sandrodachandClaude Opus 5.5 3709282a4f fix(auth): longer IDs and invite codes, register limits, single-use invites (FLAW-32, FLAW-39, FLAW-40) ...

- NewID uses 96 random bits; invite codes get their own 100 bits in Base32.
- Registration and forgot-password are limited per address via loginGuard.
- The invite is claimed atomically before the account is created and
  released again when the account cannot be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 19:28:09 +01:00

..

api

fix(auth): longer IDs and invite codes, register limits, single-use invites (FLAW-32, FLAW-39, FLAW-40)

2026-10-29 19:28:09 +01:00

auth

feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31)

2026-10-29 19:25:22 +01:00

collab

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

config

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

domain

fix(auth): longer IDs and invite codes, register limits, single-use invites (FLAW-32, FLAW-39, FLAW-40)

2026-10-29 19:28:09 +01:00

storage

fix(auth): longer IDs and invite codes, register limits, single-use invites (FLAW-32, FLAW-39, FLAW-40)

2026-10-29 19:28:09 +01:00

ws

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00