clusev/app
boban 4ea4050c80 fix(auth): R15 review — restore one-time-code autofill, memoise pendingUser in verify
- backup field: autocomplete=off -> one-time-code (backup codes ARE one-time codes;
  matches the main challenge field, the rest of the app, and the spec; restores
  password-manager OTP autofill that the earlier polish broke)
- both verify() use the trait's memoised $this->pendingUser() instead of a fresh
  User::find(), saving a redundant query on the failed-attempt re-render (Pint dropped
  the now-unused User import in TwoFactorBackup)
- spec: align trait backing-state visibility note to the implemented 'private'

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-20 16:19:40 +02:00
..
Console/Commands feat(install): fixed default admin e-mail admin@clusev.local 2026-06-19 16:54:03 +02:00
Events fix(blade): garbled header on every signed-in page + private metrics channel (v0.4.1) 2026-06-14 08:34:07 +02:00
Http fix(tls): force https URL generation for the active domain (external-proxy mode) 2026-06-19 20:35:06 +02:00
Jobs feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb 2026-06-12 00:31:50 +02:00
Livewire fix(auth): R15 review — restore one-time-code autofill, memoise pendingUser in verify 2026-06-20 16:19:40 +02:00
Models fix(security): harden brute-force, rate-limiting and auth-DoS (audit follow-up) 2026-06-17 17:59:45 +02:00
Notifications fix(security): constant-time password-reset (flatten account-enumeration timing) 2026-06-15 19:16:30 +02:00
Providers fix(assets): drop Vite preload hints (silence 'preloaded but not used') 2026-06-19 21:50:54 +02:00
Services fix(webauthn): add security-key hint so passkey managers defer 2026-06-19 21:30:52 +02:00
Support fix(security): harden brute-force, rate-limiting and auth-DoS (audit follow-up) 2026-06-17 17:59:45 +02:00