Skip to content

feat(auth): allow apps to invalidate a single token - #65737

Draft
karlitschek wants to merge 1 commit into
masterfrom
feat/public-invalidate-token-by-id
Draft

feat(auth): allow apps to invalidate a single token#65737
karlitschek wants to merge 1 commit into
masterfrom
feat/public-invalidate-token-by-id

Conversation

@karlitschek

@karlitschek karlitschek commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member
  • Resolves: #

Summary

One of seven small, independent core changes needed by a planned intrusion_detection app. Each can be reviewed and merged on its own:

  1. feat(security): let apps refuse requests early with request guards #65735 – request guards: let apps refuse requests early, on every entry point
  2. feat(auth): make AppPasswordCreatedEvent public and dispatch it everywhere #65736 – public AppPasswordCreatedEvent, dispatched everywhere
  3. feat(auth): allow apps to invalidate a single token #65737 – IProvider::invalidateTokenById() in the public token provider ← this PR
  4. feat(sharing): dispatch an event when a share link access fails #65738 – ShareLinkAccessFailedEvent
  5. feat(security): dispatch an event when a password reset is requested #65739 – PasswordResetRequestedEvent
  6. feat(login-flow): warn when a login flow was started from another network #65740 – login flow v2 remembers where it was started and warns on another network
  7. feat(2fa): allow apps to ask for the second factor again in a session #65741 – IChallengeRequester: ask for the second factor again in a session

TODO

  • Description by the author
  • Manual test on a live instance

Checklist

AI (if applicable)

  • The content of this PR was partly or fully generated using AI

AI disclosure: this change was written with Claude Code (claude-opus-5-5) and reviewed by the author; every commit carries an Assisted-by trailer.

🤖 Generated with Claude Code

This was referenced Oct 20, 2026
Draft
Draft
Draft
Draft
Draft
Draft
@karlitschek @claude
feat(auth): allow apps to invalidate a single token
0fe7d5a 
Add invalidateTokenById() to the public token provider so apps can end
one session or revoke one app password without touching the user's
other devices. The core token manager already implements it.

Assisted-by: ClaudeCode:claude-opus-5-5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Frank Karlitschek <karlitschek@users.noreply.github.com>
@karlitschek
karlitschek force-pushed the feat/public-invalidate-token-by-id branch from 41cc157 to 0fe7d5a Compare October 25, 2026 19:40

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nickvergessen nickvergessen nickvergessen approved these changes

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

AI assisted

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@karlitschek @nickvergessen @nextcloud-command