kolaente cda6d88330 feat(user): lock account after 10 failed password attempts ...

Mirrors the TOTP lockout: issue a password reset token, send a mail, set
the account to locked and revoke its sessions. Counts every wrong password
checked by CheckUserCredentials, including the password and email change
re-auth prompts, so a stolen session can no longer guess the password
indefinitely.

The 3-attempt warning mail no longer resets the counter, otherwise it
could never reach the lockout threshold.

2026-11-03 10:41:13 +01:00

..

_test.go.tpl

…

account_status_auth_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

admin_share_bypass_test.go

…

admin_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

api_token_method_matching_test.go

…

api_token_version_parity_test.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_tokens_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

archived_test.go

…

background_test.go

…

caldav_test.go

…

done_signal_ctx_test.go

fix(background): decode backgrounds before opening the write session

2026-10-20 23:05:30 +02:00

error_responses_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

expand_scope_routes_test.go

…

form_content_type_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

healthcheck_test.go

feat: add basic auth config for health endpoints

2026-11-03 09:12:02 +01:00

huma_admin_actions_test.go

…

huma_admin_test.go

…

huma_api_token_patch_test.go

…

huma_api_token_test.go

…

huma_archived_test.go

…

huma_auth_login_test.go

feat(auth): sync provider avatars in the background after login

2026-10-20 23:05:30 +02:00

huma_auth_refresh_test.go

…

huma_auth_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

huma_avatar_test.go

…

huma_avatar_upload_test.go

fix(avatar): remove a replaced avatar's blob only after commit

2026-10-20 23:05:30 +02:00

huma_background_download_test.go

…

huma_background_test.go

…

huma_background_upload_test.go

fix(background): decode backgrounds before opening the write session

2026-10-20 23:05:30 +02:00

huma_bot_user_test.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

huma_bucket_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

huma_bulk_task_test.go

…

huma_caldav_token_test.go

…

huma_errors_test.go

…

huma_helpers_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_info_test.go

feat(api): return all legal links from /info

2026-10-28 23:02:31 +01:00

huma_invite_links_test.go

…

huma_label_task_bulk_test.go

…

huma_label_task_test.go

…

huma_label_test.go

…

huma_link_sharing_test.go

…

huma_migration_csv_test.go

…

huma_migration_file_test.go

fix(migration): reject wekan boards with duplicate ids or too many items

2026-10-20 15:13:02 +02:00

huma_migration_oauth_test.go

fix(migration): bind oauth migration callbacks to the user who requested the auth url

2026-10-20 15:13:02 +02:00

huma_migration_planka_test.go

…

huma_non_crud_aliases_test.go

…

huma_notification_permissions_test.go

…

huma_notification_test.go

…

huma_pagination_test.go

…

huma_project_duplicate_test.go

…

huma_project_team_test.go

…

huma_project_test.go

…

huma_project_user_test.go

…

huma_project_view_test.go

…

huma_rate_limit_test.go

…

huma_reaction_test.go

…

huma_richtext_test.go

…

huma_saved_filter_test.go

…

huma_session_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_subscription_test.go

…

huma_task_assignee_bulk_test.go

…

huma_task_assignee_test.go

…

huma_task_attachment_test.go

fix(attachments): dispatch events after uploading attachments

2026-10-20 13:34:51 +02:00

huma_task_bucket_test.go

fix(kanban): only move tasks into buckets of their own project's view

2026-10-20 15:13:02 +02:00

huma_task_bulk_create_test.go

…

huma_task_collection_test.go

…

huma_task_comment_test.go

…

huma_task_duplicate_test.go

…

huma_task_patch_subscription_test.go

…

huma_task_position_test.go

…

huma_task_relation_test.go

…

huma_task_test.go

…

huma_task_unread_status_test.go

…

huma_team_member_test.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

huma_team_test.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

huma_testing_test.go

…

huma_time_entry_test.go

feat(api): return the user object instead of user_id on time entries

2026-10-22 11:14:14 +02:00

huma_user_deletion_test.go

…

huma_user_export_test.go

…

huma_user_search_link_share_test.go

…

huma_user_search_test.go

…

huma_user_settings_test.go

…

huma_user_totp_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

huma_user_webhook_test.go

…

huma_webhook_event_test.go

…

huma_webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

integrations.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

json_nul_test.go

test(api): cover NUL rejection in comment bodies on v1 and v2

2026-11-02 11:58:07 +01:00

kanban_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

…

link_sharing_auth_test.go

…

link_sharing_test.go

…

login_test.go

…

main_test.go

…

mcp_catalog_test.go

…

mcp_info_test.go

…

mcp_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_tools_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_transport_test.go

…

oauth2_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

project_access_cleanup_test.go

…

project_pseudo_parent_test.go

…

project_test.go

fix(api): treat page=0 as the first page on v1 list endpoints

2026-10-20 15:13:02 +02:00

reauth_throttle_test.go

feat(user): lock account after 10 failed password attempts

2026-11-03 10:41:13 +01:00

register_test.go

…

session_check_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

session_revocation_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

sessions_test.go

…

task_attachment_idor_test.go

…

task_attachment_upload_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_by_index_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_collection_test.go

…

task_comment_test.go

…

task_test.go

…

token_refresh_rate_limit_test.go

…

token_test.go

…

unauth_rate_limit_test.go

…

user_change_password_test.go

…

user_confirm_email_test.go

…

user_default_project_test.go

…

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

…

user_totp_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

ws_rate_limit_test.go

…