2 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	9f7d45a1fb	feat: charge every password, emailed-code and TOTP attempt atomically before comparing it (Redis INCR+expire script) with a per-account TOTP budget across challenges, put the signed-in password change on the reauth budget, set the per-account login limit to 50 per hour, give tester passwords an expiry (users.password_expires_at, migration 000257) and clear them plus every session on revoke, mint warmblyctl reset links with the password-reset purpose, expire fleet join tokens (7 days default, 30 max, reusable inside the window), derive captcha from the resolved Turnstile secret, refuse weak bootstrap argon2id hashes, make registration codes single-use, rate-limit the v1 invitation lookup, and draw RIDs and user codes without modulo bias	2026-10-04 02:52:22 -07:00
Matthew Meszaros	772c19820d	New Repository: Add Backend Code	2026-01-17 14:11:14 +00:00