Files
rengine/api
Yogesh OjhaandClaude Opus 5 f5437122ab refactor(auth): one step from a token payload to its account
The access gate, the refresh gate and the two-factor gate each decoded
`sub`, parsed the UUID, loaded the user and raised the same three 401s.
They had already started to drift: two checked the row exists, the
third folded is_active into the same answer. deps.user_for_payload()
holds the step and each gate keeps the rule that is its own — refresh
answers 403 for an inactive account, two-factor answers 401.

Responses are unchanged. Exercised: login, me, refresh, me again, and
a malformed bearer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DafWxfoWZXVDgr9KroJBDZ
2026-09-16 08:45:18 +05:30
..
2026-02-04 20:05:28 +05:30
2026-02-04 20:05:28 +05:30