boban dd891cd11e Reveal backup codes only when freshly generated ... Backup (recovery) codes must be viewable ONLY at the moment they are generated — at first-factor enrollment or on regenerate — and NEVER re-viewable afterward from "Backup-Codes verwalten". - Modals\RecoveryCodes: add server-gated $revealed. mount() pulls a one-time session flag (2fa.codes_fresh); regenerate() sets it. render() emits codes ONLY when revealed, so a client cannot tamper a flag to re-view stored codes. - View: revealed state shows codes grid + download + warning + close; hidden state shows a security notice + Neu erzeugen + close (no codes, no download). - TwoFactorSetup::confirm() and WebauthnKeys::register() put 2fa.codes_fresh on first-factor code generation (put, survives the redirect + later openModal request). - Add recovery_hidden_notice (DE/EN parity). - Tests: manage view hides codes; fresh flag reveals once; regenerate reveals the new set; first-factor paths set the flag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-15 06:14:59 +02:00
..
Email.php	feat(mail): SMTP configuration in Settings (encrypted password, runtime override, test-send)	2026-06-14 23:42:19 +02:00
Index.php	refactor(settings): split into per-tab nested components (Profile, Security) + tab hosts for Users/Sessions/Email	2026-06-14 23:23:25 +02:00
Profile.php	refactor(settings): split into per-tab nested components (Profile, Security) + tab hosts for Users/Sessions/Email	2026-06-14 23:23:25 +02:00
Security.php	refactor(settings): split into per-tab nested components (Profile, Security) + tab hosts for Users/Sessions/Email	2026-06-14 23:23:25 +02:00
Sessions.php	feat(sessions): database sessions + list/revoke (other devices, per-user, global) with remember-token rotation	2026-06-14 23:34:00 +02:00
Users.php	fix(accounts): make last-user removal atomic (lock + recount) to prevent a zero-user lock-out race	2026-06-14 23:49:21 +02:00
WebauthnKeys.php	Reveal backup codes only when freshly generated	2026-06-15 06:14:59 +02:00