70f6c6befb
get_current_user and get_current_user_optional now reject any token whose payload carries type="refresh". Access tokens carry no type field so the check is asymmetric and safe. Prevents a refresh-cookie value from being replayed as a Bearer access token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __pycache__ | ||
| api/v1 | ||
| core | ||
| lib | ||
| middleware | ||
| migrations | ||
| models | ||
| prompts | ||
| schemas | ||
| services | ||
| tasks | ||
| telemetry | ||
| main.py | ||