boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
clusev/docs/superpowers/specs
History
boban 6290cec6ab fix(2fa): bound the backup-code reveal flag with a 10-minute TTL 
The 2fa.codes_fresh reveal flag is now a timestamp (set at enrollment) and
RecoveryCodes::mount() only reveals within [now-600s, now], symmetric to the
download-grant window. A reveal flag whose modal never opened can no longer
re-reveal the codes later in the session. FirstFactorCodesTest asserts the
flag is an int.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 		2026-06-15 18:42:58 +02:00
..
2026-06-14-account-recovery-design.md docs(spec): account recovery design (forgot-password, 2FA backup codes, CLI) 2026-06-14 16:41:45 +02:00
2026-06-14-accounts-sessions-restart-design.md docs(spec): 0.9.0 accounts, sessions, auto-restart, SMTP, audit-retention 2026-06-14 23:17:41 +02:00
2026-06-14-external-proxy-tls-design.md docs(spec): external reverse-proxy TLS mode (Zoraxy in front) 2026-06-14 22:26:20 +02:00
2026-06-14-optional-pluggable-2fa-design.md docs(spec): optional, pluggable 2FA (TOTP and/or YubiKey) design 2026-06-14 19:47:55 +02:00
2026-06-14-server-details-hardening-polish-design.md docs(spec): server-details UX + hardening polish design 2026-06-14 10:09:17 +02:00
2026-06-14-ssh-key-auto-provision-design.md docs(spec): auto-provision SSH key & safely disable password login 2026-06-14 21:54:02 +02:00
2026-06-14-webauthn-yubikey-design.md docs(spec): WebAuthn/YubiKey 2nd-factor design (Phase 2) 2026-06-14 18:12:32 +02:00
2026-06-15-confirm-action-token-hardening-design.md feat(security): signed confirm-action tokens + airtight backup-code reveal 2026-06-15 18:35:33 +02:00
2026-06-15-recovery-codes-airtight-reveal-design.md fix(2fa): bound the backup-code reveal flag with a 10-minute TTL 2026-06-15 18:42:58 +02:00