Repository navigation

promote: reviewed IAM recovery slice - #44

Merged

BeforeLights merged 102 commits into

mainfrom

dev

Aug 4, 2026

Merged

promote: reviewed IAM recovery slice#44
BeforeLights merged 102 commits into
mainfrom
dev

Commits on Aug 3, 2026
- feat(iam): define hashed invitation token invariants
  BeforeLights
  committed
  c35f62d
- feat(iam): publish invitation invariants in domain aggregate
  BeforeLights
  committed
  92b18ed
- feat(iam): add invitation issue and redemption service
  BeforeLights
  committed
  46b6939
- feat(iam): add scoped invitation repository adapter
  BeforeLights
  committed
  9f14db2
- feat(iam): persist invitation token records
  BeforeLights
  committed
  2a65756
- docs(iam): record invitation token evidence
  BeforeLights
  committed
  5ce9fe3
- feat(iam): add keyed invitation crypto adapters
  BeforeLights
  committed
  bf311ec
- feat(iam): expose invitation HTTP composition
  BeforeLights
  committed
  ab4d22c
- feat(iam): add durable principal email lookup
  BeforeLights
  committed
  003f7c9
- feat(iam): add atomic account registration service
  BeforeLights
  committed
  b7701a7
- feat(iam): persist account registration atomically
  BeforeLights
  committed
  a6a6168
- fix(repo): normalize invitation formatting
  BeforeLights
  committed
  4fd6236
- feat(iam): expose account registration endpoint
  BeforeLights
  committed
  a8ec43e
- feat(iam): add bounded recovery challenge invariants
  BeforeLights
  committed
  26dd0ee
- feat(iam): add recovery service and transactional state effects
  BeforeLights
  committed
  371ccdf
- feat(iam): persist recovery security state atomically
  BeforeLights
  committed
  857aa05
- feat(iam): expose account recovery endpoints
  BeforeLights
  committed
  66abc06
- feat(iam): clear recovery gate after MFA verification
  BeforeLights
  committed
  20888ec
- feat(iam): propagate MFA recovery re-enrollment state
  BeforeLights
  committed
  c7faf68
- fix(iam): compare and set recovery challenge revisions
  BeforeLights
  committed
  42bb322
- feat(iam): add bounded recovery admission
  BeforeLights
  committed
  1269428
- fix(iam): avoid password hashing for invalid recovery tokens
  BeforeLights
  committed
  33882d9
- feat(iam): enforce recovery mfa gate on approvals
  BeforeLights
  committed
  c6b7228
- feat(iam): guard high-risk step-up during mfa reenrollment
  BeforeLights
  committed
  94b8766
- feat(iam): add shared recovery admission adapter
  BeforeLights
  committed
  e60170f
- feat(iam): compose shared recovery admission
  BeforeLights
  committed
  8f0a7c2
- feat(iam): bind recovery admission to redis eval
  BeforeLights
  committed
  32d8687
- feat(iam): provide context-aware mfa step-up
  BeforeLights
  committed
  20b592e
- feat(iam): bound recovery completion attempts
  BeforeLights
  committed
  1302f88
- feat(iam): separate recovery completion admission
  BeforeLights
  committed
  fe8380d
- fix(repo): align iam mocks with async lint contract
  BeforeLights
  committed
  fee9579
- Merge pull request #43 from DatabreezeService/feat/iam-recovery
  BeforeLights
  authored
  65afa44
- feat(iam): define service account identity contract
  BeforeLights
  committed
  265923b
- feat(iam): scope service account permissions
  BeforeLights
  committed
  9c238e8
- feat(iam): add service account repository port
  BeforeLights
  committed
  1db0186
- feat(iam): authorize service account lifecycle
  BeforeLights
  committed
  4a23c05
- feat(iam): generate one-time service account secrets
  BeforeLights
  committed
  9ebad8f
- feat(iam): persist service account records
  BeforeLights
  committed
  87530e7
- feat(iam): add service account prisma adapter
  BeforeLights
  committed
  73b4d99
- feat(iam): expose service account lifecycle api
  BeforeLights
  committed
  e32ea58
- feat(iam): resolve service accounts by secret digest
  BeforeLights
  committed
  7bf5ba0
- feat(iam): authenticate service account credentials
  BeforeLights
  committed
  d02aa7e
- feat(audit): register service account lifecycle actions
  BeforeLights
  committed
  03ef9db
- feat(iam): publish service account api contract
  BeforeLights
  committed
  528f0c9
- feat(audit): add signed seal attestations
  BeforeLights
  committed
  f015b11
- feat(bua): issue bounded entitlement leases
  BeforeLights
  committed
  34b79bc
- feat(bua): persist offline entitlement leases
  BeforeLights
  committed
  796a681
- feat(bua): persist entitlement lease schema
  BeforeLights
  committed
  52d1607
- feat(bua): add entitlement lease repository
  BeforeLights
  committed
  4d057e4
- feat(bua): issue and verify entitlement leases
  BeforeLights
  committed
  5c25a81
