mirror of
https://github.com/screentinker/screentinker.git
synced 2026-06-17 03:32:32 -06:00
1d3e9acea4
Two-token login: /login returns an mfa_pending token when TOTP is on; requireAuth/optionalAuth REJECT mfa_pending (tightening #1 - else password-alone is a session). /totp/verify exchanges it + a TOTP or recovery code for a full session (per-user lockout; recovery checked independently of the decryptable secret). Enrollment: setup -> enable (confirm-then-enable) -> recovery codes shown once; disable/regenerate require re-auth; regenerate replaces atomically; status surfaces codes-remaining (tightening #3). API tokens + SSO bypass TOTP by construction. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| scripts | ||
| services | ||
| test | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||
| version.js | ||