popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d90e25d1ffa576f2e527386fad8b73d3e4694e03
Crussell/backend/handlers/user
T
History
popertotsandSisyphus d90e25d1ff fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2026-08-22 00:34:51 +01:00
..
account_round9_fixes_test.go
fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants
2026-08-22 00:34:51 +01:00
account.go
fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised
2026-08-22 00:34:51 +01:00
admin_handlers_test.go
test: add coverage tests across backend + fix mock for PENDING checkout support
2026-07-10 18:13:44 +01:00
admin_twofa_test.go
fix: full-scope review — tip-inclusive amount_due, sweep deposit-strand, A6 clamp cap, B13 clawback, 2FA single-use, mint audit, account-deletion re-auth, refresh dedup
2026-08-22 00:34:50 +01:00
customer_relationship_test.go
test: add coverage tests across backend + fix mock for PENDING checkout support
2026-07-10 18:13:44 +01:00
customer_relationship.go
refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns
2026-06-24 23:43:50 +01:00
gdpr_export.go
fix: log internal errors server-side, add timeout to GDPR goroutine
2026-07-11 16:09:11 +01:00
gdpr_test.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
guest_test.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
guest.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
loyalty.go
fix: replace silent json.Encode with error-logging pattern across all handlers
2026-07-11 17:50:07 +01:00
patch_tests_test.go
chore: run go fix for Go 1.26 modernization
2026-07-09 17:25:23 +01:00
profile_test.go
fix: full-scope review — tip-inclusive amount_due, sweep deposit-strand, A6 clamp cap, B13 clawback, 2FA single-use, mint audit, account-deletion re-auth, refresh dedup
2026-08-22 00:34:50 +01:00
profile.go
fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised
2026-08-22 00:34:51 +01:00
test_helpers_test.go
fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity
2026-08-22 00:34:50 +01:00
testmain_test.go
test: add coverage tests across backend + fix mock for PENDING checkout support
2026-07-10 18:13:44 +01:00
twofa_dev.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
twofa_failclosed_test.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
twofa_prod_test.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
twofa_prod_variant_dev_test.go
feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance
2026-08-22 00:34:50 +01:00
twofa_prod_variant_prod_test.go
feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance
2026-08-22 00:34:50 +01:00
twofa_prod.go
fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
2026-08-22 00:34:50 +01:00
twofa_test.go
fix: round-2 loop-A fresh review (503c326 baseline) — B1 replay cap, A6 discount record, 2FA reissue+cooldown, notification flood, lockout saturation, VAT/refund-status consolidation
2026-08-22 00:34:50 +01:00
twofa.go
fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised
2026-08-22 00:34:51 +01:00
user_coverage_test.go
fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity
2026-08-22 00:34:50 +01:00