mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
29940afb57
- deleting a profile and ending a guardian's access resolve fresh MFA, and both sit behind a confirmation, so the request that reaches the server is minutes old and routinely outside the five-minute window - an account with no second factor is told where to set one up instead of being asked to confirm one it does not have - the arm is scoped to those two acts: a 401 on accept, revoke or renounce is a lapsed session and must not read as a factor prompt