promote: reviewed IAM recovery slice - #44

Merged

BeforeLights merged 102 commits into

mainfrom

Aug 4, 2026

Commits on Aug 3, 2026

feat(iam): define hashed invitation token invariants
BeforeLights
committed
c35f62d
feat(iam): publish invitation invariants in domain aggregate
BeforeLights
committed
92b18ed
feat(iam): add invitation issue and redemption service
BeforeLights
committed
46b6939
feat(iam): add scoped invitation repository adapter
BeforeLights
committed
9f14db2
feat(iam): persist invitation token records
BeforeLights
committed
2a65756
docs(iam): record invitation token evidence
BeforeLights
committed
5ce9fe3
feat(iam): add keyed invitation crypto adapters
BeforeLights
committed
bf311ec
feat(iam): expose invitation HTTP composition
BeforeLights
committed
ab4d22c
feat(iam): add durable principal email lookup
BeforeLights
committed
003f7c9
feat(iam): add atomic account registration service
BeforeLights
committed
b7701a7
feat(iam): persist account registration atomically
BeforeLights
committed
a6a6168
fix(repo): normalize invitation formatting
BeforeLights
committed
4fd6236
feat(iam): expose account registration endpoint
BeforeLights
committed
a8ec43e
feat(iam): add bounded recovery challenge invariants
BeforeLights
committed
26dd0ee
feat(iam): add recovery service and transactional state effects
BeforeLights
committed
371ccdf
feat(iam): persist recovery security state atomically
BeforeLights
committed
857aa05
feat(iam): expose account recovery endpoints
BeforeLights
committed
66abc06
feat(iam): clear recovery gate after MFA verification
BeforeLights
committed
20888ec
feat(iam): propagate MFA recovery re-enrollment state
BeforeLights
committed
c7faf68
fix(iam): compare and set recovery challenge revisions
BeforeLights
committed
42bb322
feat(iam): add bounded recovery admission
BeforeLights
committed
1269428
fix(iam): avoid password hashing for invalid recovery tokens
BeforeLights
committed
33882d9
feat(iam): enforce recovery mfa gate on approvals
BeforeLights
committed
c6b7228
feat(iam): guard high-risk step-up during mfa reenrollment
BeforeLights
committed
94b8766
feat(iam): add shared recovery admission adapter
BeforeLights
committed
e60170f
feat(iam): compose shared recovery admission
BeforeLights
committed
8f0a7c2
feat(iam): bind recovery admission to redis eval
BeforeLights
committed
32d8687
feat(iam): provide context-aware mfa step-up
BeforeLights
committed
20b592e
feat(iam): bound recovery completion attempts
BeforeLights
committed
1302f88
feat(iam): separate recovery completion admission
BeforeLights
committed
fe8380d
fix(repo): align iam mocks with async lint contract
BeforeLights
committed
fee9579
Merge pull request #43 from DatabreezeService/feat/iam-recovery
BeforeLights
authored
65afa44
feat(iam): define service account identity contract
BeforeLights
committed
265923b
feat(iam): scope service account permissions
BeforeLights
committed
9c238e8
feat(iam): add service account repository port
BeforeLights
committed
1db0186
feat(iam): authorize service account lifecycle
BeforeLights
committed
4a23c05
feat(iam): generate one-time service account secrets
BeforeLights
committed
9ebad8f
feat(iam): persist service account records
BeforeLights
committed
87530e7
feat(iam): add service account prisma adapter
BeforeLights
committed
73b4d99
feat(iam): expose service account lifecycle api
BeforeLights
committed
e32ea58
feat(iam): resolve service accounts by secret digest
BeforeLights
committed
7bf5ba0
feat(iam): authenticate service account credentials
BeforeLights
committed
d02aa7e
feat(audit): register service account lifecycle actions
BeforeLights
committed
03ef9db
feat(iam): publish service account api contract
BeforeLights
committed
528f0c9
feat(audit): add signed seal attestations
BeforeLights
committed
f015b11
feat(bua): issue bounded entitlement leases
BeforeLights
committed
34b79bc
feat(bua): persist offline entitlement leases
BeforeLights
committed
796a681
feat(bua): persist entitlement lease schema
BeforeLights
committed
52d1607
feat(bua): add entitlement lease repository
BeforeLights
committed
4d057e4
feat(bua): issue and verify entitlement leases
BeforeLights
committed
5c25a81
feat(bua): expose entitlement lease api
BeforeLights
committed
ecfbb25
feat(bua): add provider-neutral lease signing
BeforeLights
committed
89f7bfb
fix(bua): bind lease acceptance to canonical payload
BeforeLights
committed
82b0e22
feat(audit): define seal attestation repository port
BeforeLights
committed
ea59eb1
feat(audit): add in-memory seal attestations
BeforeLights
committed
3705546
feat(audit): persist seal attestation schema
BeforeLights
committed
304eecf
feat(audit): add Prisma seal attestation adapter
BeforeLights
committed
2834320
feat(audit): issue and verify seal attestations
BeforeLights
committed
fb9d5c2
feat(audit): compose attestation providers
BeforeLights
committed
4b40c9b
feat(audit): expose attestation api
BeforeLights
committed
a100a75
fix(bua): validate entitlement snapshot plans
BeforeLights
committed
cb0dd27
feat(bua): compose HMAC lease signing
BeforeLights
committed
e4ad354
docs(traceability): record IAM AUD BUA security slice
BeforeLights
committed
d9a8386
fix(traceability): keep audit ownership precise
BeforeLights
committed
c9ebd1f
chore: format IAM and entitlement security slice
BeforeLights
committed
99141b9
fix(iam): satisfy service account lint guard
BeforeLights
committed
c2442ad
test(api): track security migration and route contracts
BeforeLights
committed
20ceddd
fix(deps): pin patched fast-uri release
BeforeLights
committed
df4d0a2
Merge pull request #45 from DatabreezeService/feat/iam-security-completion
BeforeLights
authored
b32584d

