Matthew Meszaros de10ca5216 feat: put 2FA disable and recovery-code regeneration behind the per-account reauth attempt budget and document it in the account API reference

2026-09-19 08:16:53 -07:00

..

handler

feat: put 2FA disable and recovery-code regeneration behind the per-account reauth attempt budget and document it in the account API reference

2026-09-19 08:16:53 -07:00

middleware

docs: state the tenant and key-shape invariants in these comments as the constraints they are, rather than as an account of what each check replaced, since this repository is public and every self-hosted instance that has not updated yet reads the same text

2026-09-19 08:28:41 +02:00

cors.go

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

routes.go

feat: rebuild two-factor setup in Settings > Security as a three-step wizard with a QR code, manual setup key and TOTP parameters, inline code errors, and recovery codes with download, copy and print; show enable date and remaining recovery codes, add POST /auth/2fa/recovery-codes to regenerate them, return two_fa_invalid_code on a mismatched code, and update the security guide, API reference, error codes and OpenAPI

2026-09-19 08:15:31 -07:00