Fix 2026-10 auth audit findings AUTH-A1..A12.
AUTH-A1: tokens minted over REST record parent_token_id, are revoked with the parent, must expire no later than it; classic PATs and second-generation tokens cannot mint. AUTH-A2: stale unverified accounts expire (24h, cron + reclaim at signup/GitHub link); a reset on a never-verified row wipes TOTP, passkeys, recovery codes, signing keys and github_id. AUTH-A3: per-account login limiter key. AUTH-A4: PBKDF2 600k with rehash on sign-in/confirm. AUTH-A5: constant-work dummy verify for unknown logins. AUTH-A6/A7: admin bootstrap and closed-signup guard decided inside the insert transaction; SIGNUPS_ENABLED parsed as a boolean. AUTH-A8: MCP consent pending state in auth_tokens, consumed atomically. AUTH-A9: CIMD fetch resolve-guarded, forge host denied, JSON content-type required; stale DCR clients swept; consent page shows redirect host. AUTH-A10: HKDF per-purpose keys with AAD (v2 prefix), legacy decrypt + TOTP re-encrypt on read. AUTH-A11: GitHub redirect_uri from PUBLIC_URL with alias-host bounce. AUTH-A12: sessions in D1 with 14-day idle timeout, per-device list/revoke in Settings.
24 files changed+856−145
Rendering diff…