Marc-André Bombeck 47f20b773d fix(auth): answer 503 for every session lookup failure that is not about the value ...

The catch kept a denylist of "store unreachable" signals and folded
everything else into a missing session. The pool's own connect timeout
carries no code, and 53300, 53200 and 55P03 are about the store, so all
four answered 401 and signed the client out. The shape check already
refuses crafted values before the query; the catch now keeps only a
short allowlist of input refusals (SQLSTATE class 22, Prisma
validation) as null and raises 503 for the rest.

2026-10-20 10:36:16 +02:00

..

__tests__

fix(auth): answer 503 for every session lookup failure that is not about the value

2026-10-20 10:36:16 +02:00

mfa

fix(auth): claim a WebAuthn challenge in the statement that checks it

2026-09-26 20:22:12 +02:00

acting-carrier.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

argon2-params.mjs

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

audit.ts

fix(audit): keep refusals and job telemetry out of audit_logs

2026-10-20 06:49:03 +02:00

bearer.ts

fix(auth): make Bearer scope fail closed on every route

2026-07-19 00:44:10 +02:00

client-transport.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

device-fingerprint.ts

feat(security): alert on a new-device sign-in

2026-06-27 20:34:31 +02:00

existing-factor-proof.ts

fix(auth): a new email address on an account with a second factor needs that factor

2026-09-27 00:59:06 +02:00

handover-token.ts

feat(sharing): hand a managed profile over to the person it describes

2026-10-08 11:18:14 +02:00

hibp.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00

hmac.ts

chore(ci): pin the supply chain and surface build provenance

2026-06-10 15:05:05 +02:00

invite-token.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

issue-token.ts

fix(01-05): serialize MCP refresh families

2026-07-29 13:50:14 +02:00

login-alert.ts

feat(i18n): add Dutch as an eighth end-to-end locale

2026-10-19 11:06:55 +02:00

login-response.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

login-throttle.ts

fix(auth): wrong passwords from elsewhere can no longer lock the owner out

2026-09-26 22:42:40 +02:00

mfa-enrollment.ts

feat(security): let an operator require a second factor

2026-06-27 21:49:53 +02:00

native-client.ts

fix(auth): revoke bearer on logout, gate refresh-token issuance, widen device-mismatch revoke

2026-06-05 03:01:36 +02:00

native-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

native-web-handoff.ts

chore(release): v1.32.11 — native web-handoff login for self-hosted iOS

2026-07-24 02:28:51 +02:00

oidc-cookie.ts

fix(auth): harden the OIDC token path and state-cookie lifecycle

2026-07-14 11:53:53 +02:00

oidc-native-handoff.ts

Drop unimported re-exports outside the barrels

2026-08-23 19:11:12 +02:00

oidc-pending-link.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

oidc.ts

fix(auth): ask the provider for a fresh sign-in when claiming a profile

2026-10-16 05:45:59 +02:00

passkey.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

password.ts

Guard the dummy mint, not only the dummy verification

2026-09-11 14:36:27 +02:00

profile-update.ts

fix(auth): a new email address on an account with a second factor needs that factor

2026-09-27 00:59:06 +02:00

refresh-token.ts

fix(auth): refuse a device-bound refresh token presented without its device

2026-09-26 20:23:55 +02:00

second-factor.ts

fix(auth): count a passkey as the second factor on the managed-profile acts

2026-10-17 09:56:30 +02:00

secure-cookie.ts

feat(auth): warn on a Secure-cookie / plain-HTTP transport mismatch at login

2026-07-08 23:36:48 +02:00

security-activity.ts

feat(security): list active sessions, sign out everywhere, and show security activity

2026-06-27 20:34:43 +02:00

session.ts

fix(auth): answer 503 for every session lookup failure that is not about the value

2026-10-20 10:36:16 +02:00

step-up.ts

fix(auth): reconcile step-up elevations with main at v1.32.0

2026-07-23 09:16:03 +02:00

transport-refusal.ts

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

trusted-device.ts

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn-rp.ts

chore(deps): move to SimpleWebAuthn 14 and React 19.3

2026-09-25 19:53:47 +02:00