Phil Skentelbery
9135edfe84
fix(auth): require email authentication every login
CRITICAL SECURITY FIX:
- Email code required EVERY login (authentication, not verification)
- DNS TXT check cached separately (domain verification)
- New auth_sessions table for per-login state
- Codes hashed with SHA-256, constant-time comparison
- Max 3 attempts, 10-minute session expiry
- OAuth params stored server-side (security improvement)
New files:
- services/auth_session.py
- migrations 004, 005
- ADR-010: domain verification vs user authentication
312 tests passing, 86.21% coverage
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-22 15:16:26 -07:00
..
2025-11-20 13:05:09 -07:00
2025-11-22 15:16:26 -07:00
2025-11-22 15:16:26 -07:00
2025-11-22 11:54:06 -07:00
2025-11-22 15:16:26 -07:00
2025-11-20 13:05:09 -07:00
2025-11-20 18:28:50 -07:00
2025-11-20 13:05:09 -07:00
2025-11-20 14:24:06 -07:00