3 Commits (ccfd39fd908fd136b2e3fdbd11446c71ebef55a9)

Author	SHA1	Message	Date
Your Name	08a442e661	Rewrite 2FA tests for the pending-login refactor ... The 2FA flow moved from a middleware-gated i/auth/checkpoint model to a pending-login model (auth.pending session, POST /login/2fa, /login?step=2fa challenge). The old tests referenced the removed route and dead session keys (2fa.session.active, 2fa.attempts) and failed with 404s. Rewritten against the new code as source of truth: - Checkpoint test: throttle assertion retargeted to the login/2fa route; failed-verification audit log now driven through a pending 2FA session. - Logout-session test: asserts auth.pending is cleared and the user stays a guest after MAX_2FA_ATTEMPTS failures (replacing the old flag cleanup). - TwoFactorTest: challenge-redirect and challenge-page cases rewritten around the login flow; setup/recovery password-confirmation cases unchanged. - MiddlewarePipelineTest: 2FA is enforced at login, not per-request, so an authenticated 2FA user browses normally. Full suite: 715 passed.	2 weeks ago
Your Name	68becbe2cc	lint	2 weeks ago
Your Name	97f1a097ff	Clear 2FA session state on forced logout after failed attempts	2 weeks ago