plugin updated to use the refresh flow and security tightened

2026-08-26 17:23:05 +02:00
parent 54d2e4e864
commit 342d8a069a
5 changed files with 260 additions and 21 deletions
@@ -1020,5 +1020,11 @@ First implement a proper refresh-token rotation flow with hashing, revocation, a
 ### Assistant outcome
 Added a refresh-token rotation flow with hashed token storage, per-device binding, token-family revocation, and a dedicated /api/auth/refresh endpoint. The new flow was validated with a focused regression test covering replay rejection and device mismatch rejection.

+### User
+Always update VIBE when finished with a step
+
+### Assistant outcome
+Completed the final extension hardening pass: removed broad host permissions, validated exact backend origins before authenticated requests, kept auth tokens in session storage, cleared invalid-token state aggressively, and verified the extension syntax plus the focused backend auth tests.
+
 ### Assistant outcome
 Made popup state transitions defensive by synchronizing both `hidden` attributes and CSS classes. Non-authentication tag-loading errors no longer switch the popup to signed-out state; only a rejected session does. Added `display: none !important` guards for both authentication blocks.
@@ -182,6 +182,7 @@
 162. The authenticated session text and sign-in block are still shown together.
 163. Use the VIBE directory to log interactions.
 164. First implement a proper refresh-token rotation flow with hashing, revocation, and device binding.
+165. Always update VIBE when finished with a step.

 ## Future entries