2 Commits (388d6e57260fc40bf9ec7e40afb5fb0d1f61e58b)

Author	SHA1	Message	Date
Your Name	08a442e661	Rewrite 2FA tests for the pending-login refactor ... The 2FA flow moved from a middleware-gated i/auth/checkpoint model to a pending-login model (auth.pending session, POST /login/2fa, /login?step=2fa challenge). The old tests referenced the removed route and dead session keys (2fa.session.active, 2fa.attempts) and failed with 404s. Rewritten against the new code as source of truth: - Checkpoint test: throttle assertion retargeted to the login/2fa route; failed-verification audit log now driven through a pending 2FA session. - Logout-session test: asserts auth.pending is cleared and the user stays a guest after MAX_2FA_ATTEMPTS failures (replacing the old flag cleanup). - TwoFactorTest: challenge-redirect and challenge-page cases rewritten around the login flow; setup/recovery password-confirmation cases unchanged. - MiddlewarePipelineTest: 2FA is enforced at login, not per-request, so an authenticated 2FA user browses normally. Full suite: 715 passed.	2 weeks ago
Your Name	8cebb24c04	Rate limit and audit-log 2FA checkpoint verification	2 weeks ago