История коммитов

/admin/auth-log lists the audit trail behind the new admin.auth_log.view permission, with filters by account and by kind of event. An account matches both as the subject and as the actor, and an event key from a module the core knows nothing about is shown as it is rather than failing the page.

Adds auth_events and the logger writing it: sign-ins and refusals, password changes and recoveries, revoked sessions, granted and revoked roles. The logger fills in the address, the browser and the actor itself, so no caller can forget them, and the impersonator is named rather than the account being browsed as.

Attempts refused by the throttle are not recorded: they follow from failures already in the log, and a row per attempt would let anyone fill the table. auth:cleanup drops entries older than --event-retention-days (180 by default).

Fixes a gap left by the session work: completing a password recovery now revokes every session of the owner, without the exception a password change makes for the current one — whoever recovers a password is not signed in.

The User singleton, its factory and the mirror that refilled it are gone: CurrentUser is the only way to the visitor of the request, and nothing takes the model from the container any more.

album, downloads, library, help and guestbook: the injected model becomes the service, the id comes from id() and the profile fields from user().

news, notifications, registration, community, online, contacts and mail.