Marc-André Bombeck 94c3cdea96 fix(auth): count a passkey sign-in as a satisfied second factor ...

A passwordless passkey login already clears user verification and is a
phishing-resistant possession factor, but it never stamped the session, so a
passkey user could not satisfy an MFA-enforcement policy or pass a step-up
re-check. Stamp Session.mfaVerifiedAt on a primary passkey login so it counts
as a completed second factor — equivalent to a password+TOTP sign-in. The
password+TOTP path is unchanged.

2026-06-27 21:50:02 +02:00

..

check-user

perf(i18n,shell): ship one locale and stop blocking the first paint

2026-06-11 02:19:27 +02:00

codex

fix(auth): self-hoster opt-out for session-cookie Secure flag (v1.5.1)

2026-05-26 19:16:44 +02:00

login

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

logout

fix(auth): revoke bearer on logout, gate refresh-token issuance, widen device-mismatch revoke

2026-06-05 03:01:36 +02:00

me

feat(security): let an operator require a second factor

2026-06-27 21:49:53 +02:00

mfa

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

passkey

fix(auth): count a passkey sign-in as a satisfied second factor

2026-06-27 21:50:02 +02:00

passkeys

feat(passkeys): surface last-used, rename, and an upgrade nudge

2026-06-27 20:40:53 +02:00

password

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

profile

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00

refresh

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00

register

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

registration-status

Initial release v1.0.0

2026-03-10 20:14:33 +01:00