yiekheng 27b7a3df1f feat(web): edge-safe HMAC-signed session cookie ...

signSession + verifySession run on Edge runtime (Web Crypto only).
Verifier checks signature (constant-time compare), expiry, clock-skew
on iat (60s tolerance), token version vs OPERATOR_TOKEN_VERSION env,
and role-shape sanity. 11 unit tests cover round-trip plus every
rejection path attackers could probe.

2026-05-10 17:43:01 +08:00

..

bot

fix(bot): dedupe duplicate reminder.fire jobs (msg sent twice)

2026-05-10 16:41:11 +08:00

web

feat(web): edge-safe HMAC-signed session cookie

2026-05-10 17:43:01 +08:00