Linus Rath ce5f177d53 refactor: move Stalwart's password and TOTP login into a shared helper ...

The password+TOTP login drove Stalwart's structured login (`/api/auth`,
then `/auth/token` with PKCE) inline. Linking the mobile app needs the
same exchange to mint a phone's own grant, so it now lives in
`lib/auth/stalwart-password-login.ts` and the route only maps its
result to the responses it always gave.

2026-09-27 04:11:30 +02:00

..

active-account-slot.ts

fix: harden proxy auth and SSRF defenses

2026-03-31 17:47:09 +02:00

crypto.ts

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

instance-details.ts

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

lite-oauth.ts

fix: revoke Lite refresh tokens on sign-out and keep no failed-login password

2026-09-26 17:15:55 +02:00

lite-tokens.ts

fix: revoke Lite refresh tokens on sign-out and keep no failed-login password

2026-09-26 17:15:55 +02:00

pair-reauth.ts

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

pairing-store.ts

feat: add QR code device pairing for mobile app login

2026-06-05 17:41:55 +02:00

session-cookie.ts

feat: lift 5-account cap on HTTP/2

2026-05-07 12:28:33 +02:00

session-secret.ts

feat: add sessionSecretFile and oauthClientSecretFile for JSON config

2026-05-31 00:14:38 +02:00

stalwart-password-login.ts

refactor: move Stalwart's password and TOTP login into a shared helper

2026-09-27 04:11:30 +02:00

verification-failure.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

verify-budget.ts

fix: limit wrong passwords tried through the login pre-check

2026-09-26 16:36:58 +02:00

verify-jmap-auth.ts

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00