142b531d45
The seeded-password rotation was forced before the panel was reachable. It is now a nudge, not a wall: the prompt shows once per session and can be skipped, and a standing warning banner keeps reminding while the default password is still in use. - EnsureSecurityOnboarded redirects to the password page only when must_change_password AND the session has not set onboarding.password_skipped (set by PasswordChange::skip, which lands on the dashboard WITHOUT rotating — so the flag/banner persist). - app layout shows a default-password warning banner while must_change_password is true. - the metrics broadcast channel no longer gates on securityOnboarded() — a deliberately un-rotated (but authenticated) operator would otherwise lose realtime metrics; /broadcasting/auth still runs in the web group (guest = 403), so it stays auth-gated. - 2FA was already optional (never enforced) — only the login copy was wrong: "2FA required/enforced" → "recommended/optional" (de + en). Browser-verified (R12): login → skippable prompt → dashboard banner → free navigation (no re-redirect); login copy correct; zero console errors. Full suite 465 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| ForgotPassword.php | ||
| Login.php | ||
| PasswordChange.php | ||
| ResetPassword.php | ||
| TwoFactorBackup.php | ||
| TwoFactorChallenge.php | ||
| TwoFactorSetup.php | ||