- Shipped
- July 17, 2026 at 11:48 PM UTC
- Author
- Kamo
- Commit
- 8c76351
The ACTIVE-member login gate previously lived only in the password-login controller. Extend it to every session-minting path via the shared-lib **************** predicate, and make off-boarding an enforcement event rather than a display-only field write: - Login gate now uses the shared predicate and fails CLOSED on error (was falling through to session creation on any exception). - Device-token exchange (mobile SSO) rejects non-ACTIVE members at membership resolution — closes the critical durable "stays signed in after termination" bypass. - enter-as and god-mode impersonation gate on the same predicate (were recordState-only), so an off-boarded member cannot be re-entered/impersonated into a live session. - KSessionService: maintain a userId->{***Id} reverse index and add deleteSessionsForMember() so a member's live sessions can be revoked. - Flipping a team member out of ACTIVE now revokes their live sessions immediately (MemberController), and /session/refresh re-checks eligibility and kills any residual session. - Fix force-logout: it read *** string keys as Redis hashes (always WRONGTYPE, deleted nothing) — now purges via the reverse index. - Chat/Interaction-Center roster (/by-department) excludes non-ACTIVE members and now emits real isActive + teamMembershipStatus for client filtering. - Lead-assignee list excludes non-ACTIVE members; accept surfaces NOT_ACTIVE.