mrhid6 069e7e7c61 fix(api): declare MFA routes session-only so the server boots ...

The MFA routes were missing from routeScopes and serverScopedRoutes, and both
boot assertions refused to start the server. They are deliberately not
reachable by API tokens, so they go in a new sessionOnlyRoutes set rather than
receiving a scope, and are declared exempt from server scoping.

Adds a test that registers the real routes and runs both boot assertions, so
an undeclared route fails CI instead of production startup.

2026-09-16 14:40:29 +00:00

.gitea/workflows

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

default_steps

fix: Fixed step descriptions

2026-08-04 17:45:31 +01:00

deploy

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

docs/superpowers

docs: implementation plan for MFA on local sign-in

2026-09-16 08:15:46 +00:00

server

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

web

test(mfa): fix step-up test to assert the fresh-session path

2026-09-16 14:20:42 +00:00

.gitattributes

feat: Updated hq login page

2026-07-29 10:35:07 +01:00

.gitignore

test(mfa): end-to-end coverage, OpenAPI and documentation

2026-09-16 14:18:39 +00:00

CLAUDE.md

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

S

Description

No description provided

9.7 MiB

Languages

JavaScript 63.9%

Go 19.3%

TypeScript 16.6%