Fast-forwards production to main to deploy loghq's uniform auth conversion, matching the other HQ apps. Merging this deploys to prod — deploy.yml runs on the production branch — and, because the session cookie is renamed loghq_token → auth-token, it forces a one-time logout of all live sessions.
Auth change (the headline — commits 67e2d6c, cdc96a3)
- Single HttpOnly
auth-tokencookie. Removed the client-side token store,authFetch, and the refresh subsystem. - Server-side gating; every dashboard/API data call now authenticates via the same-origin cookie (resolvers in
routes/projects.ts,routes/analytics.ts,app/Support/request-auth.tsgained a cookie fallback before the client dropped the bearer). - Session length stamped from one per-login number: 7-day baseline, 30-day "remember me" (checkbox off by default).
- Custom Login/Register/VerifyTwoFactor/Logout actions + shared
authCookie.ts; dormant-but-correct 2FA; no refresh exchange.
Also bundled (already on main, not part of the auth work)
production was 17 commits behind main, so this cut also ships 15 prior commits: the BunPress product guide/docs, CI/release-validation hardening, SSR/a11y/SDK test suites, a mobile-nav viewport fix, the date-range picker, and the stx config revert to ui.ts.
Verification
Adversarially verified static-clean (0 blockers, 0 high/medium). No live login was executed before merge; the first successful sign-in after deploy confirms the cookie + tier + resolver wiring end to end.