Heimdall
8e65f56b0c
Linked accounts: never guess a proof provider; require stepUpRequested; no-store on completion ...
With no current list the proof goes only through a provider the member names, never the
session's sign-in provider: a sign-in through an unlinked provider makes Heimdall mint an
orphan account holding that login. Link buttons need a current list. The unlink completion
must say a step-up was requested. POST /auth/heimdall/complete answers no-store. The fake
Heimdall now models orphan minting, derives step_up_at from the start's stepUp flag, and
enforces the app secret, sign_in-only, unsupported-provider and 600 s rules.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-13 20:08:07 +00:00
AppSecretFile: pin the deprecation at Warning level, say trailing newlines
2026-11-12 13:46:24 +00:00
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
Desk: the fork desk's Bifrost half ( #40 )
2026-11-11 01:02:36 +00:00
Desk: the fork desk's Bifrost half ( #40 )
2026-11-11 01:02:36 +00:00
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
Linked accounts: never guess a proof provider; require stepUpRequested; no-store on completion
2026-11-13 20:08:07 +00:00
Suspension gaps: bootstrap, demotion, members-page notices, admin-only reason ( #60 )
2026-11-11 14:12:47 +00:00
Chat sign-in needs a live consent receipt; notice frozen as version 1 ( #59 )
2026-11-11 14:32:06 +00:00
Chat sign-in needs a live consent receipt; notice frozen as version 1 ( #59 )
2026-11-11 14:32:06 +00:00
Registration gates: proof-of-work CAPTCHA and training-notice consent receipt ( #54 )
2026-11-11 10:15:46 +00:00
Registration gates: proof-of-work CAPTCHA and training-notice consent receipt ( #54 )
2026-11-11 10:15:46 +00:00
8e65f56b0c