kolaente cda6d88330 feat(user): lock account after 10 failed password attempts ...

Mirrors the TOTP lockout: issue a password reset token, send a mail, set
the account to locked and revoke its sessions. Counts every wrong password
checked by CheckUserCredentials, including the password and email change
re-auth prompts, so a stolen session can no longer guess the password
indefinitely.

The 3-attempt warning mail no longer resets the counter, otherwise it
could never reach the lockout threshold.

2026-11-03 10:41:13 +01:00

..

_test.go.tpl

…

account_status_auth_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

admin_share_bypass_test.go

…

admin_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

api_token_method_matching_test.go

fix: hide license-gated routes from api token scope list (#3216)

2026-07-18 10:00:37 +02:00

api_token_version_parity_test.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_tokens_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

archived_test.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

background_test.go

…

caldav_test.go

fix(caldav): bound PROPPATCH response size

2026-10-19 16:05:12 +02:00

done_signal_ctx_test.go

fix(background): decode backgrounds before opening the write session

2026-10-20 23:05:30 +02:00

error_responses_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

expand_scope_routes_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

form_content_type_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

healthcheck_test.go

feat: add basic auth config for health endpoints

2026-11-03 09:12:02 +01:00

huma_admin_actions_test.go

feat(admin): port GET /admin/users to /api/v2 (#3676)

2026-08-31 09:33:47 +02:00

huma_admin_test.go

test(admin): make admin project search tests ParadeDB independent

2026-10-01 03:18:23 +02:00

huma_api_token_patch_test.go

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

huma_api_token_test.go

fix(models): return 404 for missing api tokens on delete (#3944) (#4119)

2026-10-15 21:01:39 +00:00

huma_archived_test.go

fix(projects): reject un-archiving a child while its parent is archived

2026-08-20 11:58:06 +02:00

huma_auth_login_test.go

feat(auth): sync provider avatars in the background after login

2026-10-20 23:05:30 +02:00

huma_auth_refresh_test.go

feat(auth): return error code 16005 when the refresh cookie is missing

2026-09-29 22:54:20 +02:00

huma_auth_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

huma_avatar_test.go

test(api/v2): port full v1 avatar coverage to TestAvatar

2026-06-03 19:58:27 +00:00

huma_avatar_upload_test.go

fix(avatar): remove a replaced avatar's blob only after commit

2026-10-20 23:05:30 +02:00

huma_background_download_test.go

test(api/v2): cover background download and unsplash proxy routes

2026-06-17 11:31:50 +00:00

huma_background_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_background_upload_test.go

fix(background): decode backgrounds before opening the write session

2026-10-20 23:05:30 +02:00

huma_bot_user_test.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

huma_bucket_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

huma_bulk_task_test.go

fix(tasks): reject bulk updates without fields

2026-10-16 15:49:28 +02:00

huma_caldav_token_test.go

fix(caldav-tokens): honour page in the v2 token list

2026-10-01 17:29:11 +02:00

huma_errors_test.go

fix(api/v2): stop leaking the healthcheck cause to unauthenticated callers

2026-07-28 19:26:15 +02:00

huma_helpers_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_info_test.go

feat(api): return all legal links from /info

2026-10-28 23:02:31 +01:00

huma_invite_links_test.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

huma_label_task_bulk_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_label_task_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_label_test.go

perf(labels): list a user's labels without joining label_tasks

2026-08-30 17:04:35 +02:00

huma_link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

huma_migration_csv_test.go

fix(migration): run file imports in the background

2026-09-15 16:59:37 +02:00

huma_migration_file_test.go

fix(migration): reject wekan boards with duplicate ids or too many items

2026-10-20 15:13:02 +02:00

huma_migration_oauth_test.go

fix(migration): bind oauth migration callbacks to the user who requested the auth url

2026-10-20 15:13:02 +02:00

huma_migration_planka_test.go

feat(migration): add planka migrator routes on v2

2026-08-20 08:45:42 +02:00

huma_non_crud_aliases_test.go

feat(api/v2): expose websocket endpoint under /api/v2

2026-06-17 20:35:28 +00:00

huma_notification_permissions_test.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

huma_notification_test.go

feat(notifications): add clearing stored notifications (#2735)

2026-08-29 21:22:43 +00:00

huma_pagination_test.go

fix(api): respect service.maxitemsperpage in v2 list endpoints

2026-09-21 18:23:31 +02:00

huma_project_duplicate_test.go

fix(projects): report null for a max_permission nobody computed

2026-08-28 23:49:27 +02:00

huma_project_team_test.go

fix(sharing): restrict team attachment visibility

2026-08-31 18:37:03 +02:00

huma_project_test.go

test(projects): assert search stays within the accessible set

2026-08-29 22:51:44 +02:00

huma_project_user_test.go

feat(api/v2): add project user shares CRUD on /api/v2

2026-06-07 10:37:59 +00:00

huma_project_view_test.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

huma_rate_limit_test.go

test(ratelimit): assert exact statuses instead of absence of 500

2026-07-27 22:31:06 +00:00

huma_reaction_test.go

feat(api/v2): add reactions on /api/v2

2026-06-09 21:34:22 +00:00

huma_richtext_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_saved_filter_test.go