Commits on Aug 4, 2026

fix(iam): persist recovery challenges before delivery
BeforeLights
committed
597dc5d
fix(iam): compose service accounts from derived repository
BeforeLights
committed
eb2d3c9
fix(iam): enforce strong digest keys
BeforeLights
committed
bfdcd5d
fix(iam): reject recovery for inactive users
BeforeLights
committed
8860135
fix(iam): guard service-account replacement scope
BeforeLights
committed
ea70d9f
fix(iam): persist invitations before delivery
BeforeLights
committed
2946e92
fix(iam): map invitation invariant conflicts
BeforeLights
committed
75af992
fix(iam): enforce one active invitation per membership
BeforeLights
committed
7910db8
fix(iam): validate service-account permissions before issuance
BeforeLights
committed
a723292
fix(bua): use server time for lease verification
BeforeLights
committed
b54f0b4
fix(iam): make MFA reenrollment state explicit
BeforeLights
committed
716229a
fix(security): fail closed on signer errors and MFA clear
BeforeLights
committed
03a2101
fix(api): preserve integer and UTC timestamp contracts
BeforeLights
committed
c6c5cee
fix(bua): compare immutable leases by fields
BeforeLights
committed
c4a08a2
fix(aud): use targeted scoped seal lookups
BeforeLights
committed
418b56a
fix(aud): return typed attestation replays
BeforeLights
committed
3f1c4e9
fix(iam): make registration outcomes indistinguishable
BeforeLights
committed
05149f6
fix(iam): throttle registration before password hashing
BeforeLights
committed
c61bb1c
fix(iam): honor service-account create idempotency
BeforeLights
committed
fa15e4b
test(iam): exercise registration transaction rollback
BeforeLights
committed
40af06b
test(prisma): fix migration assertion escaping
BeforeLights
committed
397087b
docs(iam): refresh invitation slice checkpoint
BeforeLights
committed
5f1bc30
test(iam): verify registration admission composition
BeforeLights
committed
8b48661
test(iam): prove registration rollback after staged write
BeforeLights
committed
108cc0a
fix(iam): distinguish revoked invitation tokens
BeforeLights
committed
000554c
docs(iam): refresh registration slice evidence
BeforeLights
committed
417885e
test(iam): fail closed on unreadable account replay
BeforeLights
committed
6231dfd
test(iam): verify registration admission digest boundaries
BeforeLights
committed
e1ff67f
test(iam): cover replay envelope bounds
BeforeLights
committed
277e699
test(iam): correct registration timestamp assertions
BeforeLights
committed
0bdd655
test(iam): preserve service-account create replay
BeforeLights
committed
ba41a8b
test(iam): keep admission fixtures lint-clean
BeforeLights
committed
e957e43
Merge pull request #47 from DatabreezeService/fix/coderabbit-iam-critical-20260804
BeforeLights
authored
2a49f79