Merge remote-tracking branch 'origin/main' into hetzner

Author: github-actions[bot]

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## v1.1.1 (2026-07-01)
+
+### Bug Fixes
+
+- Broken screenshot link
+  ([#213](https://github.com/Promptly-Technologies-LLC/fastapi-jinja2-postgres-webapp/pull/213),
+  [`28e1222`](https://github.com/Promptly-Technologies-LLC/fastapi-jinja2-postgres-webapp/commit/28e12220b476476be829c97963437fd38e538069))
+
+- Convert screenshot to WebP and update doc links
+  ([#213](https://github.com/Promptly-Technologies-LLC/fastapi-jinja2-postgres-webapp/pull/213),
+  [`28e1222`](https://github.com/Promptly-Technologies-LLC/fastapi-jinja2-postgres-webapp/commit/28e12220b476476be829c97963437fd38e538069))
+
+
 ## v1.1.0 (2026-07-01)
 
 ### Documentation

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-jinja2-postgres-webapp"
-version = "1.1.0"
+version = "1.1.1"
 description = "A template webapp with a pure-Python FastAPI backend, frontend templating with Jinja2, and a Postgres database to power user auth"
 readme = "README.md"
 package-mode = false

routers/core/account.py

@@ -734,6 +734,8 @@ async def reset_password(
     session.commit()
     session.refresh(authorized_account)
 
+    revoke_all_refresh_tokens(authorized_account.id, session)
+
     # Auto-login: issue new auth cookies so the user doesn't have to re-enter credentials
     access_token = create_access_token(
         data={"sub": authorized_account.email, "fresh": True}

tests/routers/core/test_account.py

@@ -706,6 +706,46 @@ def test_password_reset_auto_logs_in_and_shows_flash(
     assert any("flash_message=" in c for c in cookie_headers)
 
 
+def test_password_reset_revokes_existing_sessions(
+    unauth_client: TestClient, session: Session, test_account: Account
+):
+    """Password reset revokes all existing refresh tokens before auto-login."""
+    attacker_session = RefreshToken(
+        account_id=test_account.id,
+        expires_at=datetime.now(UTC) + timedelta(days=30),
+    )
+    session.add(attacker_session)
+    session.commit()
+    session.refresh(attacker_session)
+
+    reset_token = PasswordResetToken(account_id=test_account.id)
+    session.add(reset_token)
+    session.commit()
+    session.refresh(reset_token)
+
+    response = unauth_client.post(
+        app.url_path_for("reset_password"),
+        data={
+            "email": test_account.email,
+            "token": reset_token.token,
+            "password": "NewPass123!@#",
+            "confirm_password": "NewPass123!@#",
+        },
+    )
+    assert response.status_code == 303
+
+    session.refresh(attacker_session)
+    assert attacker_session.revoked is True
+
+    active_tokens = session.exec(
+        select(RefreshToken).where(
+            RefreshToken.account_id == test_account.id,
+            RefreshToken.revoked == False,  # noqa: E712
+        )
+    ).all()
+    assert len(active_tokens) == 1
+
+
 def test_password_reset_after_recovery_auto_logs_in(
     unauth_client: TestClient, session: Session
 ):