mrhid6 19383abaf8 fix(auth): final-review MFA fixes F1 F2 F3 F5 F7 and drop Ticket.Attempts ...

- OIDC sessions minted through saveSignIn with AMR oidc and StepUpAt
- passwordless passkey uses ValidateDiscoverableLogin with owner-handle check
- TOTP replay guard burns the matched step, not the current one
- enrol-only tickets refused once the user already has a factor
- bootstrap owner session minted through mintSession

2026-09-16 14:26:42 +00:00

.gitea/workflows

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

default_steps

fix: Fixed step descriptions

2026-08-04 17:45:31 +01:00

deploy

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

docs/superpowers

docs: implementation plan for MFA on local sign-in

2026-09-16 08:15:46 +00:00

server

fix(auth): final-review MFA fixes F1 F2 F3 F5 F7 and drop Ticket.Attempts

2026-09-16 14:26:42 +00:00

web

test(mfa): fix step-up test to assert the fresh-session path

2026-09-16 14:20:42 +00:00

.gitattributes

feat: Updated hq login page

2026-07-29 10:35:07 +01:00

.gitignore

test(mfa): end-to-end coverage, OpenAPI and documentation

2026-09-16 14:18:39 +00:00

CLAUDE.md

test(mfa): end-to-end coverage, OpenAPI and documentation

2026-09-16 14:18:39 +00:00

S

Description

No description provided

9.7 MiB

Languages

JavaScript 63.9%

Go 19.3%

TypeScript 16.6%