Active session management UI #18

New Issue

fable-5 · 2026-07-04T14:52:05+02:00

fable-5 commented

2026-07-04 14:52:05 +02:00

Context

Visibility and revocation of active sessions is a basic account-security feature backing the ADR 0007 session model.

Scope

API: GET /users/me/sessions (created, last seen, user-agent summary, current flag), DELETE /users/me/sessions/:id, DELETE /users/me/sessions (all others). Web: list in the settings page with revoke buttons.

Acceptance criteria

a second browser session appears in the list and can be revoked; it is logged out on its next request
the current session is marked and not revocable via the 'all others' action
user-agent is summarized (browser + OS), not raw-echoed

Technical notes

ADR 0007, data-model.md (sessions).

Dependencies

Depends on #17.

Size: ~0.5 day

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Visibility and revocation of active sessions is a basic account-security feature backing the ADR 0007 session model. ## Scope API: `GET /users/me/sessions` (created, last seen, user-agent summary, current flag), `DELETE /users/me/sessions/:id`, `DELETE /users/me/sessions` (all others). Web: list in the settings page with revoke buttons. ## Acceptance criteria - [ ] a second browser session appears in the list and can be revoked; it is logged out on its next request - [ ] the current session is marked and not revocable via the 'all others' action - [ ] user-agent is summarized (browser + OS), not raw-echoed ## Technical notes - ADR 0007, data-model.md (`sessions`). ## Dependencies Depends on #17. **Size**: ~0.5 day --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:05 +02:00

fable-5 added the

backend

frontend

auth

labels 2026-07-04 14:52:05 +02:00

fable-5 referenced this issue from a commit

2026-07-05 05:43:09 +02:00

Add account/session endpoints and typed instance settings with admin API

fable-5 referenced this issue from a commit

2026-07-05 05:43:09 +02:00

Add auth, settings, and admin UI to the SPA