@a.example` who signs in as
`john` with a password.

`resolveJmapIdentity` now returns the canonical account name for a bare
Bearer claim, the context cookie carries it as `accountName`, and the
settings route keys on it. Basic logins and fully-qualified claims keep
their existing key.

2026-09-26 14:59:55 +02:00

..

route.ts

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00