mirror of
https://github.com/GNS3/gns3-server.git
synced 2026-08-27 20:40:13 +03:00
3d6d9a3396
Token revocation is a strict version check (token_data.token_version != user.token_version). create_access_token defaults token_version to 0, so the short-lived JWTs minted for the console WebSocket URL (nodes) and the download URLs (symbols, links) carried ver=0. Any user who had logged out at least once (token_version >= 1, e.g. the default admin) got tokens rejected as "revoked" on first use. e433991cf fixed this in _resolve_token's API-key branch but missed these three independent minting sites. Now resolve token_version during _resolve_token (the JWT branch decodes it, the API-key branch reads user.token_version), carry it through gns3_ctx, and pass it at every minting call.