Lucas Berger c437f408bb feat(19-03): implement POST /api/auth/local/login (rate-limit + lockout) + logout ...

- Rate-limit: per-IP in-memory Map; 5 failures → 429, 10 → 423 (lockedOut)
- Counter increments even on 429 so brute-force accumulates toward lockout
- Timing-safe: DUMMY_HASH ensures verifyPassword runs for unknown usernames (T-19-12)
- noEchoHook: Zod errors never echo submitted values (T-19-14)
- Same 401 body for wrong-password and unknown-username (no enumeration)
- POST+GET /local/logout clear the local-session cookie

2026-06-17 16:49:59 -04:00

..

admin.ts

feat(19-02): admin create-member, reset-password, hasLocalCredential on GET /members

2026-06-17 16:31:37 -04:00

authMode.ts

feat(19-03): implement localAuthMiddleware, GET /api/auth/mode, and pre-auth route mounts

2026-06-17 16:48:17 -04:00

events.ts

fix(11-05): WR-02 add .max(10080) to reminderLeadMinutes in both Zod schemas

2026-06-14 08:22:13 -04:00

health.ts

…

lists.ts

…

localAuth.ts

feat(19-03): implement POST /api/auth/local/login (rate-limit + lockout) + logout

2026-06-17 16:49:59 -04:00

me.ts

feat(19-02): linkOidcToUser helper + POST /api/me/link-oidc initiation

2026-06-17 16:38:14 -04:00

push.ts

…

setup.ts

fix(12): satisfy CI fast-checks — lint unused vars, typed contract-test body, prettier

2026-06-16 16:53:14 -04:00

sse.ts

…