08a442e661
The 2FA flow moved from a middleware-gated i/auth/checkpoint model to a pending-login model (auth.pending session, POST /login/2fa, /login?step=2fa challenge). The old tests referenced the removed route and dead session keys (2fa.session.active, 2fa.attempts) and failed with 404s. Rewritten against the new code as source of truth: - Checkpoint test: throttle assertion retargeted to the login/2fa route; failed-verification audit log now driven through a pending 2FA session. - Logout-session test: asserts auth.pending is cleared and the user stays a guest after MAX_2FA_ATTEMPTS failures (replacing the old flag cleanup). - TwoFactorTest: challenge-redirect and challenge-page cases rewritten around the login flow; setup/recovery password-confirmation cases unchanged. - MiddlewarePipelineTest: 2FA is enforced at login, not per-request, so an authenticated 2FA user browses normally. Full suite: 715 passed. |
2 weeks ago | |
|---|---|---|
| .ddev | ||
| .github | 3 weeks ago | |
| .vscode | ||
| app | 2 weeks ago | |
| bootstrap | 2 weeks ago | |
| config | 2 weeks ago | |
| database | 2 weeks ago | |
| lang | 3 weeks ago | |
| notes | 4 weeks ago | |
| public | 2 weeks ago | |
| resources | 2 weeks ago | |
| routes | 2 weeks ago | |
| storage | ||
| tests | 2 weeks ago | |
| .dockerignore | 4 weeks ago | |
| .editorconfig | ||
| .env.docker.example | 4 weeks ago | |
| .env.example | 4 weeks ago | |
| .env.testing | 3 weeks ago | |
| .gitattributes | ||
| .gitignore | 4 weeks ago | |
| .markdownlint.json | ||
| .node-version | ||
| .shellcheckrc | ||
| CHANGELOG.md | 4 weeks ago | |
| CODEOWNERS | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| DOCKER_COMPOSE_SETUP.md | 4 weeks ago | |
| Dockerfile | 1 month ago | |
| LICENSE | ||
| README.md | ||
| SECURITY.md | ||
| artisan | 3 weeks ago | |
| composer.json | 3 weeks ago | |
| composer.lock | 3 weeks ago | |
| crowdin.yml | 3 weeks ago | |
| docker-compose.test.yml | 4 weeks ago | |
| docker-compose.yml | 4 weeks ago | |
| funding.json | ||
| package-lock.json | 3 weeks ago | |
| package.json | 3 weeks ago | |
| phpstan.neon | 3 weeks ago | |
| phpunit.xml | 3 weeks ago | |
| pint.json | 4 weeks ago | |
| psalm-baseline.xml | 4 weeks ago | |
| psalm.xml | 4 weeks ago | |
| server.php | ||
| webpack.mix.js | ||
README.md
Introduction
Photo sharing the way it should be. Pixelfed lets your casual shots and creative photography find their audience naturally, without algorithmic barriers. Join millions of people sharing across the fediverse.
Official Documentation
Documentation for Pixelfed can be found on the Pixelfed documentation website.
Run on YunoHost
Pixelfed app for YunoHost. See the package source code
License
Pixelfed is open-sourced software licensed under the AGPL license.
Communication
The ways you can communicate on the project are below. Before interacting, please read through the Code Of Conduct.
- Mastodon: @pixelfed@mastodon.social
- E-mail: hello@pixelfed.org
Pixelfed Sponsors
We would like to extend our thanks to the following sponsors for funding Pixelfed development. If you are interested in becoming a sponsor, please visit the Pixelfed Patreon Page
- NLnet Foundation and NGI0 Discovery, part of the Next Generation Internet initiative.
This project is supported by:
