4 Commits

Include renames

Author	SHA1	Message	Date
Hermes	84edb035e3	[grade=B] feat(auth): onboard missing credentials into encrypted vault	2026-08-22 05:41:38 -07:00
Hermes	0d46225efc	[grade=B] test: sync auth and version contracts	2026-07-24 22:39:29 -07:00
Krystie	2439ed3e85	DC-022: close 3 TOTP auth security holes ... 1. /totp/recovery-info: was PUBLIC, leaking TOTP configuration status to unauthenticated attackers. Now requires valid session (401 otherwise). 2. /totp/check-session: had an unconditional bypass that returned authenticated:true whenever totpConfig.enabled was false. This let anyone reach authenticated endpoints without credentials. Now throws AuthenticationError instead. 3. /totp/setup: was unmetered despite generating secrets. Added 3/hour per-IP rate limit in addition to the existing global 10/15min limiter. All changes verified live via https://status.sami: - recovery-info unauth → 401 [DC-110] (was 200) - check-session no cookie → 401 TOTP protection required (was 200) - 4th setup attempt → 429 [DC-429]	2026-07-01 03:09:33 -07:00
Hermes	e1a45543ea	DC-006: Add integration test for TOTP auth flow ... Covers the full BACKLOG DC-006 acceptance criteria: - GET /api/totp/config — read current config - POST /api/totp/setup — generate / import Base32 secret - POST /api/totp/verify-setup — activate TOTP after setup - POST /api/totp/verify — login with TOTP code → session + CSRF - GET /api/totp/check-session — auth gate (200 / 401) - POST /api/totp/disable — disable TOTP (requires valid code) - POST /api/totp/config — update session duration 25 tests, all passing. Uses real otplib for code generation (so we exercise actual TOTP math) but mocks credentialManager, session, totpConfig, saveTotpConfig — those own their own state machines (disk, cookies, file) that don't belong in a routes test. Also fixed a latent DC-005 bug: routes/auth/totp.js had wrong require-path depth after the refactor (../../../src/... went 3 levels up instead of 2, breaking route load). Changed to ../../src/... for the 2-level depth. NOTE: the same depth bug exists in many other depth-2 route files (auth/keys.js, auth/sso-gate.js, auth/session-handlers.js, recipes/*, apps/*, arr/*, config/*) — see BACKLOG.md DC-005 follow-up note. Tests didn't catch this because no test previously imported the auth routes; this new test exercises that import path. Result: 904/904 Jest tests pass (879 baseline + 25 new). ESLint: this file clean. Pre-existing 134 src/ warnings are unrelated (DC-005 refactor moved files without re-applying DC-004 lint cleanup — separate follow-up).	2026-06-25 16:15:15 -07:00