fix: guest app-mode decided once at the on-behalf resolver; clear a stale guest session before offering another app's sign-in

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BayTppRCstWX6qTf3LMco5
This commit is contained in:
Ruben Fiszel
2026-09-02 08:15:21 +00:00
co-authored by Claude Opus 5
parent 03e0504d95
commit 2ecbe31e91
5 changed files with 48 additions and 27 deletions
@@ -4611,10 +4611,9 @@ struct EditGuestAccess {
/// Turn guest sessions on or off for this workspace. Off by default, and off is
/// authoritative and immediate: the switch is re-read where a guest session is
/// minted, where a guest reads an app and where a guest runs its components
/// (`guest_app_admits` / `is_guest_access_enabled`), so an app whose policy already
/// says `guest` — pushed by git-sync, say — closes to guests on the next request,
/// sessions already issued included.
/// minted (`guest_app_admits`) and at the auth door on every guest request, so an app
/// whose policy already says `guest` — pushed by git-sync, say — closes to guests on
/// the next request, sessions already issued included.
async fn edit_guest_access(
authed: ApiAuthed,
Extension(db): Extension<DB>,