Hz_ d2f0a18f42 fix: persist logout access token invalidation (#15397) ...

### What this PR fixes

This PR fixes an issue in the Python backend where user logout did not
reliably persist the invalidated access_token to the database.
Although the logout endpoint returned success and logged that the token
had been invalidated, the user.access_token value could remain
unchanged in the database, which meant the previous login token could
stay valid longer than expected.

  ### What changed

  - Resolve the real user object before updating the token
  - Persist the invalidated access_token before calling logout_user()
- Return a server error if the token update is not written successfully

  ### Impact

- Logging out now correctly replaces the stored access_token with an
INVALID_... value
  - The previous login session is properly invalidated
- The change is limited to the logout flow and is intentionally small in
scope

2026-05-29 19:31:45 +08:00

..

auth

Refactor user REST API (#14334)

2026-04-24 10:25:15 +08:00

restful_apis

fix: persist logout access token invalidation (#15397)

2026-05-29 19:31:45 +08:00

services

Feat: tenant llm provider (#14595)

2026-05-29 17:39:41 +08:00

__init__.py

Refactor: Move API files (#15151)

2026-05-22 17:44:05 +08:00

backward_compat.py

Fix: Correct the API path (#15204)

2026-05-25 17:11:24 +08:00

llm_app.py

Fix: restore saved api_key fallback in add_llm (#14921) (#14941)

2026-05-19 15:32:09 +08:00