clusev

Commit Graph

Author	SHA1	Message	Date
boban	d44f6930bb	feat(auth): SMTP-aware forgot-password — 15-min e-mail link + 2FA fallback; recovery note out of the public screen Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 18:53:37 +02:00
boban	77fee98452	feat(auth): show/hide password toggle; email inputs to type=text (class validates) Login + password-change + reset + forgot get an eye toggle. Email fields switch to type=text so validation lives only in the Livewire class (consistent custom messages). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 23:10:37 +02:00
boban	61df4497d7	feat(2fa): forgot-password is key-only safe + states the no-2FA recovery path Guard the TOTP verifyKey call behind hasTotp() so a key-only user's null two_factor_secret never reaches Google2FA::verifyKey(); they reset via a backup code. Also adds the reset_no_2fa_note lang key (EN + DE) rendered on the forgot-password form explaining the no-2FA recovery options. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 21:26:59 +02:00
boban	cb8b906aa8	feat(auth): forgot-password reset via 2FA or backup code "Passwort vergessen?" on login -> a reset view that proves identity with a TOTP or one-time backup code (no email needed), then sets a new password under the min(12) mixedCase numbers policy. Rate-limited, generic messages (no account enumeration), audited. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 16:55:01 +02:00

4 Commits (a709ef772c0c4c17b5babc116e8aa8a9ecc1cc24)