6290cec6ab
The 2fa.codes_fresh reveal flag is now a timestamp (set at enrollment) and RecoveryCodes::mount() only reveals within [now-600s, now], symmetric to the download-grant window. A reveal flag whose modal never opened can no longer re-reveal the codes later in the session. FirstFactorCodesTest asserts the flag is an int. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 2026-06-14-account-recovery.md | ||
| 2026-06-14-optional-pluggable-2fa.md | ||
| 2026-06-14-server-details-hardening-polish.md | ||
| 2026-06-14-webauthn-yubikey.md | ||
| 2026-06-15-recovery-codes-airtight-reveal.md | ||