Timothy Carambat a207449095 Enforce user suspension check on browser extension API key path ...

Previously, suspended users could continue using browser extension
endpoints if they had created an API key before suspension. The normal
JWT session path blocked suspended users, but the browser extension
middleware did not.

Changes:
- Add suspension and user existence checks to validBrowserExtensionApiKey
- Delete browser extension API keys when a user is deleted
- Add deleteAllForUser method to BrowserExtensionApiKey model
GHSA-7754-8jcc-2rg3

2026-03-13 10:05:05 -07:00

5.7 KiB

Raw Blame History

View Raw