ApiCore

4 Commits

Include renames

Author	SHA1	Message	Date
Nick SzaunigandClaude Opus 5.5	832997f885	feat(ui): users and audit log as readable cards with names and retry - Users: one card per person on every screen size, status and MFA as icon plus word, server reasons (e.g. "more rights than you") shown. - Audit log: names instead of user ids, area as a choice instead of a free-text type, optional record id, filter reset, cards instead of a 5-column table, empty and error states with a next step. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-01 12:13:40 +02:00
Nick SzaunigandClaude Opus 5.5	5c666fe49a	fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes - Per-account lockout: five failed attempts (password, MFA code or a step-up confirmation) lock the account for 15 minutes, on top of the per-IP throttle - guesses spread over many addresses no longer help. - A TOTP code is accepted once: the time step is stored and that step or any earlier one is refused (also between two concurrent requests). - Login runs bcrypt on every path and answers unknown email, wrong password, deactivated and locked accounts with the same message; failed logins for unknown emails no longer write attacker-chosen text into the audit log. - Turning MFA off needs password and a current code; turning it on needs the password. Both end all other sessions. - New audit action ACCOUNT_LOCKED. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-01 02:27:47 +02:00
Nick Szaunig	0a52b29c57	fix: Bug fixed für alle Seiten und das Profil und label Backend Image / build-and-push (push) Successful in 2m44s Details Frontend Image / build-and-push (push) Successful in 2m47s Details	2026-08-27 15:15:55 +02:00
Nick Szaunig	ad787f8155	feat(frontend): Audit-Log-Ansicht (Modul 19) Neue Seite /settings/audit-log (nur Administrator) mit Filter nach Entitätstyp/-ID, Navigation um Audit-Log-Link ergaenzt.	2026-08-22 09:53:36 +02:00