dev_agentandClaude Opus 5.5 0f7f8014f8 Bound pending flow states ...

The login route is unauthenticated, so its pending states could grow
without limit and every Add scanned them all. Expired states now leave
from the front of an add-ordered queue, and Add refuses a new flow with
ErrTooManyPending once 10000 are pending; login answers 503. Both flows
record the state before setting the cookie.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 01:40:18 -04:00

..

actor_test.go

Feature 03 task 4: CSRF protection and GET /api/v1/me (#22)

2026-10-03 10:51:26 -04:00

actor.go

Feature 03 task 4: CSRF protection and GET /api/v1/me (#22)

2026-10-03 10:51:26 -04:00

auth_test.go

Bound pending flow states

2026-10-11 01:40:18 -04:00

auth.go

Bound pending flow states

2026-10-11 01:40:18 -04:00

cookie.go

Bound pending flow states

2026-10-11 01:40:18 -04:00

gate_test.go

Feature 03 task 3: Household group gate and auth middleware (#21)

2026-10-03 10:30:07 -04:00

refused.go

Feature 03 task 3: Household group gate and auth middleware (#21)

2026-10-03 10:30:07 -04:00

session_test.go

Feature 06: PWA shell and offline (#58)

2026-10-05 15:22:37 -04:00

session.go

Feature 03 task 2: Server-side sessions, cookie and logout (#19)

2026-10-03 10:20:14 -04:00