Security: broken auth in src/admin/password-admin-auth-provider.ts #1016

CodeRabbit's historical security scan of this repository (scan e8c825ec-84c1-4a90-b646-61791714baf8, revision bc22677aba, generated 2026-11-01) reported this. It is an AI-generated finding, not a confirmed vulnerability: reachability is not established by the scan, and the report itself says so. Triage before treating it as exploitable.

F-021 — broken auth (medium)

src/admin/password-admin-auth-provider.ts:57-65

Logout deletes the browser cookie without invalidating the underlying administrator session token. Authentication continues accepting that token until its signed expiry, allowing a retained copy to restore administrator access after sign-out.

Evidence

• Source/control: A retained copy of an administrator session token whose owner has subsequently logged out.
• Sink/decision: isRequestAuthenticated accepts the token without checking whether its session was terminated.
• Missing mitigation: Tokens have no independently revocable session identifier, and neither cookie nor Bearer authentication checks server-side termination state.

Suggested fix. Give each session a unique identifier and invalidate the presented session on logout in shared server-side storage. Check that state whenever accepting either cookie or Bearer credentials.

Finding F-021 of 43 in the scan. The other findings are filed as separate issues by area.