astra/owpengram-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: sync harden auth, privacy, and PTS state

Browse source
This commit is contained in:
iamxvbaba 2026-08-02 14:12:04 +08:00
parent c1597696af
commit 2512eab51d
24 changed files with 817 additions and 154 deletions
Download patch file Download diff file Expand all files Collapse all files

5
internal/store/code.go
View file

@ -76,6 +76,11 @@ type PhoneCode struct {
VerifiedEmail bool
RequireSignUp bool
LoginEmailHash string
// RecoveryBinding ties a password-recovery code to the exact 2FA state
// which existed when the code was issued. A password or recovery-email
// change makes an older code unusable without relying on cross-store
// best-effort invalidation.
RecoveryBinding string
// AccountDeletionHash is the hex-encoded SHA-256 digest of the validated
// confirmphone link token. It binds account.confirmPhone to one pending
// deletion without persisting the raw link credential in the code record.