ApiCore

245 Commits 2 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Nick SzaunigandClaude Opus 5.5	832997f885	feat(ui): users and audit log as readable cards with names and retry - Users: one card per person on every screen size, status and MFA as icon plus word, server reasons (e.g. "more rights than you") shown. - Audit log: names instead of user ids, area as a choice instead of a free-text type, optional record id, filter reset, cards instead of a 5-column table, empty and error states with a next step. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-01 12:13:40 +02:00
Nick SzaunigandClaude Opus 5.5	5c666fe49a	fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes - Per-account lockout: five failed attempts (password, MFA code or a step-up confirmation) lock the account for 15 minutes, on top of the per-IP throttle - guesses spread over many addresses no longer help. - A TOTP code is accepted once: the time step is stored and that step or any earlier one is refused (also between two concurrent requests). - Login runs bcrypt on every path and answers unknown email, wrong password, deactivated and locked accounts with the same message; failed logins for unknown emails no longer write attacker-chosen text into the audit log. - Turning MFA off needs password and a current code; turning it on needs the password. Both end all other sessions. - New audit action ACCOUNT_LOCKED. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-01 02:27:47 +02:00
Nick Szaunig	0a52b29c57	fix: Bug fixed für alle Seiten und das Profil und label Backend Image / build-and-push (push) Successful in 2m44s Details Frontend Image / build-and-push (push) Successful in 2m47s Details	2026-08-27 15:15:55 +02:00

Author

SHA1

Message

Date

Nick SzaunigandClaude Opus 5.5

832997f885

feat(ui): users and audit log as readable cards with names and retry

- Users: one card per person on every screen size, status and MFA as
  icon plus word, server reasons (e.g. "more rights than you") shown.
- Audit log: names instead of user ids, area as a choice instead of a
  free-text type, optional record id, filter reset, cards instead of a
  5-column table, empty and error states with a next step.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 12:13:40 +02:00

Nick SzaunigandClaude Opus 5.5

5c666fe49a

fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes

- Per-account lockout: five failed attempts (password, MFA code or a
  step-up confirmation) lock the account for 15 minutes, on top of the
  per-IP throttle - guesses spread over many addresses no longer help.
- A TOTP code is accepted once: the time step is stored and that step or
  any earlier one is refused (also between two concurrent requests).
- Login runs bcrypt on every path and answers unknown email, wrong
  password, deactivated and locked accounts with the same message; failed
  logins for unknown emails no longer write attacker-chosen text into the
  audit log.
- Turning MFA off needs password and a current code; turning it on needs
  the password. Both end all other sessions.
- New audit action ACCOUNT_LOCKED.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 02:27:47 +02:00

Nick Szaunig

0a52b29c57

fix: Bug fixed für alle Seiten und das Profil und label

Backend Image / build-and-push (push) Successful in 2m44s

Details

Frontend Image / build-and-push (push) Successful in 2m47s

Details

2026-08-27 15:15:55 +02:00