mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-14 03:52:26 +08:00
shaw
38ef8dc069
A hijacked session must not be able to silently add a passkey as a persistent backdoor or remove the victim's credentials. Registration (begin) and deletion now verify the account password server-side, reusing the existing PASSWORD_REQUIRED / PASSWORD_INCORRECT errors. The password is used instead of TOTP step-up so the guard also protects deployments that never configured a TOTP encryption key. The password key in both request bodies is covered by the audit middleware's key-substring redaction, so no credential material reaches audit_logs. Frontend: the add-passkey form gains a current-password field, and the delete confirmation is now a dialog with a password input (replacing window.confirm), mirroring the TOTP disable dialog. Backend error messages (e.g. wrong password) are surfaced instead of the generic failure toast. Rename remains password-free as it is cosmetic.