Repository navigation

feat(mfa): add idp:enforce-admin-2fa command - #166

Open

romanetar wants to merge 24 commits into

feat/mfa-phase1---migrations--and--interfacesfrom

feat/mfa-admin-enforcement-and-reset-commands

Commits on Sep 22, 2026
- feat: Add MultiFactor Authentication
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  4d8ed80
- chore: Add PR's requested changes and additional AI comments
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  a682489
- chore: Add PR's requested changes
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  c2e5389
- chore: Add guards on setEventType and setMethod methods on TwoFactorAuditLog model
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  9ecc006
- chore: Guard the unique-index migration against existing duplicates.
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  194adbc
- chore: Add UniqueConstraint annotation to mirror the database migration
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  8bc5a70
- chore: Refactor UserRecoveryCode and TwoFactorAuditLog models; update migration for user_recovery_codes
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  a2c2e84
- chore: remove BaseEntity oveloaded props and methods. fix skipped test
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  856f031
- chore: unify migrations
  
  matiasperrone-exo
  authored and
  smarcet
  committed
  4d8e6a5
- Feature | Implement Two-Factor Authentication (2FA) support for users (#126)
  
  committed
  6607c19
- MFA hardening: OAuth2 memento guard on recovery, DTO refactors, full OIDC circuit tests (#152)
  smarcet
  committed
  0359d77
- fix(session): restore Secure and SameSite=None defaults for the session cookie
  smarcet
  committed
  236ddef
- fix(auth): split the login SPA reset from cancelLogin to keep OAuth2 requests alive
  smarcet
  committed
  f2d8521
- fix(2fa): reserve verify/recovery attempts atomically before the controller runs
  smarcet
  committed
  7f00d36
- chore(auth): drop unused imports from MFACookieManager
  smarcet
  committed
  d1a91df
- fix(2fa): require CSRF on the profile 2FA enable and recovery-code regenerate routes
  smarcet
  committed
  01da08a
- fix(2fa): make the pending MFA session TTL configurable, default 600s
  smarcet
  committed
  317a87c
- fix(tests): drop stale OAuth2ProtocolTestCase.php entry from phpunit.xml
  smarcet
  committed
  c92f563
- fix(e2e): assert the intended post-error password step, not the old reset-to-email behavior
  smarcet
  committed
  e72bc80
Commits on Sep 23, 2026
- fix: MFA-enforced accounts leak enumeration via passwordless login guard order (#154)
  smarcet
  authored
  c19f19a
- Recovery code login flow UI (#151)
  
  romanetar
  and
  claude
  authored
  807befd
- chore: fix ssl redirect
  smarcet
  committed
  9f24344
- fix(2fa): apply the local MFA policy to social login
  smarcet
  committed
  2d489c3
Commits on Oct 5, 2026
- feat(mfa): add idp:enforce-admin-2fa command
  romanetar
  committed
  16ad9fd

Navigation Menu

Repository navigation

feat(mfa): add idp:enforce-admin-2fa command - #166

feat(mfa): add idp:enforce-admin-2fa command#166
romanetar wants to merge 24 commits into
feat/mfa-phase1---migrations--and--interfacesfrom
feat/mfa-admin-enforcement-and-reset-commands

Commits on Sep 22, 2026

feat: Add MultiFactor Authentication

chore: Add PR's requested changes and additional AI comments

chore: Add PR's requested changes

chore: Add guards on setEventType and setMethod methods on TwoFactorAuditLog model

chore: Guard the unique-index migration against existing duplicates.

chore: Add UniqueConstraint annotation to mirror the database migration

chore: Refactor UserRecoveryCode and TwoFactorAuditLog models; update migration for user_recovery_codes

chore: remove BaseEntity oveloaded props and methods. fix skipped test

chore: unify migrations

Feature | Implement Two-Factor Authentication (2FA) support for users (#126)

MFA hardening: OAuth2 memento guard on recovery, DTO refactors, full OIDC circuit tests (#152)

fix(session): restore Secure and SameSite=None defaults for the session cookie

fix(auth): split the login SPA reset from cancelLogin to keep OAuth2 requests alive

fix(2fa): reserve verify/recovery attempts atomically before the controller runs

chore(auth): drop unused imports from MFACookieManager

fix(2fa): require CSRF on the profile 2FA enable and recovery-code regenerate routes

fix(2fa): make the pending MFA session TTL configurable, default 600s

fix(tests): drop stale OAuth2ProtocolTestCase.php entry from phpunit.xml

fix(e2e): assert the intended post-error password step, not the old reset-to-email behavior

Commits on Sep 23, 2026

fix: MFA-enforced accounts leak enumeration via passwordless login guard order (#154)

Recovery code login flow UI (#151)

chore: fix ssl redirect

fix(2fa): apply the local MFA policy to social login

Commits on Oct 5, 2026

feat(mfa): add idp:enforce-admin-2fa command