fix(auth): a tab acts only as the account it was built for, and the review's other findings

A tab names the account it was claimed for on every request, beacon and upload
(X-Siftlode-Expect-Account); current_user and /auth/logout refuse a mismatch with
401 account_changed and keep the session, so a tab left showing the account
signed in before reloads instead of writing to the new one.

/auth/login clears a connect marker left by an abandoned connect, and a link
completes only on a session that still holds. The prefs merge reads the row
under a lock. A tab's sessionStorage records its own owner. A page the account
loses is given up, address bar and remembered page included. The panel layouts
are preferences; the storage contract also refuses a key handed to the Storage
API or to usePref outside its kind. A refused sign-in as someone else and a
failed sign-out say so. The chromium-only e2e specs are in the gate register,
the member walk waits for its requests, and devices.spec checks the save itself.
This commit is contained in:
2026-10-21 01:05:12 +02:00
parent 28b77fed1e
commit 94418a087e
39 changed files with 576 additions and 78 deletions
+2
View File
@@ -55,6 +55,7 @@
},
"writeFailed": {
"hideChannel": "Couldn't change whether the channel is hidden",
"signOut": "Couldn't sign you out",
"blockChannel": "Couldn't change the channel's block",
"unblockChannel": "Couldn't unblock the channel",
"channelSettings": "Couldn't save the channel's settings",
@@ -134,6 +135,7 @@
"gone": "This playlist no longer exists on YouTube"
},
"refused": {
"account_changed": "This tab was showing another account than the one signed in now, so it reloads as that one",
"address_has_account": "That address already has an account — delete the account instead",
"admin_first": "Create the admin account first",
"admin_only": "Only an admin can do that",
+1
View File
@@ -31,6 +31,7 @@
"about": "About",
"signOut": "Sign out",
"signInAsOther": "Sign in as someone else",
"switchNotApproved": "That Google account isn't approved for this instance yet, so you're still signed in as before.",
"googleAddress": "Google account: {{email}}",
"activity": "Activity"
},
+2
View File
@@ -55,6 +55,7 @@
},
"writeFailed": {
"hideChannel": "Nem sikerült módosítani a csatorna elrejtését",
"signOut": "Nem sikerült kijelentkeztetni",
"blockChannel": "Nem sikerült módosítani a csatorna tiltását",
"unblockChannel": "Nem sikerült feloldani a csatorna tiltását",
"channelSettings": "Nem sikerült menteni a csatorna beállításait",
@@ -134,6 +135,7 @@
"gone": "Ez a lejátszási lista már nem létezik a YouTube-on"
},
"refused": {
"account_changed": "Ez a fül más fiókot mutatott, mint ami most be van lépve, ezért újratölt azzal",
"address_has_account": "Ehhez a címhez már tartozik fiók — azt töröld helyette",
"admin_first": "Előbb hozd létre az admin fiókot",
"admin_only": "Ezt csak admin teheti meg",
+1
View File
@@ -31,6 +31,7 @@
"about": "Névjegy",
"signOut": "Kijelentkezés",
"signInAsOther": "Belépés más fiókkal",
"switchNotApproved": "Ez a Google-fiók még nincs jóváhagyva ezen a példányon, ezért továbbra is az eddigi fiókkal vagy belépve.",
"googleAddress": "Google-fiók: {{email}}",
"activity": "Napló"
},