Highlights
sm-mfa-plugin 0.1.1 fixes a settings bug that could turn off two-factor sign-in for everyone, and adds a full unit test suite.
Fixed
- Saving the two-factor settings form without touching the method or group lists no longer makes every method unavailable. An empty list now falls back to the configuration, like an unset one, so TOTP setup no longer answers 403 after the form is saved.
Added
- Unit tests for every second-factor decision: TOTP, QR codes, recovery and email codes, challenges and the failure cap, trusted devices, revocation, settings, admin reset, tokens at rest, WebAuthn and passkeys.
- A login-path invariant test that fails when a new place starts issuing sign-in tokens without going through the two-factor gate.
- Byte-for-byte checks of the error bodies against the PHP plugin, and a map of the PHP security tests to their Go counterparts.
The two-factor modes are disabled, optional and enforced.