rays 37c08195f1 A new password signs the account out everywhere (#334) ...

ipx user passwd, the one way to change a password and the step taken
when one may be known to someone else, only replaced the hash. Every
session stayed, and session_user moves `seen` on each use, so a
session someone kept using never reached the idle cutoff.

set_password now deletes the account's sessions too. API tokens stay:
a reset that broke every script would be a reason not to reset, and
the owner lists and removes tokens in Settings. The command says how
many still work.

Also corrects the first-start log line from #321: there is no way to
change a password in the page, so it names the command alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-23 14:45:41 +00:00

..

architecture.md

docs/signals.md: how Signals work, with TypeSafe's requests and answers and the API

2026-10-16 17:57:05 +00:00

cli.md

A new password signs the account out everywhere (#334)

2026-10-23 14:45:41 +00:00

configuration.md

A feed's credentials go to its own host alone (#327 #328)

2026-10-23 14:02:10 +00:00

directory.md

directory.toml's fetch_internal lets the refresher reach listed addresses (#329)

2026-10-23 14:33:30 +00:00

signals.md

An OPML's page lists its shows' items together, not the shows (#283)

2026-10-18 17:41:38 +00:00

sso.md

docs: the three services, their versions and traces (#207, #213)

2026-10-12 16:40:08 +00:00

users.md

The first admin gets a random password, not admin / ipodderx (#321)

2026-10-23 13:55:34 +00:00