7 Commits

Include renames

Author	SHA1	Message	Date
lobo	d924c09953	feat(user): add owner-lists opt-in setting and user listing endpoint	2026-10-06 13:19:58 +02:00
lobo	365b69feb4	feat(admin): let admins change user roles ... V32 adds role_changed_at and the role_change log. Role changes lock the admin rows, so there is always one admin left; the last admin cannot delete their own account. Login and refresh read the role under the user lock. Tokens issued before a role change are refused.	2026-10-04 20:09:22 +02:00
lobo	6e7fb1e066	feat(account): send display name in account state to Core ... The account state push carries displayName. It is published when the name changes. Contract test updated.	2026-10-02 09:10:56 +02:00
lobo	e72222a37f	feat(profile): role claim in the profile ticket ... The public profile ticket now carries the user's role so Core can check ownership of shop items. PLATFORM_ADMIN gets every catalog item for free. The role comes from the users table; a ticket without the claim means USER.	2026-10-01 13:14:27 +02:00
lobo	fd79c63441	chore(security)!: drop the userId and typ claims and tokens without aud	2026-09-30 15:00:47 +02:00
lobo	06f8089f5a	feat(account): tell Core about Steam ID and block changes ... Sent on the task executor after the commit, and every user again in the nightly cleanup. A failed call only warns.	2026-09-30 15:00:47 +02:00
lobo	afcfacb68b	refactor(api): one error body, token audiences, user lookup by id	2026-09-29 14:48:28 +02:00