hsiegeln 9031533077 feat(auth): add POST /auth/logout that revokes all user tokens ...

Bumps users.token_revoked_before = now() for the calling user, audited
under AuditCategory.AUTH. Best-effort: returns 204 even when the request
is unauthenticated, so the SPA can call it on every logout regardless of
token state. Token-rejection is enforced by the existing
JwtAuthenticationFilter revocation check (fixed in 7066795c).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-27 09:21:47 +02:00

..

src

feat(auth): add POST /auth/logout that revokes all user tokens

2026-04-27 09:21:47 +02:00

pom.xml

test(license): LicenseLifecycleIT — install/persist/revalidate/reject

2026-04-26 15:56:01 +02:00