Repository navigation

feat!: log in by farm code, with per-account email identity (#532) - #564

Merged

mforce merged 23 commits into

mainfrom

mforce/auth-login-by-farm-code-per-account-email-identi

Aug 20, 2026

Commits on Aug 19, 2026
- feat(auth): account-scoped Identity indexes, validator and farm-code login (#532)
  mforce
  committed
  ee3f95e
- feat(web): farm code on the sign-in form
  mforce
  committed
  6a1055c
- chore(sim): send the farm code from the k6, Playwright and reset callers
  mforce
  committed
  7da5f97
- docs: farm code glossary, help page, i18n example and the record amendments
  mforce
  committed
  a1f058a
- fix(auth): close the cross-farm lockout bypass and scope the remaining user lookups
  mforce
  committed
  04a9a6f
- test(auth): pin the account-scoped Identity indexes against a migrated database
  mforce
  committed
  de68be1
- fix(sim): farm code on the two direct Playwright sign-ins, and dedupe the glossary
  mforce
  committed
  1f86150
- test(auth): pin the duplicate-email user to the requesting account, not the seed default
  mforce
  committed
  590edf2
- test(auth): assert the orphan insert fails on the foreign key, not on any constraint
  mforce
  committed
  8d8f125
Commits on Aug 20, 2026
- feat(auth): immediate farm suspension across login, refresh and every authenticated request
  mforce
  committed
  e3cbd8c
- fix(auth): compare raw values in the validator short-circuit, and guard what round two found unguarded
  mforce
  committed
  7287231
- test(auth): cover farm suspension end to end, and prove the identity-column guard
  mforce
  committed
  bf42c47
- fix(auth): pin the suspension guarantee, and stop reactivation signing out an active farm
  mforce
  committed
  ccc857f
- fix(auth): stop the SPA adopting another farm's session, and pin what round four only claimed to
  mforce
  committed
  0c7e9dd
- fix(#532): round 8 — one-shot guard, FK-dropping test, decode pin, guard exemption
  mforce
  committed
  b519d1b
- feat(auth): bind refresh to the account the tab expects (#547)
  mforce
  committed
  07d6ca7
- feat(auth): name the refresh cookie per farm, so two farms cannot collide
  mforce
  committed
  54b1e68
- fix(auth): restore the farm-scoped session safeguards the rename broke
  mforce
  committed
  a928557
- fix(auth): attribute every session action to the farm that owns it
  mforce
  committed
  b2429da
- fix(auth): scope legacy logout revocation to the farm that owns it
  mforce
  committed
  5f466df
- Merge remote-tracking branch 'origin/main' into mforce/auth-login-by-farm-code-per-account-email-identi
  mforce
  committed
  fd91e41
- test(otlp): send a farm code from the subprocess exporter's login probe
  mforce
  committed
  3e26386
- test(auth): probe the legacy token first, so the same-farm guard is real
  mforce
  committed
  7bfac85

Navigation Menu

Repository navigation

feat!: log in by farm code, with per-account email identity (#532) - #564

feat!: log in by farm code, with per-account email identity (#532)#564
mforce merged 23 commits into
mainfrom
mforce/auth-login-by-farm-code-per-account-email-identi

Commits on Aug 19, 2026

feat(auth): account-scoped Identity indexes, validator and farm-code login (#532)

feat(web): farm code on the sign-in form

chore(sim): send the farm code from the k6, Playwright and reset callers

docs: farm code glossary, help page, i18n example and the record amendments

fix(auth): close the cross-farm lockout bypass and scope the remaining user lookups

test(auth): pin the account-scoped Identity indexes against a migrated database

fix(sim): farm code on the two direct Playwright sign-ins, and dedupe the glossary

test(auth): pin the duplicate-email user to the requesting account, not the seed default

test(auth): assert the orphan insert fails on the foreign key, not on any constraint

Commits on Aug 20, 2026

feat(auth): immediate farm suspension across login, refresh and every authenticated request

fix(auth): compare raw values in the validator short-circuit, and guard what round two found unguarded

test(auth): cover farm suspension end to end, and prove the identity-column guard

fix(auth): pin the suspension guarantee, and stop reactivation signing out an active farm

fix(auth): stop the SPA adopting another farm's session, and pin what round four only claimed to

fix(#532): round 8 — one-shot guard, FK-dropping test, decode pin, guard exemption

feat(auth): bind refresh to the account the tab expects (#547)

feat(auth): name the refresh cookie per farm, so two farms cannot collide

fix(auth): restore the farm-scoped session safeguards the rename broke

fix(auth): attribute every session action to the farm that owns it

fix(auth): scope legacy logout revocation to the farm that owns it

Merge remote-tracking branch 'origin/main' into mforce/auth-login-by-farm-code-per-account-email-identi

test(otlp): send a farm code from the subprocess exporter's login probe

test(auth): probe the legacy token first, so the same-farm guard is real