mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
6b3d3fd840
When a password is accepted for an account with a confirmed TOTP factor, the login route no longer mints a session or token. It creates a single-use, ~5-minute MfaChallenge (the opaque ticket is stored only as a hash) and returns HTTP 200 with data:null, error:null and meta.mfaRequired + mfaTicket + methods. The client completes the login at POST /api/auth/mfa/verify with the ticket + a TOTP or recovery code, receiving the exact same token bundle the password path issues, with the session stamped second-factor-verified. - The ticket is claimed once, atomically, only after the factor verifies, so two concurrent submissions can mint at most one session; no session ever exists before factor two. - Wrong codes increment the ticket attempt counter and burn it at the cap (throttle, not an account lock); the anonymous verify surface is also rate-limited per IP. - meta.mfaRequired is returned only after a valid password and the invalid-credentials response is identical regardless of MFA state, so an attacker without the password cannot enumerate MFA. - The session/token tail is extracted to login-response.ts and shared by both the password path and the verify path, keeping the transport contract identical. OpenAPI registers the verify endpoint, the MFA management endpoints, and the mfaRequired login variant.
docs/ — internal reference + operator playbooks
The user-facing documentation lives at https://docs.healthlog.dev — that's the canonical surface for self-hosting guides, integration walkthroughs, AI-provider setup, and the doctor-report workflow.
The files in this directory are the internal operator playbooks, audit notes, and machine-readable specs that ship alongside the source:
api/— the OpenAPI 3.1 spec for the native-client subset (iOS DTO codegen target). Seeapi/README.mdfor the preview commands.ops/— backup / restore + encryption-key-rotation playbooks. These are the runbooks an operator reaches for during an incident.self-hosting/— horizontal-scaling notes (HEALTHLOG_PROCESS_TYPE=web|worker|all) and the deploy-pipeline recipe. Routine install steps stay ondocs.healthlog.dev.migration/— release-by-release migration notes. Read the entry for the version you're upgrading from.audit/— per-release audit summaries archived for forensic traceability.apple-store-connect-checklist.md— the iOS submission gate.doctor-report.md— PDF generator design notes.codex-protocol-spec.md— Codex / ChatGPT OAuth protocol reverse-engineering notes.ui-guidelines.md— UI / a11y house style.
If you're a self-hoster looking to spin up an instance, start at https://docs.healthlog.dev or jump to the Quick Start in the project README.