Wekan

REST login, API authentication, private attachment reads and uploads, imports and exports now share an active-account check. REST and header-login token issuance test account status atomically; LDAP leaves token issuance to the validated login pipeline. Disabling an account clears its tokens and Meteor disconnects the sessions observing them. A startup observer also revokes tokens on existing disabled accounts and direct database updates. Reactivation does not restore old tokens. Anonymous public-board access remains public; already authorized operations are not rolled back.

People’s Active control uses the administrator-only method and reports errors. Admin-created users receive their active status, administrator flag, profile, organizations and teams before insertion, through a trusted server context. Creation is awaited and ordinary users cannot invoke the admin creation method. Attributable disabled-account authentication attempts are summarized as InactiveBleed in Admin Panel / Problems.

Upcoming regression audit: positive and negative Node tests cover authentication, atomic issuance, revocation, logging failure, attachment contexts and a source sweep across server, models, imports, packages and client code. The affected HTTP, LDAP, export, team-membership and security-catalog suites pass. A Meteor build and three Chromium tests pass, covering inactive creation, REST and DDP login, old Bearer/cookie/legacy upload credentials, live-session disconnection, direct database deactivation, reactivation, People toggles and admin-only account creation. Live LDAP and the FerretDB matrix were not exercised.