- feat(bua): expose entitlement lease api
  BeforeLights
  committed
  ecfbb25
- feat(bua): add provider-neutral lease signing
  BeforeLights
  committed
  89f7bfb
- fix(bua): bind lease acceptance to canonical payload
  BeforeLights
  committed
  82b0e22
- feat(audit): define seal attestation repository port
  BeforeLights
  committed
  ea59eb1
- feat(audit): add in-memory seal attestations
  BeforeLights
  committed
  3705546
- feat(audit): persist seal attestation schema
  BeforeLights
  committed
  304eecf
- feat(audit): add Prisma seal attestation adapter
  BeforeLights
  committed
  2834320
- feat(audit): issue and verify seal attestations
  BeforeLights
  committed
  fb9d5c2
- feat(audit): compose attestation providers
  BeforeLights
  committed
  4b40c9b
- feat(audit): expose attestation api
  BeforeLights
  committed
  a100a75
- fix(bua): validate entitlement snapshot plans
  BeforeLights
  committed
  cb0dd27
- feat(bua): compose HMAC lease signing
  BeforeLights
  committed
  e4ad354
- docs(traceability): record IAM AUD BUA security slice
  BeforeLights
  committed
  d9a8386
- fix(traceability): keep audit ownership precise
  BeforeLights
  committed
  c9ebd1f
- chore: format IAM and entitlement security slice
  BeforeLights
  committed
  99141b9
- fix(iam): satisfy service account lint guard
  BeforeLights
  committed
  c2442ad
- test(api): track security migration and route contracts
  BeforeLights
  committed
  20ceddd
- fix(deps): pin patched fast-uri release
  BeforeLights
  committed
  df4d0a2
- Merge pull request #45 from DatabreezeService/feat/iam-security-completion
  BeforeLights
  authored
  b32584d
Commits on Aug 4, 2026
- fix(iam): persist recovery challenges before delivery
  BeforeLights
  committed
  597dc5d
- fix(iam): compose service accounts from derived repository
  BeforeLights
  committed
  eb2d3c9
- fix(iam): enforce strong digest keys
  BeforeLights
  committed
  bfdcd5d
- fix(iam): reject recovery for inactive users
  BeforeLights
  committed
  8860135
- fix(iam): guard service-account replacement scope
  BeforeLights
  committed
  ea70d9f
- fix(iam): persist invitations before delivery
  BeforeLights
  committed
  2946e92
- fix(iam): map invitation invariant conflicts
  BeforeLights
  committed
  75af992
- fix(iam): enforce one active invitation per membership
  BeforeLights
  committed
  7910db8
- fix(iam): validate service-account permissions before issuance
  BeforeLights
  committed
  a723292
- fix(bua): use server time for lease verification
  BeforeLights
  committed
  b54f0b4
- fix(iam): make MFA reenrollment state explicit
  BeforeLights
  committed
  716229a
- fix(security): fail closed on signer errors and MFA clear
  BeforeLights
  committed
  03a2101
- fix(api): preserve integer and UTC timestamp contracts
  BeforeLights
  committed
  c6c5cee
- fix(bua): compare immutable leases by fields
  BeforeLights
  committed
  c4a08a2
- fix(aud): use targeted scoped seal lookups
  BeforeLights
  committed
  418b56a
- fix(aud): return typed attestation replays
  BeforeLights
  committed
  3f1c4e9
- fix(iam): make registration outcomes indistinguishable
  BeforeLights
  committed
  05149f6
- fix(iam): throttle registration before password hashing
  BeforeLights
  committed
  c61bb1c
- fix(iam): honor service-account create idempotency
  BeforeLights
  committed
  fa15e4b
- test(iam): exercise registration transaction rollback
  BeforeLights
  committed
  40af06b
- test(prisma): fix migration assertion escaping
  BeforeLights
  committed
  397087b
- docs(iam): refresh invitation slice checkpoint
  BeforeLights
  committed
  5f1bc30
- test(iam): verify registration admission composition
  BeforeLights
  committed
  8b48661
- test(iam): prove registration rollback after staged write
  BeforeLights
  committed
  108cc0a
- fix(iam): distinguish revoked invitation tokens
  BeforeLights
  committed
  000554c
- docs(iam): refresh registration slice evidence
  BeforeLights
  committed
  417885e
- test(iam): fail closed on unreadable account replay
  BeforeLights
  committed
  6231dfd
- test(iam): verify registration admission digest boundaries
  BeforeLights
  committed
  e1ff67f
- test(iam): cover replay envelope bounds
  BeforeLights
  committed
  277e699
- test(iam): correct registration timestamp assertions
  BeforeLights
  committed
  0bdd655
- test(iam): preserve service-account create replay
  BeforeLights
  committed
  ba41a8b
- test(iam): keep admission fixtures lint-clean
  BeforeLights
  committed
  e957e43
- Merge pull request #47 from DatabreezeService/fix/coderabbit-iam-critical-20260804
  BeforeLights
  authored
  2a49f79

Commits

Commits on Aug 3, 2026

Commits on Aug 4, 2026