promote: IAM registration and replay hardening - #48

Merged

BeforeLights merged 45 commits into

mainfrom

promote/iam-registration-20260804

Aug 4, 2026

Commits on Aug 4, 2026

fix(iam): persist recovery challenges before delivery
BeforeLights
committed
597dc5d
fix(iam): compose service accounts from derived repository
BeforeLights
committed
eb2d3c9
fix(iam): enforce strong digest keys
BeforeLights
committed
bfdcd5d
fix(iam): reject recovery for inactive users
BeforeLights
committed
8860135
fix(iam): guard service-account replacement scope
BeforeLights
committed
ea70d9f
fix(iam): persist invitations before delivery
BeforeLights
committed
2946e92
fix(iam): map invitation invariant conflicts
BeforeLights
committed
75af992
fix(iam): enforce one active invitation per membership
BeforeLights
committed
7910db8
fix(iam): validate service-account permissions before issuance
BeforeLights
committed
a723292
fix(bua): use server time for lease verification
BeforeLights
committed
b54f0b4
fix(iam): make MFA reenrollment state explicit
BeforeLights
committed
716229a
fix(security): fail closed on signer errors and MFA clear
BeforeLights
committed
03a2101
fix(api): preserve integer and UTC timestamp contracts
BeforeLights
committed
c6c5cee
fix(bua): compare immutable leases by fields
BeforeLights
committed
c4a08a2
fix(aud): use targeted scoped seal lookups
BeforeLights
committed
418b56a
fix(aud): return typed attestation replays
BeforeLights
committed
3f1c4e9
fix(iam): make registration outcomes indistinguishable
BeforeLights
committed
05149f6
fix(iam): throttle registration before password hashing
BeforeLights
committed
c61bb1c
fix(iam): honor service-account create idempotency
BeforeLights
committed
fa15e4b
test(iam): exercise registration transaction rollback
BeforeLights
committed
40af06b
test(prisma): fix migration assertion escaping
BeforeLights
committed
397087b
docs(iam): refresh invitation slice checkpoint
BeforeLights
committed
5f1bc30
test(iam): verify registration admission composition
BeforeLights
committed
8b48661
test(iam): prove registration rollback after staged write
BeforeLights
committed
108cc0a
fix(iam): distinguish revoked invitation tokens
BeforeLights
committed
000554c
docs(iam): refresh registration slice evidence
BeforeLights
committed
417885e
test(iam): fail closed on unreadable account replay
BeforeLights
committed
6231dfd
test(iam): verify registration admission digest boundaries
BeforeLights
committed
e1ff67f
test(iam): cover replay envelope bounds
BeforeLights
committed
277e699
test(iam): correct registration timestamp assertions
BeforeLights
committed
0bdd655
test(iam): preserve service-account create replay
BeforeLights
committed
ba41a8b
test(iam): keep admission fixtures lint-clean
BeforeLights
committed
e957e43
Merge pull request #47 from DatabreezeService/fix/coderabbit-iam-critical-20260804
BeforeLights
authored
2a49f79
merge: reconcile promotion with main
BeforeLights
committed
67d1982
fix(iam): align replay and entitlement contracts
BeforeLights
committed
bb276d8
fix(iam): require durable service-account envelope keys
BeforeLights
committed
5acded3
fix(iam): require MFA reenrollment state at auth boundaries
BeforeLights
committed
a2e79b6
fix(iam): bound and snapshot service-account replays
BeforeLights
committed
1a90d5b
fix(iam): key registration admission and require durable counters
BeforeLights
committed
9c50840
fix(iam): durably block recovery compensation failures
BeforeLights
committed
df8bfc8
test(iam): prove replay invalidation across lifecycle
BeforeLights
committed
888aa7d
fix(iam): revoke and block failed invitation delivery
BeforeLights
committed
5e2307b
test(iam): tighten replay framing and migration evidence
BeforeLights
committed
70f2b27
style(iam): normalize promotion formatting
BeforeLights
committed
9c9af98
fix(iam): satisfy durable adapter lint boundaries
BeforeLights
committed
63af721