Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) requires admin-issued one-time keys, in-transaction revalidation of restricted sessions, a login race guard, and audited password writes.
Evidence: go test ./... green locally (SQLite, SELF); store tests use openTestStore so the CI test-pg job covers real PostgreSQL; 100-way concurrent redeem single-winner and auth-version race covered.
Impact: Migration v28 (users/sessions.auth_version + account_events). Admin endpoints POST/GET /api/admin/users/{owner}/login-keys and DELETE .../login-keys/{id}. Login binds session creation to verified auth version; must-change logins create restricted sessions; redeem gains per-IP backoff; Secure cookies under TLS; active change-password and admin/CLI resets become single audited transactions.
Task card: Dev .task/feature-svc-login-recovery-flow.md (main record). Refs: proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2.
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) requires admin-issued one-time keys, in-transaction revalidation of restricted sessions, a login race guard, and audited password writes.
Evidence: go test ./... green locally (SQLite, SELF); store tests use openTestStore so the CI test-pg job covers real PostgreSQL; 100-way concurrent redeem single-winner and auth-version race covered.
Impact: Migration v28 (users/sessions.auth_version + account_events). Admin endpoints POST/GET /api/admin/users/{owner}/login-keys and DELETE .../login-keys/{id}. Login binds session creation to verified auth version; must-change logins create restricted sessions; redeem gains per-IP backoff; Secure cookies under TLS; active change-password and admin/CLI resets become single audited transactions.
Task card: Dev .task/feature-svc-login-recovery-flow.md (main record). Refs: proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2.
Why: The login recovery contract (2026-10-13) requires admin-issued
one-time keys, in-transaction revalidation of restricted sessions, a
login race guard, and audited password writes; the previous
implementation validated sessions outside the change-password
transaction and let stale password verifications create sessions.
Evidence: go test ./... green (SQLite); store tests switch to
openTestStore so the CI test-pg job covers real PostgreSQL, including
100-way concurrent redeem single-winner and auth-version race cases
(SELF, local run).
Impact: New migration v28 (users/sessions.auth_version,
account_events). New admin endpoints POST/GET
/api/admin/users/{owner}/login-keys and DELETE
.../login-keys/{id}. Login binds session creation to the verified
auth version and creates restricted sessions for must-change accounts;
redeem gains per-IP backoff; cookies gain Secure under TLS; active
change-password and admin/CLI resets become single transactions that
bump auth_version, revoke keys and sessions, and write audit events.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2; Dev task feature/svc-login-recovery-flow
weichen
merged commit f103540d60 into main2026-10-13 04:03:06 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md) requires admin-issued one-time keys, in-transaction revalidation of restricted sessions, a login race guard, and audited password writes.
Evidence: go test ./... green locally (SQLite, SELF); store tests use openTestStore so the CI test-pg job covers real PostgreSQL; 100-way concurrent redeem single-winner and auth-version race covered.
Impact: Migration v28 (users/sessions.auth_version + account_events). Admin endpoints POST/GET /api/admin/users/{owner}/login-keys and DELETE .../login-keys/{id}. Login binds session creation to verified auth version; must-change logins create restricted sessions; redeem gains per-IP backoff; Secure cookies under TLS; active change-password and admin/CLI resets become single audited transactions.
Task card: Dev .task/feature-svc-login-recovery-flow.md (main record). Refs: proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2.
Why: The login recovery contract (2026-10-13) requires admin-issued one-time keys, in-transaction revalidation of restricted sessions, a login race guard, and audited password writes; the previous implementation validated sessions outside the change-password transaction and let stale password verifications create sessions. Evidence: go test ./... green (SQLite); store tests switch to openTestStore so the CI test-pg job covers real PostgreSQL, including 100-way concurrent redeem single-winner and auth-version race cases (SELF, local run). Impact: New migration v28 (users/sessions.auth_version, account_events). New admin endpoints POST/GET /api/admin/users/{owner}/login-keys and DELETE .../login-keys/{id}. Login binds session creation to the verified auth version and creates restricted sessions for must-change accounts; redeem gains per-IP backoff; cookies gain Secure under TLS; active change-password and admin/CLI resets become single transactions that bump auth_version, revoke keys and sessions, and write audit events. Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2; Dev task feature/svc-login-recovery-flow