[1.3.2-beta.16] - 2026-10-25
Bug Fixes
- Exempt refresh/setup-required via allowList (max:0 blocks, not exempts) by @John710
@fastify/rate-limit treats a max of 0 as 'zero requests allowed' —
setup-required got 429'd on every call. Route exemption belongs in
allowList. - Session recovery path — refresh grace, rate-limit exemptions, client storm guard by @John710
Multi-tab usage made sessions self-destruct: two tabs refreshing within
the rotation window tripped the replay guard, which revoked every
session; the logout burst then exhausted the 10/min auth rate limit,
so the login page itself threw raw 429 toasts.- refresh rotation now grants the consumed token a 30-second grace
window instead of deleting it: concurrent tab refreshes are benign,
a token reused beyond the grace is still treated as stolen - /auth/refresh and /auth/setup-required are exempt from the rate
limit (they are the recovery path); /auth/login stays at 10/min - api.js: after a failed refresh a latch stops the queued-request
refresh storm; cleared on successful login - 429 responses surface as a localized 'too many requests' message
- refresh rotation now grants the consumed token a 30-second grace
Full Changelog: v1.3.2-beta.14...v1.3.2-beta.16