kolaente d58dd7a7c6 fix(auth): enforce TOTP on OIDC callback for users with 2FA enabled ... The OIDC callback handler previously issued a JWT without ever checking TOTP state. For installations with EmailFallback (or UsernameFallback) enabled, this allowed an attacker who could authenticate at the IdP with a matching email to log in as a local user with TOTP enrolled, bypassing the second factor entirely. HandleCallback now runs enforceTOTPIfRequired after resolving the user and before any team sync writes, returning 412/1017 when the passcode is missing or invalid. Clients resubmit the OIDC flow with the totp_passcode field populated. Fixes GHSA-8jvc-mcx6-r4cg		2026-04-09 17:25:47 +00:00
..
cron.go	fix: add missing Commit() to write callers	2026-02-25 11:03:02 +01:00
main_test.go	feat: move to slog for logging	2025-07-21 18:15:39 +02:00
openid.go	fix(auth): enforce TOTP on OIDC callback for users with 2FA enabled	2026-04-09 17:25:47 +00:00
openid_test.go	test(auth): add failing unit tests for OIDC TOTP enforcement	2026-04-09 17:25:47 +00:00
providers.go	feat(auth): enforce OpenID Connect issuer uniqueness across providers	2026-03-30 22:41:50 +00:00
providers_test.go	feat(auth): enforce OpenID Connect issuer uniqueness across providers	2026-03-30 22:41:50 +00:00