5 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	6cadcc725d	feat: answer every public request-body bind failure with a 400 that names the problem (empty body, JSON syntax error with its byte offset, wrong JSON type for the body or a named field, missing or out-of-range fields by json key) instead of a blanket malformed-JSON message or a 500, accept a single contact object on POST /v1/contacts as the CLIs send it, and drop the API-key lookup cache whose 300ns TTL made it a Redis round trip that saved nothing	2026-09-22 20:21:41 -07:00
Matthew Meszaros	e9d1a7e734	feat: reserve the per-account reauth attempt atomically before checking a password or 2FA code, keep the 2FA dialogs open while a request is in flight, move and trap focus in them, show a retry row when 2FA status fails to load, and drop Idempotency-Key from the recovery-code route with the reason documented	2026-09-19 08:36:59 -07:00
Matthew Meszaros	de10ca5216	feat: put 2FA disable and recovery-code regeneration behind the per-account reauth attempt budget and document it in the account API reference	2026-09-19 08:16:53 -07:00
Matthew Meszaros	274ff888a5	feat: rebuild two-factor setup in Settings > Security as a three-step wizard with a QR code, manual setup key and TOTP parameters, inline code errors, and recovery codes with download, copy and print; show enable date and remaining recovery codes, add POST /auth/2fa/recovery-codes to regenerate them, return two_fa_invalid_code on a mismatched code, and update the security guide, API reference, error codes and OpenAPI	2026-09-19 08:15:31 -07:00
Matthew Meszaros	4013b33008	feat: expose security notification APIs ... Wires notification and two-factor services into the backend and consumer, adds the authenticated notification feed/preferences endpoints, and exposes the public 2FA login verification endpoint.	2026-06-08 15:04:47 +02:00