mrhid6 217e2dc5a9 feat(auth): prefer rather than require passkey user verification ...

Requiring user verification made password managers such as NordPass ask
for their master password on every passkey use. Every ceremony now asks
for it as preferred and no longer rejects a result without it.

This is a deliberate trade-off: a passkey used without verification is
possession-only, so passwordless sign-in and step-up rest on the device or
vault being unlocked. The spec records the decision.

2026-09-16 15:20:31 +00:00

.gitea/workflows

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

default_steps

fix: Fixed step descriptions

2026-08-04 17:45:31 +01:00

deploy

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

docs/superpowers

feat(auth): prefer rather than require passkey user verification

2026-09-16 15:20:31 +00:00

server

feat(auth): prefer rather than require passkey user verification

2026-09-16 15:20:31 +00:00

web

test(mfa): fix step-up test to assert the fresh-session path

2026-09-16 14:20:42 +00:00

.gitattributes

feat: Updated hq login page

2026-07-29 10:35:07 +01:00

.gitignore

test(mfa): end-to-end coverage, OpenAPI and documentation

2026-09-16 14:18:39 +00:00

CLAUDE.md

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

S

Description

No description provided

9.7 MiB

Languages

JavaScript 63.9%

Go 19.3%

TypeScript 16.6%