tlmanz / authkit / 28718027776

63%

push

github

feat: remember-device (trusted device) for the mobile token flow

IssuePasswordToken accepts a trusted_device_token in the body and skips the TOTP
step when it is a live trust (cookie-free equivalent of the web trustedDevice
cookie). IssuePasswordToken2FA accepts remember=true, mints a trusted-device
token via the store, and returns it as trusted_device_token for the client to
store securely and present next login. Adds trustedDeviceTokenValid +
mintTrustedDeviceToken helpers; test covers skip + bogus-token rejection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

41 of 46 new or added lines in 2 files covered. (89.13%)

1494 of 2342 relevant lines covered (63.79%)

6.56 hits per line