Marc-André Bombeck 4979805d11 fix(audit): keep refusals and job telemetry out of audit_logs ...

A *.validation-failed row was written on every malformed request, the
caller's own included, and the PR detection enqueue wrote one per batch.
Neither is a security event and nothing reads them. auditLog now files a
refused attempt only when a delegate made it, for the owner's activity
feed; otherwise it rides the wide event as meta.rejected_attempt. The PR
detection enqueue moves to annotate().

2026-10-20 06:49:03 +02:00

..

__tests__

fix(audit): keep refusals and job telemetry out of audit_logs

2026-10-20 06:49:03 +02:00

mfa

fix(auth): claim a WebAuthn challenge in the statement that checks it

2026-09-26 20:22:12 +02:00

acting-carrier.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

argon2-params.mjs

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

audit.ts

fix(audit): keep refusals and job telemetry out of audit_logs

2026-10-20 06:49:03 +02:00

bearer.ts

fix(auth): make Bearer scope fail closed on every route

2026-07-19 00:44:10 +02:00

client-transport.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

device-fingerprint.ts

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

existing-factor-proof.ts

fix(auth): a new email address on an account with a second factor needs that factor

2026-09-27 00:59:06 +02:00

handover-token.ts

feat(sharing): hand a managed profile over to the person it describes

2026-10-08 11:18:14 +02:00

hibp.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

hmac.ts

chore(ci): pin the supply chain and surface build provenance

2026-06-10 15:05:05 +02:00

invite-token.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

issue-token.ts

fix(01-05): serialize MCP refresh families

2026-07-29 13:50:14 +02:00

login-alert.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

login-response.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

login-throttle.ts

fix(auth): wrong passwords from elsewhere can no longer lock the owner out

2026-09-26 22:42:40 +02:00

mfa-enrollment.ts

feat(security): let an operator require a second factor

2026-06-27 21:49:53 +02:00

native-client.ts

fix(auth): revoke bearer on logout, gate refresh-token issuance, widen device-mismatch revoke

2026-06-05 03:01:36 +02:00

native-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

native-web-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

oidc-cookie.ts

fix(auth): harden the OIDC token path and state-cookie lifecycle

2026-07-14 11:53:53 +02:00

oidc-native-handoff.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

oidc-pending-link.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

oidc.ts

fix(auth): ask the provider for a fresh sign-in when claiming a profile

2026-10-16 05:45:59 +02:00

passkey.ts

fix(db): read the clock as UTC in raw SQL and prove it on a Berlin database

2026-10-11 12:31:37 +02:00

password.ts

Guard the dummy mint, not only the dummy verification

2026-09-11 14:36:27 +02:00

profile-update.ts

fix(auth): a new email address on an account with a second factor needs that factor

2026-09-27 00:59:06 +02:00

refresh-token.ts

fix(auth): refuse a device-bound refresh token presented without its device

2026-09-26 20:23:55 +02:00

second-factor.ts

fix(auth): count a passkey as the second factor on the managed-profile acts

2026-10-17 09:56:30 +02:00

secure-cookie.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

security-activity.ts

feat(security): list active sessions, sign out everywhere, and show security activity

2026-06-27 20:34:43 +02:00

session.ts

fix(auth): answer 503 when the session store cannot be read

2026-10-20 05:43:58 +02:00

step-up.ts

fix(auth): reconcile step-up elevations with main at v1.32.0

2026-07-23 09:16:03 +02:00

transport-refusal.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

trusted-device.ts

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn-rp.ts

chore(deps): move to SimpleWebAuthn 14 and React 19.3

2026-09-25 19:53:47 +02:00