Marc-André Bombeck 01689f77bc feat(security): require fresh verification before destructive account actions ...

Account deletion and the keep-account data reset now demand a recent
second-factor re-verification for accounts that have a second factor
active; single-factor accounts are unaffected and keep the typed-
confirmation-only contract. The gate runs through requireFreshMfaIfEnrolled,
which is cookie-only by construction — a Bearer transport for an MFA-enrolled
account cannot satisfy step-up and surfaces the auth.stepup.required envelope
so the UI can launch a re-verification flow.

2026-06-27 20:34:11 +02:00

..

__tests__

chore(release): v1.4.27

2026-05-15 22:59:10 +02:00

account

feat(security): require fresh verification before destructive account actions

2026-06-27 20:34:11 +02:00

data

feat(security): require fresh verification before destructive account actions

2026-06-27 20:34:11 +02:00

email

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

global-services

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

moodlog

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00

ntfy

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00

reminder-thresholds

feat(medications): make low-stock alert reorder-lead-time aware

2026-06-14 20:39:06 +02:00

telegram

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

webhook

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00