xarmian 10867b9210 fix: persist 2FA challenge key and prevent duplicate TOTP verification ...

- Persist the 2FA challenge HMAC signing key in platform_settings so
  tokens survive process restarts and work across multiple instances
- Add AND totp_enabled = false to EnableTOTP WHERE clause so concurrent
  /auth/2fa/verify calls (double-click, multi-tab) cannot both succeed
  and overwrite each other's recovery codes

2026-04-08 20:30:39 +00:00

..

handlers_2fa.go

fix: address 6 security findings from Codex review of TOTP 2FA

2026-04-08 20:30:39 +00:00

handlers_activity.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_admin.go

feat: add API token rotation, expiry defaults, and scope enforcement

2026-04-08 18:00:43 +00:00

handlers_agent_roles.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_audit.go

fix: address Codex review findings for backup and audit trail

2026-04-06 02:22:23 +00:00

handlers_auth_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_auth.go

fix: address 6 security findings from Codex review of TOTP 2FA

2026-04-08 20:30:39 +00:00

handlers_collections.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_comments.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_convention_library.go

Initial release

2026-03-26 01:52:36 +00:00

handlers_dashboard_test.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_dashboard.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_documents.go

fix: resolve Codex review findings across SSE, audit, metrics, and deployment

2026-04-07 01:13:44 +00:00

handlers_events_test.go

feat: implement SSE connection limits

2026-04-06 01:23:34 +00:00

handlers_events.go

fix: resolve Codex review findings across SSE, audit, metrics, and deployment

2026-04-07 01:13:44 +00:00

handlers_item_links_test.go

feat(lineage): surface derived closure for TASK-122 (#40)

2026-04-02 10:46:09 -04:00

handlers_item_links.go

feat: generalized parent/child items with progress tracking (#70)

2026-04-07 09:52:31 -04:00

handlers_item_versions.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_items_test.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_items.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_members.go

feat: session binding, nonce-based CSP, and auth hardening (#75)

2026-04-08 13:58:58 -04:00

handlers_playbook_library.go

Initial release

2026-03-26 01:52:36 +00:00

handlers_rbac_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_role_board.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_search.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_timeline.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_tokens.go

fix: address Codex review findings for token rotation and scope enforcement

2026-04-08 18:50:08 +00:00

handlers_versions.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_views.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_webhooks.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_workspaces.go

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

item_lineage.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

middleware_auth.go

fix: address Codex review findings for token rotation and scope enforcement

2026-04-08 18:50:08 +00:00

middleware_csrf_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_csrf.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_logging.go

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

middleware_metrics_test.go

feat: add Prometheus metrics and /metrics endpoint

2026-04-06 01:13:40 +00:00

middleware_metrics.go

feat: add Prometheus metrics and /metrics endpoint

2026-04-06 01:13:40 +00:00

middleware_ratelimit_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_ratelimit.go

fix: address 6 security findings from Codex review of TOTP 2FA

2026-04-08 20:30:39 +00:00

middleware_security_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_security.go

feat: session binding, nonce-based CSP, and auth hardening (#75)

2026-04-08 13:58:58 -04:00

server_test.go

feat(workspaces): add CLI and API context support for TASK-130 (#46)

2026-04-02 16:10:09 -04:00

server.go

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00

token_scopes_test.go

fix: address Codex review findings for token rotation and scope enforcement

2026-04-08 18:50:08 +00:00

twofactor_challenge.go

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00