Marc-André Bombeck 94c3cdea96 fix(auth): count a passkey sign-in as a satisfied second factor ...

A passwordless passkey login already clears user verification and is a
phishing-resistant possession factor, but it never stamped the session, so a
passkey user could not satisfy an MFA-enforcement policy or pass a step-up
re-check. Stamp Session.mfaVerifiedAt on a primary passkey login so it counts
as a completed second factor — equivalent to a password+TOTP sign-in. The
password+TOTP path is unchanged.

2026-06-27 21:50:02 +02:00

..

login-options

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

login-verify

fix(auth): count a passkey sign-in as a satisfied second factor

2026-06-27 21:50:02 +02:00

register-options

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

register-verify

fix(api): bound every JSON body read

2026-06-10 11:36:51 +02:00