Separate second-factor verification and delivery from authentication #41

2026-09-12T18:36:56Z

tech commented

2026-09-12 18:36:56 +00:00

Login verification previously mixed OTP issuance, delivery and consumption with authentication. This change introduces a dedicated product/twofactor domain service that reuses the existing Sendico-derived token engine. Auth now creates a session through an atomic completion callback after verification and single-use proof consumption; a failed session write leaves the code retryable. Signup activation stays separate.

The service owns verified email enrollment, preferred-factor selection, challenge snapshots, expiry, attempts and delivery limits. Preference changes require a code at the current factor and invalidate older proofs. Notifications remain a delivery adapter. The Flutter adapter now binds the server challenge ID to its pending credential and preserves resend retries.

Validation passed: make test (all Go race suites and frontend suites), make lint-backend, flutter analyze in sxchnge_auth, and Dart format checks. Real Mongo tests cover scope isolation, proof replay, attempt persistence, rollback, concurrent completion and verified preferences. Architecture and transport tests protect the boundary.

Deploy backend and Flutter together, load the twofactor.code revision 1 template, and restart old pending logins. Email is the implemented channel; settings UI integration, other channels, recovery/removal, payout wiring and a separate process are outside this change. Lost responses after successful commit still require recovery. No live emails were sent.

Source reuse, API contracts and rollout details: docs/architecture/two-factor.md. Closes #40.

Login verification previously mixed OTP issuance, delivery and consumption with authentication. This change introduces a dedicated product/twofactor domain service that reuses the existing Sendico-derived token engine. Auth now creates a session through an atomic completion callback after verification and single-use proof consumption; a failed session write leaves the code retryable. Signup activation stays separate. The service owns verified email enrollment, preferred-factor selection, challenge snapshots, expiry, attempts and delivery limits. Preference changes require a code at the current factor and invalidate older proofs. Notifications remain a delivery adapter. The Flutter adapter now binds the server challenge ID to its pending credential and preserves resend retries. Validation passed: make test (all Go race suites and frontend suites), make lint-backend, flutter analyze in sxchnge_auth, and Dart format checks. Real Mongo tests cover scope isolation, proof replay, attempt persistence, rollback, concurrent completion and verified preferences. Architecture and transport tests protect the boundary. Deploy backend and Flutter together, load the twofactor.code revision 1 template, and restart old pending logins. Email is the implemented channel; settings UI integration, other channels, recovery/removal, payout wiring and a separate process are outside this change. Lost responses after successful commit still require recovery. No live emails were sent. Source reuse, API contracts and rollout details: docs/architecture/two-factor.md. Closes #40.

tech added the backend frontend labels 2026-09-12 18:36:56 +00:00

tech added 1 commit 2026-09-12 18:36:56 +00:00

Separate second-factor verification and delivery from auth (#40 ) ecb63b61c6

tech added 1 commit 2026-09-12 18:37:13 +00:00

Record second-factor service delivery PR (#40 ) fc33630a0a

tech referenced this pull request

2026-09-12 18:37:33 +00:00

Isolate second-factor challenges and verified delivery preferences #40

tech merged commit 8e2ef7aa88 into main

2026-09-12 18:38:01 +00:00

tech deleted branch twofactor-40

2026-09-12 18:38:01 +00:00