feat(api/v2): add saved filter CRUD on /api/v2

2026-06-07 10:40:20 +00:00

huma_session_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_subscription_test.go

test(subscriptions): cover the opt-out paths and the rows they leave behind

2026-08-29 23:42:41 +02:00

huma_task_assignee_bulk_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_task_assignee_test.go

feat(api/v2): add task assignees (create/list/delete) on /api/v2

2026-06-06 19:06:12 +00:00

huma_task_attachment_test.go

fix(attachments): dispatch events after uploading attachments

2026-10-20 13:34:51 +02:00

huma_task_bucket_test.go

fix(kanban): only move tasks into buckets of their own project's view

2026-10-20 15:13:02 +02:00

huma_task_bulk_create_test.go

feat(api): return per-view positions from task create

2026-10-13 11:54:08 +02:00

huma_task_collection_test.go

feat(api/v2): add task collection (task lists) on /api/v2

2026-06-11 18:31:03 +00:00

huma_task_comment_test.go

test(api/v2): assert task comment max_permission and per-caller ETag

2026-06-05 07:43:38 +00:00

huma_task_duplicate_test.go

feat(api): return per-view positions from task create

2026-10-13 11:54:08 +02:00

huma_task_patch_subscription_test.go

fix(subscriptions): declare subscription entity as string enum in v2 OpenAPI schema

2026-07-29 22:28:31 +02:00

huma_task_position_test.go

feat(api/v2): add task position updates on /api/v2

2026-06-10 11:55:51 +02:00

huma_task_relation_test.go

feat(api/v2): add task relations on /api/v2

2026-06-09 20:42:00 +00:00

huma_task_test.go

feat(api): return per-view positions from task create

2026-10-13 11:54:08 +02:00

huma_task_unread_status_test.go

feat(api/v2): add task read-status marking on /api/v2

2026-06-09 19:50:58 +00:00

huma_team_member_test.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

huma_team_test.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

huma_testing_test.go

test(api/v2): use cross-engine datetime literals in testing webtest

2026-06-17 12:13:50 +00:00

huma_time_entry_test.go

feat(api): return the user object instead of user_id on time entries

2026-10-22 11:14:14 +02:00

huma_user_deletion_test.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

huma_user_export_test.go

feat(api): generate canonical v2 frontend client

2026-08-31 20:10:49 +02:00

huma_user_search_link_share_test.go

fix(users): reject link shares from user listings

2026-08-31 18:37:03 +02:00

huma_user_search_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_user_settings_test.go

feat(api): read the current user's general settings on v2

2026-10-02 09:47:32 +02:00

huma_user_totp_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

huma_user_webhook_test.go

feat(api/v2): add user webhooks on /api/v2

2026-06-10 19:12:41 +00:00

huma_webhook_event_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

integrations.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

json_nul_test.go

test(api): cover NUL rejection in comment bodies on v1 and v2

2026-11-02 11:58:07 +01:00

kanban_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

link_sharing_auth_test.go

…

link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

login_test.go

fix(auth): return ErrAccountLocked for locked accounts on login

2026-06-17 19:43:41 +00:00

main_test.go

…

mcp_catalog_test.go

feat(mcp): add filter_syntax tool and resource

2026-10-19 13:25:00 +02:00

mcp_info_test.go

feat(mcp): expose connection settings and token presets

2026-09-15 11:41:34 +02:00

mcp_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_tools_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_transport_test.go

feat(routes): serve the MCP endpoint at /api/v2/mcp

2026-09-15 11:41:34 +02:00

oauth2_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

project_access_cleanup_test.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_pseudo_parent_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_test.go

fix(api): treat page=0 as the first page on v1 list endpoints

2026-10-20 15:13:02 +02:00

reauth_throttle_test.go

feat(user): lock account after 10 failed password attempts

2026-11-03 10:41:13 +01:00

register_test.go

fix(user): keep email confirmation status after registration

2026-08-18 11:30:03 +02:00

session_check_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

session_revocation_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

sessions_test.go

feat(auth): return error code 16005 when the refresh cookie is missing

2026-09-29 22:54:20 +02:00

task_attachment_idor_test.go

…

task_attachment_upload_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_by_index_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_collection_test.go

perf(tasks): index (project_id, done, due_date) instead of (done, due_date)

2026-09-04 10:32:56 +02:00

task_comment_test.go

…

task_test.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

token_refresh_rate_limit_test.go

fix(routes): send and expose Retry-After on rate-limited responses

2026-10-01 17:34:38 +02:00

token_test.go

…

unauth_rate_limit_test.go

test(ratelimit): align basic auth rate limit webtests to a fresh window

2026-09-18 15:59:07 +02:00

user_change_password_test.go

…

user_confirm_email_test.go

…

user_default_project_test.go

fix(projects): count a project as default only for its owner

2026-10-02 19:08:02 +02:00

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

feat(api/v2): expose pending email, add cancel and resend endpoints

2026-08-18 22:03:38 +02:00

user_totp_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

ws_rate_limit_test.go

fix(security): rate limit the websocket upgrade endpoint (#3348)

2026-07-28 17:12:18 +02:00