Why: Login recovery contract section 6.7 (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) — established SSE connections must stop receiving private events once a password write destroys their session.
Evidence: go test ./... green including TestSSESessionInvalidationClosesStream over a real HTTP server (SELF worktree run); CI on this HEAD is the GATE.
Impact: Session-authenticated streams revalidate every 15s (test-shortened var) and terminate with a session-expired marker; API-key streams unchanged; reconnects rejected by middleware.
Why: Login recovery contract section 6.7 (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) — established SSE connections must stop receiving private events once a password write destroys their session.
Evidence: go test ./... green including TestSSESessionInvalidationClosesStream over a real HTTP server (SELF worktree run); CI on this HEAD is the GATE.
Impact: Session-authenticated streams revalidate every 15s (test-shortened var) and terminate with a session-expired marker; API-key streams unchanged; reconnects rejected by middleware.
Refs: Dev PR #504.
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/
2026-10-13-login-recovery-contract.md, plan item 6.7) requires that
established SSE connections stop receiving private events once a
password write destroys their session.
Evidence: go test ./... green; TestSSESessionInvalidationClosesStream
streams over a real HTTP server, invalidates the session via
AdminResetUserPassword, and asserts the stream terminates with the
session-expired marker within the recheck window (SELF, worktree run).
Impact: Session-authenticated event streams revalidate at a 15s
heartbeat cadence (package var, shortened in tests) and terminate on
invalidation; API-key streams are unchanged (key revocation is separate).
EventSource reconnects are rejected by the auth middleware.
Refs: Dev PR #504; login recovery contract section 6.7.
weichen
merged commit 349a47de6f into main2026-10-13 04:35:26 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: Login recovery contract section 6.7 (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) — established SSE connections must stop receiving private events once a password write destroys their session.
Evidence: go test ./... green including TestSSESessionInvalidationClosesStream over a real HTTP server (SELF worktree run); CI on this HEAD is the GATE.
Impact: Session-authenticated streams revalidate every 15s (test-shortened var) and terminate with a session-expired marker; API-key streams unchanged; reconnects rejected by middleware.
Refs: Dev PR #504.