From 439683d35082e2e39671564e1a0d9d113aac94ee Mon Sep 17 00:00:00 2001
From: shuaiplus <2327005759@qq.com>
Date: Thu, 2 Jul 2026 16:57:24 +0800
Subject: [PATCH] fix(identity): add security stamp and invalidate user cache
 on token handling

---
 src/handlers/identity.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/handlers/identity.ts b/src/handlers/identity.ts
index 9c8a547..d67b2aa 100644
--- a/src/handlers/identity.ts
+++ b/src/handlers/identity.ts
@@ -419,9 +419,11 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
         }
         user.totpSecret = null;
         user.totpRecoveryCode = createRecoveryCode();
+        user.securityStamp = generateUUID();
         user.updatedAt = new Date().toISOString();
         await storage.saveUser(user);
         await storage.deleteRefreshTokensByUserId(user.id);
+        AuthService.invalidateUserCache(user.id);
         rememberRequested = false;
       } else {
         // Unsupported provider for this server profile behaves as an invalid 2FA attempt.