feat(auth): harden device authorization and native admission - #5021

Merged

iscekic merged 52 commits into

mainfrom

audit-w2b-device-auth-8c25

Aug 5, 2026

Commits on Aug 3, 2026

feat(github): add one-time install states
iscekic
committed
fa87777
feat(github): verify installation claims
iscekic
committed
6ad82c3
feat(device-auth): split polling secret from code
iscekic
committed
837a9b3
feat(auth): add refreshable device sessions
iscekic
committed
86dc0b1
fix(auth): revoke blocked device credentials
iscekic
committed
105b61d
fix(auth): reserve sign-in codes before settlement
iscekic
committed
628b59b

Commits on Aug 4, 2026

fix(auth): isolate sign-in code attempts
iscekic
committed
545bf1d
fix(auth): equalize native OTP responses
iscekic
committed
cb27251
fix(device-auth): ignore expired pending requests
iscekic
committed
7aec9c3
merge: integrate origin main
iscekic
committed
4898e2b
Merge remote-tracking branch 'origin/main' into audit-w2b-device-auth-8c25
iscekic
committed
2b4c1f4
fix(github): return delete query row count
iscekic
committed
890d4c9
fix(db): regenerate device auth migrations
iscekic
committed
59277f2
fix(auth): defer native sign-in analytics
iscekic
committed
0743de4
feat(mobile): support refreshable device auth
iscekic
committed
5119437
feat(github): return installations to mobile
iscekic
committed
4dc8c0b
test(mobile): remove superseded auth tests
iscekic
committed
a933531
feat(auth): verify native identity proofs
iscekic
committed
1767ce8
feat(auth): add native admission checks
iscekic
committed
bb4b1db
feat(mobile): attach native admission
iscekic
committed
e2e7eb5
test(auth): prove token verifier compatibility
iscekic
committed
dbe0c06
test(web): accept device session claims
iscekic
committed
0e65c7a
chore(format): normalize admission files
iscekic
committed
e75f7b8
test(auth): fix admission test types
iscekic
committed
669c095
fix(types): satisfy strict type checks
iscekic
committed
8901546
refactor(mobile): satisfy lint rules
iscekic
committed
1a0ad5d
test(cron): cover admission cleanup counts
iscekic
committed
1fee94d
fix(auth): restore failed device auth issuance
iscekic
committed
eabe9a4
chore(format): normalize cleanup test
iscekic
committed
d2fd68b
fix(mobile): repair auth type checks
iscekic
committed
8532306

Commits on Aug 5, 2026

fix(dev): target tmux pane breaks by session
iscekic
committed
20c79c0
fix(github): redact callback state telemetry
iscekic
committed
67926df
fix(auth): atomically advance admission counters
iscekic
committed
cef3b99
fix(auth): preserve refresh rotation recovery
iscekic
committed
072fe19
fix(github): repair mobile install outcomes
iscekic
committed
c01a948
fix(sentry): redact callback state requests
iscekic
committed
57de70b
fix(auth): target Play Integrity package
iscekic
committed
ef00495
fix(auth): validate Apple attestation chains
iscekic
committed
9cfbae3
test(auth): cover refresh revoke races
iscekic
committed
8a3bb39
fix(sentry): redact install state telemetry
iscekic
committed
7747d91
fix(auth): use configured Apple audience
iscekic
committed
82eda2c
fix(github): scope webhook mutations by app
iscekic
committed
1914ca5
fix(github): scope lifecycle mutations by installation
iscekic
committed
cd68a18
chore: retrigger review
iscekic
committed
cf8df99
fix(mobile): remove unused auth type exports
iscekic
committed
86dfd2d
test(services): update worker auth mocks
iscekic
committed
74bbfac
fix(auth): resolve Kilobot findings
iscekic
committed
da44fa5
fix(auth): reject blocked users in KiloClaw, allow members to mint install state
iscekic
committed
bc1e291
refactor(auth): parse App Attest with libraries instead of hand-rolled decoders
iscekic
committed
2892037
feat(auth): implement native admission with @expo/app-integrity
iscekic
committed
0678890
Merge remote-tracking branch 'origin/main' into audit-w2b-device-auth-8c25
iscekic
committed
7b14543
Merge remote-tracking branch 'origin/main' into audit-w2b-device-auth-8c25
iscekic
committed
a231ed8