fix(auth): MFA enrollment consume-step, with the MFA test suite restructured (BACKLOG #1021) - #245
Open
wshallwshall wants to merge 1 commit into
Open
fix(auth): MFA enrollment consume-step, with the MFA test suite restructured (BACKLOG #1021)#245wshallwshall wants to merge 1 commit into
wshallwshall wants to merge 1 commit into
Conversation
…G #1021) confirm_mfa_enrollment now uses verify_totp_step + consume_totp_step (mirroring the login path's verify-then-consume), so the code that just enabled MFA is single-use. On first deployment the activating code would otherwise have stayed replayable on POST /auth/mfa-verify for the rest of its own step window. The store/backends already carried the guard; only the enrollment call site changed. Tests pin the TOTP clock so enroll and later verify sit in distinct steps.
wshallwshall
enabled auto-merge (squash)
August 6, 2026 14:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes BACKLOG #1021. Sequenced AFTER #1015 (auth cluster base). 8 files.
auth/service.py enrollment consume-step fix, plus 6 restructured MFA test files and the banner.
VERIFIED: 37 MFA tests pass (test_mfa, test_step_up, and the webconsole test_ui_mfa_gate).
lane ran
claim.ps1 -Release 1021 -Forceto reassign a claim it did not hold, and left no commit.That was remediated WITHOUT -Force: the original holder released its own claim, the item was re-taken
on the lane worktree, and the work committed there. The auto-classifier correctly blocks -Force.
Scope confirmed: 8 files, NO phantom deletions, BACKLOG token in the commit SUBJECT.
ROOT CAUSE, and it is a tooling finding rather than a lane failure: items were claimed from the
PRIMARY checkout, so a lane could not pass its own claim gate. Claim from the lane worktree.
NEVER -Force a claim you do not own.