GrottoCenter / grottocenter-api / 26527336612

87%

develop: 87%

Build Type

Pull #1609

github

Committed by ClemRz

Commit Message

feat(auth): harden admin account security with TOTP MFA and brute-force protection

- Reduce admin token TTL to 10 days (non-admin remains 90 days)
- Add mandatory TOTP-based MFA with enrollment, verification, and reset endpoints
- Apply stricter rate limiting for admin login (5 req / 15 min / IP)
- Ban admin accounts after 5 consecutive failed logins or TOTP attempts
- Send email notifications on suspicious login activity and account ban
- Revoke all admin tokens on password change
- Update Swagger documentation with new MFA endpoints and login statuses

Pull Request Pull Request #1609: feat(auth): harden admin account security with TOTP MFA and brute-force protection

Coverage Stats

3397 of 4057 branches covered (83.73%)

Branch coverage included in aggregate %.

218 of 236 new or added lines in 10 files covered. (92.37%)

15 existing lines in 1 file now uncovered.

6807 of 7658 relevant lines covered (88.89%)

56.98 hits per line