fix(auth): require the password to turn MFA off (#754) - #848

Merged

alex-dembele merged 9 commits into

754-securityauth-disabling-mfa-does-not-re-verify-the-password

Oct 1, 2026

Commits on Sep 30, 2026

fix(auth): delete the MFA secret and backup codes in one transaction (#754)
alex-dembele
committed
eae19eb
fix(auth): require the password to turn MFA off (#754)
alex-dembele
committed
48d0b51
fix(ds): leave focus on a field that autofocused inside a Modal (#754)
alex-dembele
committed
b3d9016
feat(settings): turn MFA off from Settings with password confirmation (#754)
alex-dembele
committed
6f0eb5b
test(auth): prove the MFA disable rollback on a real Postgres (#754)
alex-dembele
committed
e125f6c
feat(auth): let an SSO account turn MFA off with an authenticator code (#754)
alex-dembele
committed
94d4dac
feat(settings): ask an SSO account for its authenticator code to turn MFA off (#754)
alex-dembele
committed
eb5f8e3
docs(decisions): record D-061, SSO accounts confirm MFA removal with a code (#754)
alex-dembele
committed
9a96d2f
docs(api): describe GET /auth/me and POST /auth/mfa/disable (#754)
alex-dembele
committed
4c56854