Linus Rath 91a1b1cb51 fix: let non-admin users see their name and change a TOTP password ...

Bulwark read the live display name (#900) and the account profile with
`x:Account/get`, which Stalwart only allows for admins. Every other
user got `forbidden`, so the settings page showed no name and the
identity kept the stale snapshot. The name now comes from
`x:AccountSettings/get`, the account's own settings object; aliases
and quota still use `x:Account/get` where it is permitted.

With TOTP on, Stalwart requires the current code for a password change
and for switching TOTP off ("Current OTP code is required"). Neither
dialog asked for it. Both now do, and the password change sends it as
the `otpAuth/otpCode` patch, because a whole `otpAuth` object would
reset `otpUrl` and turn TOTP off.

Saving the display name also ignored a `notUpdated` answer and showed
success.

2026-09-22 20:28:01 +02:00

..

auth-context.ts

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

credentials.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

jmap-api.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

jmap-passthrough.ts

feat: add Bulwark Lite static export build

2026-09-17 23:54:33 +02:00

principal.ts

fix: let non-admin users see their name and change a TOTP password

2026-09-22 20:28:01 +02:00

server-fetch.ts

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00