Repository navigation

Feature | Add MultiFactor Authentication. Initial migrations and entities - #125

Open

matiasperrone-exo wants to merge 29 commits into

mainfrom

feat/mfa-phase1---migrations--and--interfaces

Open

Feature | Add MultiFactor Authentication. Initial migrations and entities#125
matiasperrone-exo wants to merge 29 commits into
mainfrom
feat/mfa-phase1---migrations--and--interfaces

Commits on Nov 3, 2026
- feat: Add MultiFactor Authentication
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  1585d0b
- chore: Add PR's requested changes and additional AI comments
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  385342a
- chore: Add PR's requested changes
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  93c3310
- chore: Add guards on setEventType and setMethod methods on TwoFactorAuditLog model
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  706e775
- chore: Guard the unique-index migration against existing duplicates.
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  fb205a8
- chore: Add UniqueConstraint annotation to mirror the database migration
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  11fe73b
- chore: Refactor UserRecoveryCode and TwoFactorAuditLog models; update migration for user_recovery_codes
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  ac48cbc
- chore: remove BaseEntity oveloaded props and methods. fix skipped test
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  11904d2
- chore: unify migrations
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  e97bcd9
- Feature | Implement Two-Factor Authentication (2FA) support for users (#126)
  
  committed
  1428636
- MFA hardening: OAuth2 memento guard on recovery, DTO refactors, full OIDC circuit tests (#152)
  smarcet
  committed
  56e8f09
- fix(session): restore Secure and SameSite=None defaults for the session cookie
  smarcet
  committed
  660d7c4
- fix(auth): split the login SPA reset from cancelLogin to keep OAuth2 requests alive
  smarcet
  committed
  66b252e
- fix(2fa): reserve verify/recovery attempts atomically before the controller runs
  smarcet
  committed
  fec8fd1
- chore(auth): drop unused imports from MFACookieManager
  smarcet
  committed
  1590816
- fix(2fa): require CSRF on the profile 2FA enable and recovery-code regenerate routes
  smarcet
  committed
  d759216
- fix(2fa): make the pending MFA session TTL configurable, default 600s
  smarcet
  committed
  ca9fe61
- fix(tests): drop stale OAuth2ProtocolTestCase.php entry from phpunit.xml
  smarcet
  committed
  e058c9f
- fix(e2e): assert the intended post-error password step, not the old reset-to-email behavior
  smarcet
  committed
  fb1b233
- fix: MFA-enforced accounts leak enumeration via passwordless login guard order (#154)
  smarcet
  committed
  3e9c5d0
- Recovery code login flow UI (#151)
  
  authored and
  smarcet
  committed
  1405ba9
- chore: fix ssl redirect
  smarcet
  committed
  c9f5345
- fix(2fa): apply the local MFA policy to social login
  smarcet
  committed
  4bd1a20
- fix(session): finish the SESSION_COOKIE_SECURE rename after rebasing on main
  smarcet
  committed
  a622991
- fix(2fa): render the 2FA screen when social login was started with provider=
  smarcet
  committed
  3bdab76
Commits on Nov 4, 2026
- fix(app): do not force https in the testing environment
  smarcet
  committed
  9d969e5
- fix(2fa): reject a recovery code whose row was deleted before the redemption lock
  smarcet
  committed
  8313230
Commits on Nov 6, 2026
- fix(2fa): issue MFA codes with two_factor.otp_lifetime, not the client's passwordless lifetime (#182)
  smarcet
  authored
  8d5c066
Commits on Nov 13, 2026
- feat(2fa): trusted devices management UI and revoke endpoints (#160)
  
  romanetar
  and
  claude
  authored
  295c98b

Commits

Commits on Nov 3, 2026

Commits on Nov 4, 2026

Commits on Nov 6, 2026

Commits on Nov 13, 2026