GrottoCenter / grottocenter-api / 26660435915

87%

Build Type

push

github

Committed by ClemRz

Commit Message

feat(auth): harden admin account security with TOTP MFA and brute-force protection

- Reduce admin token TTL to 10 days (non-admin remains 90 days)
- Add mandatory TOTP-based MFA with enrollment, verification, and reset endpoints
- Apply stricter rate limiting for admin login (5 req / 15 min / IP)
- Ban admin accounts after 5 consecutive failed logins or TOTP attempts
- Send email notifications on suspicious login activity and account ban
- Revoke all admin tokens on password change
- Update Swagger documentation with new MFA endpoints and login statuses

Coverage Stats

3514 of 4205 branches covered (83.57%)

Branch coverage included in aggregate %.

218 of 236 new or added lines in 10 files covered. (92.37%)

2 existing lines in 1 file now uncovered.

7039 of 7937 relevant lines covered (88.69%)

55.59 hits per line