Marc-André Bombeck fc117d7cd9 fix(auth): date a provider re-proof by its auth_time ...

The re-proof accepted an auth_time up to five minutes old and then
stamped the session at callback time, so the proof held for close to
ten minutes after the person signed in at the provider. It now stamps
the authentication instant, clamped to now for a provider clock that
runs ahead, and the gates' five-minute window runs from there.

2026-10-29 11:01:25 +01:00

..

__tests__

fix(auth): date a provider re-proof by its auth_time

2026-10-29 11:01:25 +01:00

guards

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00

mfa

feat(account): hold account deletion and data wipe for a grace window

2026-10-25 13:50:14 +01:00

oidc-callback

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00

acting-carrier.ts

refactor(auth): move the request guards out of api-handler into lib/auth/guards

2026-10-23 10:54:23 +02:00

admin-roster.ts

fix(admin): the last-admin rule counts only admins who can sign in

2026-10-25 17:02:32 +01:00

argon2-params.mjs

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

audit.ts

fix(audit): keep refusals and job telemetry out of audit_logs

2026-10-20 06:49:03 +02:00

bearer.ts

feat(account): hold account deletion and data wipe for a grace window

2026-10-25 13:50:14 +01:00

client-transport.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

credential-revocations.ts

feat(account): hold account deletion and data wipe for a grace window

2026-10-25 13:50:14 +01:00

device-fingerprint.ts

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

existing-factor-proof.ts

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00

handover-token.ts

feat(sharing): hand a managed profile over to the person it describes

2026-10-08 11:18:14 +02:00

hibp.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

hmac.ts

chore(ci): pin the supply chain and surface build provenance

2026-06-10 15:05:05 +02:00

invite-token.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

issue-token.ts

feat(tokens): add a per-token Apple Health setting

2026-10-23 19:28:05 +02:00

login-alert.ts

feat(i18n): register Brazilian Portuguese as a locale

2026-10-22 14:50:00 +02:00

login-response.ts

feat(account): hold account deletion and data wipe for a grace window

2026-10-25 13:50:14 +01:00

login-throttle.ts

fix(auth): read a remembered browser's expiry on the throttle's clock

2026-10-26 15:08:06 +01:00

mfa-enrollment.ts

perf(auth): read the operator settings once per request

2026-10-22 07:25:00 +02:00

native-client.ts

fix(auth): issue a Secure session cookie under the __Host- prefix

2026-10-25 17:44:31 +01:00

native-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

native-web-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

oidc-cookie.ts

fix(auth): harden the OIDC token path and state-cookie lifecycle

2026-07-14 11:53:53 +02:00

oidc-native-handoff.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

oidc-pending-link.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

oidc-reproof.ts

fix(auth): date a provider re-proof by its auth_time

2026-10-29 11:01:25 +01:00

oidc.ts

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00

passkey.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

password.ts

Guard the dummy mint, not only the dummy verification

2026-09-11 14:36:27 +02:00

profile-update.ts

fix(ai): accept every app language on the chat and status requests

2026-10-29 09:19:56 +01:00

refresh-token.ts

fix(auth): refuse a device-bound refresh token presented without its device

2026-09-26 20:23:55 +02:00

second-factor.ts

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00

secure-cookie.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

security-activity.ts

feat(security): list active sessions, sign out everywhere, and show security activity

2026-06-27 20:34:43 +02:00

session-cookie.ts

fix(auth): issue a Secure session cookie under the __Host- prefix

2026-10-25 17:44:31 +01:00

session-user.ts

feat(account): hold account deletion and data wipe for a grace window

2026-10-25 13:50:14 +01:00

session.ts

fix(auth): issue a Secure session cookie under the __Host- prefix

2026-10-25 17:44:31 +01:00

step-up-factors.ts

test(guards): load no module graph inside a guard's test body

2026-10-23 22:51:51 +02:00

step-up.ts

test(guards): load no module graph inside a guard's test body

2026-10-23 22:51:51 +02:00

transport-refusal.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

trusted-device.ts

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn-rp.ts

chore(deps): move to SimpleWebAuthn 14 and React 19.3

2026-09-25 19:53:47 +02:00

write-meter.ts

refactor(auth): move the request guards out of api-handler into lib/auth/guards

2026-10-23 10:54:23 +02:00