~/acme/payments-api on feat/session-refactor
❯ gitdocu audit --pr 482 --depth=full
▸ Fetching PR #482 "Refactor session middleware" (6 files, +214 −87)
▸ Parsing AST across 1,284 files ·················· done 2.1s
▸ Packing context 412,870 / 1,000,000 tokens ······· done
▸ Reasoning over cross-module call graph with Claude ··· done 31.7s
✖ Security · Blocking
src/auth/session.ts:41
Revocation check removed from validateToken(). Revoked JWTs will now pass.
40export async function validateToken(token: Token) {
41- if (await revocations.has(token.jti)) return null;
42 return verifySignature(token, env.JWT_SECRET);
43}
3 downstream callers assume revoked tokens are rejected:
- → src/billing/webhooks.ts:118 refund issuance
- → src/admin/routes.ts:57 role escalation
- → src/api/v2/users.ts:203 account deletion
⚠ Doc drift docs/architecture/auth.md still describes edge-less revocation flow
✓ Review comment + suggested fix posted to PR #482
✓ Doc patch opened as gitdocu/sync-auth-md
2 findings · 1 blocking · completed in 38.4s
❯