feat(auth): a session ended for its wrong proofs warns its owner

Browse source

The tenth wrong owner proof in a row ends a session (the third
reading); someone holding that session tried the password or its
codes. The register now keeps the moment with the account's password
(`account_password.sessionEndedForProofsAt`): the account's sign-in
ways and its next password sign-in carry it, until the owner dismisses
it (`password.dismissSessionEndedWarning`, their session alone: it
hides a warning and secures nothing) or sets a new password. A member
ending its own session tells the register
(`noteSessionEndedForProofs`); a register out of reach leaves the
owner unwarned, the session ended all the same.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "sessionEndedForProofsAt"
timestamp without time zone; nullable, so every row keeps its values
and has no warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

...

This commit is contained in:

Tizian 「ティツィアーン」 2026-10-21 12:05:18 +02:00

parent 858fffdce3

commit 5e7d7f4e36

Signed by: raisondetredev

GPG key ID: 07F6FCF405488B64

1 changed files with 41919 additions and 34 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4317

apps/todo/halkyon_todo_server/migrations/20261021100422779-session-ended-warning/definition.json Normal file

View file

File diff suppressed because it is too large Load diff