MFA hardening: OAuth2 memento guard on recovery, DTO refactors, full OIDC circuit tests - #152

Merged

smarcet merged 13 commits into

feat/mfa-phase1---migrations--and--interfacesfrom

feature/mfa-oauth2-hardening

Aug 12, 2026

Commits on Aug 11, 2026

fix(2fa): validate pending OAuth2 client before redeeming a recovery code
smarcet
committed
8eb854f
refactor(2fa): extract MFA error_code literals into MFAConstants
smarcet
committed
77264d5
refactor(2fa): return a typed DTO from getPendingState() instead of an array
smarcet
committed
9644663
refactor(2fa): serialize recovery-codes standing via a RecoveryCodesStatus DTO
smarcet
committed
e354159
test(2fa): prove the full OIDC consent circuit for verify2FA and verify2FARecovery
smarcet
committed
472e290
test(oidc): repair OIDCProtocolTestCase login circuits (stale password + MFA gate)
smarcet
committed
b7d210c
fix(auth): honor clear_security_ctx=false across logout()'s session flush
smarcet
committed
6e16fb2
test(oidc): raise testTokenResponseModePost max_age from 1 to 3200
smarcet
committed
e3d8b41
test(2fa): negative-path OIDC circuits for verify2FA and verify2FARecovery
smarcet
committed
235d649
test(2fa): cover the error branches of verify2FA and verify2FARecovery
smarcet
committed
6672516
test(ci): actually run the protocol TestCase suites, stop hiding failure breadth
smarcet
committed
6f1bb9f
refactor(2fa): single home for every MFA string constant
smarcet
committed
9e25bf6

Commits on Aug 12, 2026

test(oidc): extract the seeded password into a SEED_PASSWORD constant
smarcet
committed
305b9bd