Daniel Salazar db26193a55 auth: per-account 2FA code limit, single-use otp-login tokens, recovery mail limits ...

- /login/otp and /login/recovery-code share a per-account bucket charged on
  wrong codes; an otp-login token completes one sign-in.
- /send-pass-recovery-email adds an IP bucket, a per-account cap and captcha,
  and reuses the outstanding recovery token instead of rotating it.
- Reauth tokens carry the rejection reason; /signup re-attaches a temp
  account only from an expired session.

2026-10-08 20:41:15 -07:00

..

apps

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

auth

auth: per-account 2FA code limit, single-use otp-login tokens, recovery mail limits

2026-10-08 20:41:15 -07:00

broadcast

…

desktop

…

drivers

fix(ai): propagate cancellation and stream termination failures

2026-10-06 20:24:19 +02:00

events

fix(socket): hold unlisted free plans to the free connection cap (PUT-1830) (#4060)

2026-10-04 00:46:59 -07:00

feedback

…

fs

fix: don't hand the owner's subtree size to a see-only caller

2026-10-06 19:08:46 -04:00

homepage

…

hosting

…

notification

…

oidc

fix: alert errors from timeouts (#4066)

2026-10-04 02:44:40 -07:00

peer

fix(metering): stop caching subscription answers from email-less actors and failed lookups (PUT-2002) (#4052)

2026-10-03 16:39:08 -07:00

profile

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

puterai

refactor(ai): trim redundant cancellation checks

2026-10-06 19:49:25 -07:00

share

Let the account's own API token reach the routes a privileged app needs (#4032)

2026-10-05 01:10:29 -07:00

static

…

system

…

team

fix: address code review on the teams cleanup

2026-10-06 16:22:48 -04:00

webdav

fix(fs): hide the issuer's home from scoped-token root listings (PUT-2053) (#4047)

2026-10-04 00:22:43 -07:00

wisp

…

index.ts

…

types.ts

…