[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"journal-post-sm-user-plugin-0-1-13":3},{"author":4,"categories":8,"content":13,"content_html":14,"created_at":15,"excerpt":16,"featured_image_url":13,"featured_images":17,"id":18,"is_pinned":19,"metadata":13,"next_post":20,"previous_post":24,"published":28,"published_at":29,"reading_time":6,"related_posts":30,"slug":31,"sources":13,"tags":32,"title":33,"translations":13,"updated_at":34},{"first_name":5,"id":6,"last_name":5,"login":7},"",1,"jakubzych@gmail.com",[9],{"id":10,"name":11,"slug":12},3,"Plugins","plugins",null,"\u003Ch2>Highlights\u003C\u002Fh2>\n\u003Cp>sm-user-plugin 0.1.13 hardens device authorization and the admin Reset 2FA action.\u003C\u002Fp>\n\u003Ch2>Fixed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Revoking a device can no longer lose to a refresh happening at the same moment. The revoke always blacklists the token the device holds now, and a refresh of a device revoked meanwhile is refused without handing out a new token.\u003C\u002Fli>\n\u003Cli>A password change or ban now ends the user's pending and confirmed device sessions, and a device the user approved before their last password change can no longer collect a token.\u003C\u002Fli>\n\u003Cli>The admin Reset 2FA action on a member of a privileged group requires the privileged-groups permission, like setting their password or deleting them.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Changed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>The QR code for device sign-in now carries the short code instead of the polling token, so someone who sees the QR code can no longer collect the session. \u003Ccode>golem15.user.device_auth.auth_url\u003C\u002Fcode> gains a \u003Ccode>{short_code}\u003C\u002Fcode> placeholder and defaults to \u003Ccode>{frontend_url}\u002Fdevice\u002Fscan\u002F{short_code}\u003C\u002Fcode>. \u003Ccode>POST \u002Fdevices\u002Fauthorize\u003C\u002Fcode> also accepts the short code in its \u003Ccode>token\u003C\u002Fcode> field.\u003C\u002Fli>\n\u003Cli>The device status poll hands the session token only to the client with the User-Agent that started the flow. A flow started through a server-side proxy and polled from a browser no longer receives its token.\u003C\u002Fli>\n\u003C\u002Ful>\n","2026-10-26T15:43:18+00:00","Device sign-in hardening: race-free revoke, sessions end on password change, QR no longer carries the polling token.",[],42,false,{"id":21,"slug":22,"title":23},41,"sm-mfa-plugin-0-1-1","sm-mfa-plugin 0.1.1",{"id":25,"slug":26,"title":27},43,"sm-mfa-plugin-0-1-2","sm-mfa-plugin 0.1.2",true,"2026-10-26T15:40:04+00:00",[],"sm-user-plugin-0-1-13",[],"sm-user-plugin 0.1.13","2026-10-29T10:39:25+00:00"]