raucao
44e4488a4f
CI / Test (pull_request) Successful in 41s
A new consent for the same app on the same device now replaces the previous authorization, so a device keeps a single active token per app instead of accumulating duplicates. Destroying the superseded record revokes its token in Redis and removes its expiry job. Matching is on (user, client_id, user_agent); a different device or app is left untouched. Also documents the storage-first launch (remoteStorage spec section 11) with an explicit spec proving only the user address is handed over, never an access token. Part of #254