Dustin Healy 4b4cecb48f 🔒 fix: Reject refresh for users migrated off the Google provider ... The interactive Google admin login path in socialLogin.js already rejects a user whose provider field is not 'google', returning AUTH_FAILED. Without a matching guard in the refresh path, a user migrated to OpenID could use an unexpired Google refresh token to keep minting admin JWTs indefinitely. Add a PROVIDER_MISMATCH check after resolving the user in both the direct getUserById branch and the findUsers fallback branch of resolveAdminUser, mirroring the provider gate the interactive path enforces.		2026-06-22 09:50:10 -07:00
..
src	🔒 fix: Reject refresh for users migrated off the Google provider	2026-06-22 09:50:10 -07:00
types	🔬 ci: Add TypeScript Type Checks to Backend Workflow and Fix All Type Errors (#12451)	2026-03-28 21:06:39 -04:00
.gitignore
babel.config.cjs
jest.config.mjs	📦 chore: npm audit fix (#13828)	2026-06-17 21:54:04 -04:00
jest.setup.cjs	🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831)	2026-04-27 08:56:39 +09:00
package.json	📦 chore: npm audit fix (#13828)	2026-06-17 21:54:04 -04:00
tsconfig-paths-bootstrap.mjs
tsconfig.build.json	🧑‍💻 refactor: Secure Field Selection for 2FA & API Build Sourcemap (#9087)	2025-08-15 18:55:49 -04:00
tsconfig.json	📦 chore: npm audit fixes and Mongoose 8.23 TypeScript follow-ups (#12996)	2026-05-07 09:47:40 -04:00
tsconfig.spec.json	📦 chore: Update TypeScript Config for TS v7 (#12794)	2026-04-23 12:51:03 -04:00
tsdown.config.mjs	🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates (#13700)	2026-06-13 11:04:46 -04:00