Nick SzaunigandClaude Opus 5.5 45efb08369 fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica ...

- Every JWT carries a jti. The SSO completion token and the MFA challenge
  (once a code was accepted) are recorded as used in ConsumedToken; a
  replayed request or copied cookie cannot open a second session. Used
  ids are cleaned up after they expire.
- The token-validity check (active user, active role, password change)
  reads fresh on every request and refreshes the permission cache, so a
  deactivation or role change made on another replica applies to the very
  next request instead of up to 30 s later.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 07:24:28 +02:00

..

decorators

fix: PermissionsGuard schliesst jetzt statt bei fehlendem Decorator zu oeffnen

2026-09-02 14:44:28 +02:00

dto

feat(auth): 12-character minimum, 72-byte maximum and breach check for new passwords

2026-10-01 02:47:09 +02:00

guards

feat(api-keys): restrict keys to source IP addresses

2026-10-01 02:41:46 +02:00

mfa

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

permissions

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

reauth

fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes

2026-10-01 02:27:47 +02:00

sso

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

strategies

fix(auth): accept only access tokens as bearer credentials (MFA bypass)

2026-10-01 01:14:02 +02:00

types

feat: MFA (TOTP) und Self-Service-Profilseite

2026-08-27 00:25:34 +02:00

util

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

auth.controller.ts

fix(api): tighter public lot endpoint, SSO callback from config, mapped 4xx errors

2026-10-01 07:20:33 +02:00

auth.module.ts

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

auth.service.spec.ts

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

auth.service.ts

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00

one-time-token.service.ts

fix(auth): one-time SSO and MFA tokens, permission changes effective on every replica

2026-10-01 07:24:28 +02:00