Marc-André Bombeck a2fc6ea243 fix(auth): reconcile step-up elevations with main at v1.32.0 ...

Renumber the elevation migration from 0260 to 0267 — main claimed 0260
for an unrelated table while this branch sat unmerged, and 0266 is now
the highest committed number.

Two loose ends the merge itself did not touch: the schema comment on
StepUpElevation.method still called it "audit/telemetry only, never an
authorisation input" — the exact claim the fresh-factor fix (a prior
commit on this branch) made false, since the method is now precisely
what decides whether an elevation reaches the destructive MFA routes.
Reworded to match. And pruneExpiredStepUpElevations in step-up.ts was
dead code: the actual sweep runs in cleanup-handlers.ts against the
worker Prisma client for reasons that function could never satisfy
against the request-scoped one. Removed rather than left to drift.

2026-07-23 09:16:03 +02:00

..

__tests__

Merge remote-tracking branch 'origin/main' into work/native-stepup-rebase

2026-07-23 09:04:43 +02:00

mfa

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

argon2-params.mjs

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

audit.ts

feat(admin): resolve the sign-in carrier online + give it its own column

2026-06-29 23:51:40 +02:00

bearer.ts

fix(auth): make Bearer scope fail closed on every route

2026-07-19 00:44:10 +02:00

device-fingerprint.ts

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

hibp.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

hmac.ts

chore(ci): pin the supply chain and surface build provenance

2026-06-10 15:05:05 +02:00

invite-token.ts

Add invite universal-link landing for app deep-link

2026-06-14 19:32:19 +02:00

issue-token.ts

fix(mcp): close OAuth 2.1 resource-server gaps before the remote surface ships

2026-06-27 15:09:11 +02:00

login-alert.ts

fix(api): narrow swallowed database errors and redact the incident URL

2026-07-01 23:45:08 +02:00

login-response.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

mfa-enrollment.ts

feat(security): let an operator require a second factor

2026-06-27 21:49:53 +02:00

native-client.ts

fix(auth): revoke bearer on logout, gate refresh-token issuance, widen device-mismatch revoke

2026-06-05 03:01:36 +02:00

oidc-cookie.ts

fix(auth): harden the OIDC token path and state-cookie lifecycle

2026-07-14 11:53:53 +02:00

oidc-native-handoff.ts

fix(auth): force the native-bundle branch on the OIDC token exchange

2026-07-18 17:02:45 +02:00

oidc.ts

feat(auth): native OIDC SSO session handoff for the iOS client

2026-07-18 16:50:56 +02:00

passkey.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

password.ts

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

profile-update.ts

feat(profile): persist and expose the date-format preference

2026-06-26 12:15:09 +02:00

refresh-token.ts

fix(auth): bind a live refresh token to its issuing device

2026-07-19 11:40:56 +02:00

secure-cookie.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

security-activity.ts

feat(security): list active sessions, sign out everywhere, and show security activity

2026-06-27 20:34:43 +02:00

session.ts

fix(auth): make the re-proved factor decide what an elevation reaches

2026-07-19 13:48:46 +02:00

step-up.ts

fix(auth): reconcile step-up elevations with main at v1.32.0

2026-07-23 09:16:03 +02:00

trusted-device.ts

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn-rp.ts

feat(security): add a TOTP and security-key setup hub

2026-06-27 20:40:36 +02:00