Hartmut fe79810a85 security: MFA backup codes — issue on enable, redeem at login, regenerate on demand (#43) ...

Adds a one-time-use backup code set so users with a lost authenticator are not
locked out. Codes are Crockford base32 (XXXXX-XXXXX), hashed with argon2id, and
redeemed under a WHERE-guarded delete so a concurrent replay race fails closed.

- New MfaBackupCode model + migration
- Issue 10 codes inside the enable transaction; show plaintext exactly once
- Sign-in page accepts TOTP or backup code, reporting remaining count
- regenerateBackupCodes tRPC mutation wipes + reissues atomically
- Unit coverage for generator, normalizer, verify, redeem, and race path

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 18:47:18 +02:00

..

prisma

security: MFA backup codes — issue on enable, redeem at login, regenerate on demand (#43)

2026-04-17 18:47:18 +02:00

src

test(db): clear env before each loadWorkspaceEnv test, not just after

2026-04-12 21:08:37 +02:00

package.json

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

tsconfig.json

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00