pad/internal/cli at a0f20009689b0ecdf7d2102fbaa040a97685e5b8 - pad

mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-11 21:39:01 +00:00

Files

T

xarmian 5606b22007 fix: address 6 security findings from Codex review of TOTP 2FA

HIGH fixes:
- Login-verify no longer accepts bare user_id. Now requires an
  HMAC-signed, IP-bound, 5-minute challenge token issued during login
  (prevents password bypass via known user ID + TOTP code)
- Recovery codes are SHA-256 hashed before storage; plaintext is
  returned to the user once and never persisted

MEDIUM fixes:
- ConsumeRecoveryCode uses a DB transaction to prevent concurrent
  double-consumption of the same recovery code
- EnableTOTP is atomic: WHERE clause requires totp_secret match to
  prevent TOCTOU race between setup and verify calls
- /auth/2fa/login-verify now uses the strict Auth rate limiter
  (5 req/min/IP) instead of the general API limiter
- CLI login detects requires_2fa response and prompts for TOTP code
  instead of silently saving empty credentials

2026-04-08 20:30:39 +00:00

agents_test.go

Add multi-agent pad install command

2026-03-28 03:58:52 +00:00

agents.go

Rename Phases to Plans, clean up deprecated aliases (#71 )

2026-04-07 14:55:23 -04:00

client.go

fix: address 6 security findings from Codex review of TOTP 2FA

2026-04-08 20:30:39 +00:00

credentials.go

feat(server): add info command for TASK-134 (#52 )