Matthew Meszaros 78ec522758 feat: challenge a sign-in that could not physically be the same person, which a remembered device cannot catch because an attacker holding the cookie looks familiar: sign-ins were only ever a Redis device fingerprint with a TTL, so nothing durable recorded WHERE an account was used and there was nothing to compare a new one against; login_history keeps a bounded window per user, the geo lookup gains the coordinates the city database already had, and a journey implying more than 1000 km/h forces the emailed code even on a known device; it declines to judge a first sign-in, a hop under 500 km, an interval under two minutes or a missing position, because a false challenge locks a real person out of their own account and that is the worse failure, and repeated anomalies inside a fortnight reach the workspace posture while one odd trip does not

2026-08-28 12:08:17 -07:00

..

api

feat: measure an uploaded list at import, and say what it looks like (#236)

2026-08-28 11:50:48 -07:00

development

feat: build the browser half of social sign-in, which was never wired: GOOGLE_CLIENT_ID was read at boot and made the login screen render a Google button, but the button opened a popup at /auth/google/login which no route served, and authService.GoogleAuth/AppleAuth had no caller anywhere in the codebase; internal/app/socialauth now runs Google and Apple through the flow generic OIDC already used (one-time state, PKCE, nonce, id_token verified against the provider JWKS, identity keyed on issuer and subject, JIT provisioning, the ban and 2FA gates), the redirect URI defaults to API_PUBLIC_URL/v1/auth/<provider>/callback and is logged at boot because registering the dashboard origin instead is the mistake that produces a valid OAuth client and a dead button, /auth/config advertises only providers the backend can actually complete, the SSO landing page no longer swallows a two_fa_required response, and OIDC_PROVIDER_NAME finally reaches the button it documents

2026-08-28 01:33:08 -07:00

guides

feat: challenge a sign-in that could not physically be the same person, which a remembered device cannot catch because an attacker holding the cookie looks familiar: sign-ins were only ever a Redis device fingerprint with a TTL, so nothing durable recorded WHERE an account was used and there was nothing to compare a new one against; login_history keeps a bounded window per user, the geo lookup gains the coordinates the city database already had, and a journey implying more than 1000 km/h forces the emailed code even on a known device; it declines to judge a first sign-in, a hop under 500 km, an interval under two minutes or a missing position, because a false challenge locks a real person out of their own account and that is the worse failure, and repeated anomalies inside a fortnight reach the workspace posture while one odd trip does not

2026-08-28 12:08:17 -07:00

learn

feat: verify warmup mail that arrives without its verify header, because Microsoft Graph strips custom headers in transit and re-stamps the Message-ID, so every warmup email sent from an Outlook or Microsoft 365 mailbox reached its recipient unmarked, consumed no token, earned no engagement and was filed in the recipient's unibox as ordinary mail; the Graph client now creates the message as a draft and sends that so it can read the internetMessageId Exchange assigned, the consumer records that delivered id on the task and its warmup token alongside the sent subject, and the recipient resolves an unmarked warmup email by delivered Message-ID or by the pending sender/recipient/subject pair

2026-08-26 04:31:19 -07:00

meta.json

Publish development docs to docs.warmbly.com

2026-06-28 13:25:08 +02:00