weichenandCursor 1ba7225e83 Add one-time login keys, restricted sessions, and OpenExisting ...

Why: passwordless activation/recovery must redeem only into a
set-password session; account ops must not create empty stores.
Evidence: SELF go test store/server login-key and OpenExisting cases.
Impact: auth middleware gates; CLI user create defaults to activate key.
Refs: docs/svc-deploy/u4-one-time-login-key.md

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-12 03:44:16 +00:00

..

blobstore_test.go

Validate object ids in the local blobstore to block path traversal

2026-09-30 16:32:17 +00:00

blobstore.go

Add one-time login keys, restricted sessions, and OpenExisting

2026-10-12 03:44:16 +00:00

object_store_test.go

Add same-transaction outbox, S3-compatible blobstore, and real-process acceptance (U5 remainder)

2026-10-11 15:57:12 +00:00

s3.go

Add same-transaction outbox, S3-compatible blobstore, and real-process acceptance (U5 remainder)

2026-10-11 15:57:12 +00:00