obscuremind 5a8b4bf8a5 feat(auth): two-factor sign-in for admins and resellers ...

A TOTP code from an authenticator app (RFC 6238), or one of ten one-time
recovery codes, after the password. Each user turns it on from the profile
page (a QR code drawn in the browser, never by a QR service); a group can
require it, and a member without it sets it up at the next sign-in.

A sign-in that needs a code is held: the session keys the password wrote
are moved aside until a good code, so no page sees a signed-in session
before it. A code is good once (users_2fa.last_step), recovery codes are
stored as hashes and spent on use, and ten wrong codes in 15 minutes lock
the account's second step; wrong codes count toward the login flood limit.
An admin turns it off for a user who lost the app, or root runs
`console.php tools twofactor <username>`.

2026-10-06 21:41:49 +00:00

..

constants.stub.php

feat(auth): two-factor sign-in for admins and resellers

2026-10-06 21:41:49 +00:00

gen-constants-stub.php

fix(phpstan): fix real bugs (return contracts, arg/byref, stub types) 599→585

2026-06-23 20:02:46 +03:00

phpstan-bootstrap.php

chore(build): move phpstan / php-cs-fixer config out of the repo root

2026-08-09 19:37:11 +03:00