mirror of
https://github.com/HeyPuter/puter.git
synced 2026-10-15 00:00:04 +00:00
Juan Castro
cab70254b1
Forcing 2FA makes lockout materially likelier, and nothing could clear a factor except the account holding it — `resetMemberPassword` leaves 2FA alone on purpose, and admin only displays it. A seat that lost both its authenticator and its recovery codes had no way back. Its own route and its own audit action rather than folded into the password reset, so that method keeps the property its comment claims: a password reset alone is not takeover. The two together are, and for an account the team created and pays for that is the team's to do — but it has to be chosen and recorded, not arrived at sideways. Bounded to `org_owned = 1`: a joined member's own login is not a team's to reach into. The member is told, and signed out everywhere.