Marc-André Bombeck f1c977a7a7 test(auth): give the MFA fixtures a Bearer transport ...

The disable-route suite only ever supplied a cookie-shaped context, which is why
the token-id-as-session-id defect was invisible to it. It now covers both arms
and asserts the credential shape handed to the session revoker, plus that the
elevation is spent before the teardown and not spent when the factor code is
wrong.

2026-07-19 14:43:05 +02:00

..

disable

test(auth): give the MFA fixtures a Bearer transport

2026-07-19 14:43:05 +02:00

recovery-codes/regenerate

fix(auth): make the re-proved factor decide what an elevation reaches

2026-07-19 13:48:46 +02:00

totp

fix(auth): make the re-proved factor decide what an elevation reaches

2026-07-19 13:48:46 +02:00

webauthn

test(auth): give the MFA fixtures a Bearer transport

2026-07-19 14:43:05 +02:00

route.ts

fix(auth): make the re-proved factor decide what an elevation reaches

2026-07-19 13:48:46 +02:00