Repository navigation

fix(security): an API token's authority is read live, never from the role snapshot taken at mint - #2974

Merged

github-actions[bot] merged 5 commits into

mainfrom

fix/api-token-role-snapshot-staleness

Sep 1, 2026

Merged

fix(security): an API token's authority is read live, never from the role snapshot taken at mint#2974
github-actions[bot] merged 5 commits into
mainfrom
fix/api-token-role-snapshot-staleness

Commits on Sep 1, 2026
- fix(security): an API token's authority is read live, never from the role snapshot taken at mint
  
  rbuergi
  and
  claude
  committed
  12f988a
- docs(access): name the second, distinct defect the stamp's removal exposed (#2976)
  
  rbuergi
  and
  claude
  committed
  68d1907
- test(security): pin the issue's case in TIME ORDER — token first, grant second, no re-mint
  
  rbuergi
  and
  claude
  committed
  0dc5012
- docs: take the review's title fix; the heading level was already correct
  
  rbuergi
  and
  claude
  committed
  6db0415
- test: adopt TestTimeouts.Quick — the suite's wait was a hand-written 30 s literal
  
  rbuergi
  and
  claude
  committed
  3437cfd