feat(iam): complete recovery security slice - #43

Merged

BeforeLights merged 31 commits into

devfrom

feat/iam-recovery

Aug 3, 2026

Commits on Aug 3, 2026

feat(iam): define hashed invitation token invariants
BeforeLights
committed
c35f62d
feat(iam): publish invitation invariants in domain aggregate
BeforeLights
committed
92b18ed
feat(iam): add invitation issue and redemption service
BeforeLights
committed
46b6939
feat(iam): add scoped invitation repository adapter
BeforeLights
committed
9f14db2
feat(iam): persist invitation token records
BeforeLights
committed
2a65756
docs(iam): record invitation token evidence
BeforeLights
committed
5ce9fe3
feat(iam): add keyed invitation crypto adapters
BeforeLights
committed
bf311ec
feat(iam): expose invitation HTTP composition
BeforeLights
committed
ab4d22c
feat(iam): add durable principal email lookup
BeforeLights
committed
003f7c9
feat(iam): add atomic account registration service
BeforeLights
committed
b7701a7
feat(iam): persist account registration atomically
BeforeLights
committed
a6a6168
fix(repo): normalize invitation formatting
BeforeLights
committed
4fd6236
feat(iam): expose account registration endpoint
BeforeLights
committed
a8ec43e
feat(iam): add bounded recovery challenge invariants
BeforeLights
committed
26dd0ee
feat(iam): add recovery service and transactional state effects
BeforeLights
committed
371ccdf
feat(iam): persist recovery security state atomically
BeforeLights
committed
857aa05
feat(iam): expose account recovery endpoints
BeforeLights
committed
66abc06
feat(iam): clear recovery gate after MFA verification
BeforeLights
committed
20888ec
feat(iam): propagate MFA recovery re-enrollment state
BeforeLights
committed
c7faf68
fix(iam): compare and set recovery challenge revisions
BeforeLights
committed
42bb322
feat(iam): add bounded recovery admission
BeforeLights
committed
1269428
fix(iam): avoid password hashing for invalid recovery tokens
BeforeLights
committed
33882d9
feat(iam): enforce recovery mfa gate on approvals
BeforeLights
committed
c6b7228
feat(iam): guard high-risk step-up during mfa reenrollment
BeforeLights
committed
94b8766
feat(iam): add shared recovery admission adapter
BeforeLights
committed
e60170f
feat(iam): compose shared recovery admission
BeforeLights
committed
8f0a7c2
feat(iam): bind recovery admission to redis eval
BeforeLights
committed
32d8687
feat(iam): provide context-aware mfa step-up
BeforeLights
committed
20b592e
feat(iam): bound recovery completion attempts
BeforeLights
committed
1302f88
feat(iam): separate recovery completion admission
BeforeLights
committed
fe8380d
fix(repo): align iam mocks with async lint contract
BeforeLights
committed
fee9579