refactor(auth): one account per browser session

The session held a wallet of up to six accounts, and a request picked one by a header or an
?account= parameter. It now holds one: user_id and its epoch. A sign-in replaces whoever was
signed in, sign-out and account deletion end the session, and an account refused mid-session
(revoked, suspended, deactivated) clears it. /api/me/accounts and /api/me/switch are gone, and
with them their refusal codes and the UI copy for them.

A cookie the multi-account build wrote carries no single epoch and is refused: its holder signs
in once more. A Google link finishing in a browser now signed in as someone else is refused, as
before for an account outside the wallet. A test holds that no app code reads the wallet keys or
the account header again.
This commit is contained in:
2026-10-20 04:36:26 +02:00
parent dc4f4f5143
commit 59ec4a28ba
9 changed files with 151 additions and 300 deletions
-5
View File
@@ -24,7 +24,6 @@
"screenshot": "This screenshot doesn't exist any more",
"link": "This share link doesn't exist any more",
"notification": "This notification doesn't exist any more",
"account": "That account no longer exists",
"collection": "This collection doesn't exist any more",
"config_key": "There's no such setting",
"file": "The file is no longer available",
@@ -135,9 +134,6 @@
"gone": "This playlist no longer exists on YouTube"
},
"refused": {
"account_no_access": "That account no longer has access",
"account_signed_out": "That account was signed out elsewhere — sign in again",
"account_suspended": "That account is suspended",
"address_has_account": "That address already has an account — delete the account instead",
"admin_first": "Create the admin account first",
"admin_only": "Only an admin can do that",
@@ -174,7 +170,6 @@
"not_authenticated": "You're not signed in",
"not_ready": "Not available yet",
"not_redownloadable": "This download can't be downloaded again",
"not_your_account": "That's not an account you've signed into here",
"only_admin_delete": "You're the only admin — make someone else admin before deleting your account",
"own_delete": "Delete your own account in Settings → Account",
"own_role": "You can't change your own role",
-5
View File
@@ -24,7 +24,6 @@
"screenshot": "Ez a képernyőkép már nem létezik",
"link": "Ez a megosztási link már nem létezik",
"notification": "Ez az értesítés már nem létezik",
"account": "Ez a fiók már nem létezik",
"collection": "Ez a kollekció már nem létezik",
"config_key": "Nincs ilyen beállítás",
"file": "A fájl már nem érhető el",
@@ -135,9 +134,6 @@
"gone": "Ez a lejátszási lista már nem létezik a YouTube-on"
},
"refused": {
"account_no_access": "Ennek a fióknak már nincs hozzáférése",
"account_signed_out": "Ezt a fiókot máshol kijelentkeztették — lépj be újra",
"account_suspended": "Ez a fiók fel van függesztve",
"address_has_account": "Ehhez a címhez már tartozik fiók — azt töröld helyette",
"admin_first": "Előbb hozd létre az admin fiókot",
"admin_only": "Ezt csak admin teheti meg",
@@ -174,7 +170,6 @@
"not_authenticated": "Nem vagy bejelentkezve",
"not_ready": "Még nem érhető el",
"not_redownloadable": "Ez a letöltés nem tölthető le újra",
"not_your_account": "Ebbe a fiókba itt nem léptél be",
"only_admin_delete": "Te vagy az egyetlen admin — a fiókod törlése előtt tegyél meg valaki mást adminnak",
"own_delete": "A saját fiókodat a Beállítások → Fiók alatt törölheted",
"own_role": "A saját szerepkörödet nem módosíthatod",