Repository navigation
fix(bff): upgrade backendkit to v1.27.0 (logout tombstone in MemoryStore) - #68
Merged
Merged
Conversation
…ore) backendkit v1.26.1 makes MemoryStore keep a logout tombstone, so a request in flight during a sign-out (the Gateway's touch or a token refresh writing the session back) can no longer re-insert a session the logout revoked. The admin BFF keeps its sessions in MemoryStore. Nothing else in v1.26.0..v1.27.0 reaches it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA
ovander
pushed a commit
that referenced
this pull request
Oct 11, 2026
Moves [Unreleased] under [1.7.1] - 2026-10-11 (#68 backendkit v1.27.0, #67 docs) in Changed-then-Fixed order, updates the compare links, package.json and lockfile versions, and the push.sh examples. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The admin BFF keeps its sessions in backendkit's
bff.MemoryStore. Until backendkit v1.26.1, a request in flight during a sign-out could re-insert the session the logout had just revoked. Two writes did that: the gateway touching the session on a proxied call, and a token refresh writing rotated tokens back. backendkit v1.26.1 makesMemoryStore.Deletekeep a one-hour tombstone thatPutrespects (ovander/backendkit#121), as the Postgres store always has.bff/go.mod: backendkit v1.25.0 → v1.27.0, from the published tag.jwtauth,conformanceandServiceTokenWithScopesare unused here.bff/README.mdnames v1.27.0.How it was tested
npm run lint:check: not run, no SPA changenpx vue-tsc -b && npm run build: not run, no SPA changenpm run coverage: not run, no SPA changenpx playwright test: not run, no SPA change./scripts/npm-audit-gate.sh: not run, no SPA changecd bff && go vet ./... && go test -race ./... && golangci-lint run ./...(0 issues)## [Unreleased]inCHANGELOG.mdThe race itself is covered by backendkit's tests, including a concurrent one under
-race.Deploy notes
🤖 Generated with Claude Code
https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA
Generated by Claude Code