Marc-André Bombeck 8f56ac95d8 fix(auth): harden the second-factor verify and disable surfaces ...

Reject any challenge that is not a login challenge before minting a session,
cap the disable and confirm request bodies through safeJson, and correct the
recovery-code scan comment to match its early-return-on-match behaviour.

2026-06-27 20:08:10 +02:00

..

disable

fix(auth): harden the second-factor verify and disable surfaces

2026-06-27 20:08:10 +02:00

recovery-codes/regenerate

feat(auth): add TOTP second factor and recovery codes

2026-06-27 19:56:16 +02:00

totp

fix(auth): harden the second-factor verify and disable surfaces

2026-06-27 20:08:10 +02:00