Feat/security hardening - #172

Merged

shaig-mahmudov merged 18 commits into

mainfrom

feat/security-hardening

Jul 15, 2026

Commits on Jul 15, 2026

fix(security): restrict websocket message destinations
shaig-mahmudov
committed
5b04c1e
fix(auth): disable authentication for inactive users
shaig-mahmudov
committed
017cdbe
fix(auth): load only active non-deleted users
shaig-mahmudov
committed
2f3c014
fix(auth): reject disabled users during jwt authentication
shaig-mahmudov
committed
1a513f2
fix(auth): prevent automatic restoration of deleted accounts
shaig-mahmudov
committed
ed87f92
refactor(users): preserve registration controller compatibility
shaig-mahmudov
committed
5d07571
refactor(users): preserve user registration service contract
shaig-mahmudov
committed
67fd13c
fix(users): deactivate accounts during soft deletion
shaig-mahmudov
committed
ab98191
refactor(security): preserve existing registration access rules
shaig-mahmudov
committed
4eeafe4
test(security): cover websocket destination authorization
shaig-mahmudov
committed
dc2135a
test(auth): cover deleted and inactive account login rejection
shaig-mahmudov
committed
255ed7f
test(users): verify account deactivation during deletion
shaig-mahmudov
committed
a24d16d
test(users): cover inactive state after soft deletion
shaig-mahmudov
committed
9b8fa3f
test(auth): reject inactive admin tokens
shaig-mahmudov
committed
29ee62a
test(auth): ensure deleted accounts are not restored
shaig-mahmudov
committed
fd80ab5
feat: update user register request
shaig-mahmudov
committed
97d8b74
feat(redis): update redis integration test to adapt ci timing
shaig-mahmudov
committed
1a0f8bf
test(cache): remove duplicate Redis cache write
shaig-mahmudov
authored
ecf4882

Navigation Menu

Uh oh!

Feat/security hardening - #172

Feat/security hardening#172
shaig-mahmudov merged 18 commits into
mainfrom
feat/security-hardening

Commits on Jul 15, 2026

fix(security): restrict websocket message destinations

fix(auth): disable authentication for inactive users

fix(auth): load only active non-deleted users

fix(auth): reject disabled users during jwt authentication

fix(auth): prevent automatic restoration of deleted accounts

refactor(users): preserve registration controller compatibility

refactor(users): preserve user registration service contract

fix(users): deactivate accounts during soft deletion

refactor(security): preserve existing registration access rules

test(security): cover websocket destination authorization

test(auth): cover deleted and inactive account login rejection

test(users): verify account deactivation during deletion

test(users): cover inactive state after soft deletion

test(auth): reject inactive admin tokens

test(auth): ensure deleted accounts are not restored

feat: update user register request

feat(redis): update redis integration test to adapt ci timing

test(cache): remove duplicate Redis cache write