fix: actually invalidate the session on OAuth logout - #211

Merged

heskew merged 7 commits into

mainfrom

security/f2-f4-identity-session

Sep 1, 2026

Commits on Aug 14, 2026

fix: actually invalidate the session on OAuth logout (F4)

heskew
and
claude
committed
029ecb8

Commits on Aug 24, 2026

Merge remote-tracking branch 'origin/main' into security/f2-f4-identity-session
heskew
committed
3681a49
refactor: null the in-memory-fallback session fields (match persisted shape)

heskew
and
claude
committed
293fac7
fix: guard logout persistence on session.id; persist { user: null } (F4 review)

heskew
and
claude
committed
7fad2e9
docs: note the session.id guard limitation; refresh stale test comment (#211 review)

heskew
and
claude
committed
c1e07fb

Commits on Sep 1, 2026

fix: clear in-memory session fields on logout so the current request sees no identity

heskew
and
claude
committed
4c20cc1
style: trim clearOAuthSession and related comments to essentials

heskew
and
claude
committed
0cb731e