giles 404449fcab Fix auth ordering: validate grant before loading user ...

_load_user ran before _check_auth_state, so g.user was set to the wrong
user before the grant check could clear the stale session. Now grant
verification runs first, ensuring stale sessions are cleared before
the user is loaded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 12:22:35 +00:00

..

__init__.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

actions.py

Decouple all cross-app service calls to HTTP endpoints

2026-02-25 03:01:38 +00:00

activitypub.py

Fix AP blueprint cross-DB queries + harden Ghost sync init

2026-02-25 14:06:42 +00:00

ap_inbox_handlers.py

Show per-app actor in follow notifications on Hub

2026-02-25 09:17:34 +00:00

ap_social.py

Fix AP blueprint cross-DB queries + harden Ghost sync init

2026-02-25 14:06:42 +00:00

auth_redis.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

cart_identity.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

context.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

data_client.py

Decouple all cross-app service calls to HTTP endpoints

2026-02-25 03:01:38 +00:00

factory.py

Fix auth ordering: validate grant before loading user

2026-02-26 12:22:35 +00:00

fragments.py

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

ghost_admin_token.py

Decouple cross-domain DB queries for per-app database split

2026-02-25 11:32:14 +00:00

http_utils.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

jinja_setup.py

Remove widget system — fully replaced by fragment composition

2026-02-25 01:20:58 +00:00

oauth.py

Decouple cross-domain DB queries for per-app database split

2026-02-25 11:32:14 +00:00

oembed.py

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

urls.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

user_loader.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00