kolaente 3eb76fc774 fix(auth): reject bot credentials while the bot's owner can't authenticate

2026-10-20 15:13:02 +02:00

..

bot_identity_test.go

refactor(bots): take a verified user, not any web.Auth

2026-08-29 23:29:46 +02:00

bot_identity.go

refactor(bots): take a verified user, not any web.Auth

2026-08-29 23:29:46 +02:00

caldav_token_test.go

test(user): enforce CalDAV token deletion ownership

2026-09-30 23:26:55 +02:00

caldav_token.go

fix(caldav-tokens): honour page in the v2 token list

2026-10-01 17:29:11 +02:00

db.go

…

delete.go

…

error_test.go

…

error.go

fix(user): throttle password re-checks per user on sensitive account actions

2026-10-20 15:13:02 +02:00

events.go

fix(user): revoke sessions when too many TOTP attempts lock the account

2026-10-02 19:08:02 +02:00

is_admin_test.go

…

main_test.go

…

notifications_test.go

fix(user): put account tokens in the email link fragment

2026-10-20 15:13:02 +02:00

notifications.go

fix(user): put account tokens in the email link fragment

2026-10-20 15:13:02 +02:00

reauth_test.go

fix(user): throttle password re-checks per user on sensitive account actions

2026-10-20 15:13:02 +02:00

reauth.go

fix(user): throttle password re-checks per user on sensitive account actions

2026-10-20 15:13:02 +02:00

session_auth_cache_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

session_auth_cache.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

test.go

…

token_test.go

test(user): reject tokens issued for another purpose

2026-09-30 23:26:55 +02:00

token.go

…

totp_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

totp.go

refactor(user): use keyvalue.GetInt64 for failed login and TOTP counters

2026-10-20 15:13:02 +02:00

update_email_test.go

fix(user): put account tokens in the email link fragment

2026-10-20 15:13:02 +02:00

update_email.go

fix(user): enforce the email confirmation cooldown on redis

2026-10-20 15:13:02 +02:00

user_claims_test.go

…

user_create_test.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

user_create.go

fix(user): set default reminder settings on bot users and guard reminder parser (#4007)

2026-10-15 23:26:55 +02:00

user_email_confirm_test.go

…

user_email_confirm.go

…

user_password_reset.go

…

user_test.go

fix(auth): reject bot credentials while the bot's owner can't authenticate

2026-10-20 15:13:02 +02:00

user.go

fix(auth): reject bot credentials while the bot's owner can't authenticate

2026-10-20 15:13:02 +02:00

users_project.go

…

validator_test.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

validator.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00