v0.11.0
February 24, 2026Latest
Added
- Google OAuth account linking from profile settings
- Session management UI (list sessions, revoke, sign out other devices)
- Auth audit logging for login, OAuth link, and phone verification
- Redis-backed rate limiting with per-account throttles
- Phone verification UX with Uzbekistan selector and validation
- Auth docs source-of-truth markdown
Changed
- Cookie-auth requests now require Origin/Referer validation (CSRF protection)
- OAuth error handling uses encoded params and standard error format
- Suspended users are blocked at the auth boundary
Fixed
- Logout-all-sessions reliably revokes refresh tokens
- Auth docs link now points to the correct markdown location