feat(gdpr): HttpOnly author-token cookie (PR3 of #6701)#7548

Draft

JohnMcLear wants to merge 10 commits intodevelopfrom

feat-gdpr-anon-identity

Commits on Apr 19, 2026

docs: PR3 GDPR anonymous identity hardening design spec
JohnMcLear
committed
docs: PR3 GDPR anon identity implementation plan
JohnMcLear
committed
feat(gdpr): ensureAuthorTokenCookie helper — HttpOnly server-set author token
JohnMcLear
committed
feat(gdpr): set HttpOnly author-token cookie from the pad routes
JohnMcLear
committed
feat(gdpr): read author token from cookie first, keep message.token fallback
JohnMcLear
committed
feat(gdpr): stop generating the author token client-side
JohnMcLear
committed
test(gdpr): server sets + reuses the HttpOnly author-token cookie
JohnMcLear
committed
fix+test(gdpr): parse token cookie from handshake Cookie header
JohnMcLear
committed
docs(gdpr): token cookie is now HttpOnly + server-set
JohnMcLear
committed
fix(gdpr): close two HttpOnly token bypasses

JohnMcLear
and
claude
committed