SnapOtter

2,084 Commits 10 Branches 89 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
SnapOtterandGitHub	190d4c2a00	fix(auth): close the MFA policy lockout and add self-service enrollment (#531 ) Fixes #529 (opened investigating #515). Setting MFA policy to "required"/"admins only" saved regardless of whether the mfa enterprise feature was licensed, and there was no enrollment UI at all, so any instance that flipped the toggle locked every unenrolled user out with no way back in. The login page and Settings save also both collapsed the resulting error into a generic message, hiding the real reason. - Reject saving mfaPolicy to admins_only/required server-side unless mfa is licensed - Surface the specific server error on login and on a failed settings save instead of a generic fallback - Add a self-service two-factor authentication enrollment flow (QR code, manual entry, recovery codes, verify, disable) so a licensed admin can actually satisfy the policy before it's enforced - Fix a pending-enrollment dead end, silent error swallowing in verify/disable, and a silent clipboard-copy failure on the recovery codes screen - Add the integration test that actually proves the fix: a real login attempt returns 403 MFA_ENROLLMENT_REQUIRED	2026-07-16 18:07:27 +08:00
SnapOtter	1727a7a73e	test: reorganize flat test files into purpose-based subdirectories (phase 6) Group 245 flat integration tests and 25 loose unit tests into discoverable subdirectories per spec section 6: integration/tools/{image,video,audio,document,data}/ (156 files) integration/platform/ (64 files) integration/generated/ (14 files) integration/security/ (10 files) unit/security/ (8 files, new subdir) unit/api/ (7 files moved in) unit/web/ (3 files moved in) unit/shared/ (6 files moved in) unit/image-engine/ (1 file moved in) All moves via git mv (history preserved). Relative imports repaired for both depth levels (platform/generated/security = +1, tools/ = +2): static from-imports, dynamic import() calls, vi.mock() paths, import.meta.dirname joins, and __dirname joins. Vitest discovery unchanged (no test.include in config, recursive glob matches subdirs, shard-by-hash unaffected). test-server.ts and tool-route-drift.test.ts stay at integration root. fixtures/ untouched. Parity gate: 13189 passing test names before = 13189 after (0 dropped).	2026-06-20 05:07:46 +08:00

Author

SHA1

Message

Date

SnapOtterandGitHub

190d4c2a00

fix(auth): close the MFA policy lockout and add self-service enrollment (#531 )

Fixes #529 (opened investigating #515).

Setting MFA policy to "required"/"admins only" saved regardless of whether the mfa enterprise feature was licensed, and there was no enrollment UI at all, so any instance that flipped the toggle locked every unenrolled user out with no way back in. The login page and Settings save also both collapsed the resulting error into a generic message, hiding the real reason.

- Reject saving mfaPolicy to admins_only/required server-side unless mfa is licensed
- Surface the specific server error on login and on a failed settings save instead of a generic fallback
- Add a self-service two-factor authentication enrollment flow (QR code, manual entry, recovery codes, verify, disable) so a licensed admin can actually satisfy the policy before it's enforced
- Fix a pending-enrollment dead end, silent error swallowing in verify/disable, and a silent clipboard-copy failure on the recovery codes screen
- Add the integration test that actually proves the fix: a real login attempt returns 403 MFA_ENROLLMENT_REQUIRED

2026-07-16 18:07:27 +08:00

SnapOtter

1727a7a73e

test: reorganize flat test files into purpose-based subdirectories (phase 6)

Group 245 flat integration tests and 25 loose unit tests into
discoverable subdirectories per spec section 6:

  integration/tools/{image,video,audio,document,data}/  (156 files)
  integration/platform/                                  (64 files)
  integration/generated/                                 (14 files)
  integration/security/                                  (10 files)

  unit/security/     (8 files, new subdir)
  unit/api/          (7 files moved in)
  unit/web/          (3 files moved in)
  unit/shared/       (6 files moved in)
  unit/image-engine/ (1 file moved in)

All moves via git mv (history preserved). Relative imports repaired
for both depth levels (platform/generated/security = +1, tools/ = +2):
static from-imports, dynamic import() calls, vi.mock() paths,
import.meta.dirname joins, and __dirname joins.

Vitest discovery unchanged (no test.include in config, recursive glob
matches subdirs, shard-by-hash unaffected). test-server.ts and
tool-route-drift.test.ts stay at integration root. fixtures/ untouched.

Parity gate: 13189 passing test names before = 13189 after (0 dropped).

2026-06-20 05:07:46 +08:00