fix: harden IAM registration and service-account replay - #47

Merged

BeforeLights merged 32 commits into

devfrom

fix/coderabbit-iam-critical-20260804

Aug 4, 2026

Commits on Aug 4, 2026

fix(iam): persist recovery challenges before delivery
BeforeLights
committed
597dc5d
fix(iam): compose service accounts from derived repository
BeforeLights
committed
eb2d3c9
fix(iam): enforce strong digest keys
BeforeLights
committed
bfdcd5d
fix(iam): reject recovery for inactive users
BeforeLights
committed
8860135
fix(iam): guard service-account replacement scope
BeforeLights
committed
ea70d9f
fix(iam): persist invitations before delivery
BeforeLights
committed
2946e92
fix(iam): map invitation invariant conflicts
BeforeLights
committed
75af992
fix(iam): enforce one active invitation per membership
BeforeLights
committed
7910db8
fix(iam): validate service-account permissions before issuance
BeforeLights
committed
a723292
fix(bua): use server time for lease verification
BeforeLights
committed
b54f0b4
fix(iam): make MFA reenrollment state explicit
BeforeLights
committed
716229a
fix(security): fail closed on signer errors and MFA clear
BeforeLights
committed
03a2101
fix(api): preserve integer and UTC timestamp contracts
BeforeLights
committed
c6c5cee
fix(bua): compare immutable leases by fields
BeforeLights
committed
c4a08a2
fix(aud): use targeted scoped seal lookups
BeforeLights
committed
418b56a
fix(aud): return typed attestation replays
BeforeLights
committed
3f1c4e9
fix(iam): make registration outcomes indistinguishable
BeforeLights
committed
05149f6
fix(iam): throttle registration before password hashing
BeforeLights
committed
c61bb1c
fix(iam): honor service-account create idempotency
BeforeLights
committed
fa15e4b
test(iam): exercise registration transaction rollback
BeforeLights
committed
40af06b
test(prisma): fix migration assertion escaping
BeforeLights
committed
397087b
docs(iam): refresh invitation slice checkpoint
BeforeLights
committed
5f1bc30
test(iam): verify registration admission composition
BeforeLights
committed
8b48661
test(iam): prove registration rollback after staged write
BeforeLights
committed
108cc0a
fix(iam): distinguish revoked invitation tokens
BeforeLights
committed
000554c
docs(iam): refresh registration slice evidence
BeforeLights
committed
417885e
test(iam): fail closed on unreadable account replay
BeforeLights
committed
6231dfd
test(iam): verify registration admission digest boundaries
BeforeLights
committed
e1ff67f
test(iam): cover replay envelope bounds
BeforeLights
committed
277e699
test(iam): correct registration timestamp assertions
BeforeLights
committed
0bdd655
test(iam): preserve service-account create replay
BeforeLights
committed
ba41a8b
test(iam): keep admission fixtures lint-clean
BeforeLights
committed
e957e43

Navigation Menu

Uh oh!

fix: harden IAM registration and service-account replay - #47

fix: harden IAM registration and service-account replay#47
BeforeLights merged 32 commits into
devfrom
fix/coderabbit-iam-critical-20260804

Commits on Aug 4, 2026

fix(iam): persist recovery challenges before delivery

fix(iam): compose service accounts from derived repository

fix(iam): enforce strong digest keys

fix(iam): reject recovery for inactive users

fix(iam): guard service-account replacement scope

fix(iam): persist invitations before delivery

fix(iam): map invitation invariant conflicts

fix(iam): enforce one active invitation per membership

fix(iam): validate service-account permissions before issuance

fix(bua): use server time for lease verification

fix(iam): make MFA reenrollment state explicit

fix(security): fail closed on signer errors and MFA clear

fix(api): preserve integer and UTC timestamp contracts

fix(bua): compare immutable leases by fields

fix(aud): use targeted scoped seal lookups

fix(aud): return typed attestation replays

fix(iam): make registration outcomes indistinguishable

fix(iam): throttle registration before password hashing

fix(iam): honor service-account create idempotency

test(iam): exercise registration transaction rollback

test(prisma): fix migration assertion escaping

docs(iam): refresh invitation slice checkpoint

test(iam): verify registration admission composition

test(iam): prove registration rollback after staged write

fix(iam): distinguish revoked invitation tokens

docs(iam): refresh registration slice evidence

test(iam): fail closed on unreadable account replay

test(iam): verify registration admission digest boundaries

test(iam): cover replay envelope bounds

test(iam): correct registration timestamp assertions

test(iam): preserve service-account create replay

test(iam): keep admission fixtures lint-clean