audit login flow end-to-end #228

New issue

Closed

opened 2026-04-08 02:35:57 +00:00 by barrettruth · 1 comment

barrettruth commented

2026-04-08 02:35:57 +00:00

Revisit the login flow after the current settings and reminders cleanup and do a full end-to-end UX pass.

Check the main path from login through post-auth redirect, plus OAuth provider errors, passkey/WebAuthn RP ID and origin handling, 2FA verification, recovery, logout/re-entry, and the onboarding handoff for a fresh session.

This should include the redirect-uri class of failures seen during the Forgejo/VPS migration.

Revisit the login flow after the current settings and reminders cleanup and do a full end-to-end UX pass. Check the main path from login through post-auth redirect, plus OAuth provider errors, passkey/WebAuthn RP ID and origin handling, 2FA verification, recovery, logout/re-entry, and the onboarding handoff for a fresh session. This should include the redirect-uri class of failures seen during the Forgejo/VPS migration.

barrettruth added the

track:core

type:cleanup

labels

2026-05-10 20:16:28 +00:00

barrettruth added this to the v0.1.0 milestone

2026-05-10 20:16:28 +00:00

barrettruth referenced this issue

2026-05-11 15:54:42 +00:00

scope: retire login flow for self-hosted mode #287

barrettruth commented

2026-05-11 15:56:07 +00:00

Owner

Change of plan: the full login/auth flow is being retired for a simpler self-hosted mode. Tracker #287 owns the shutdown work, so this audit should close with that PR instead of continuing the OAuth/WebAuthn/TOTP flow.

barrettruth referenced this issue from a pull request that will close it,

2026-05-11 18:17:32 +00:00

Retire login flow #289

barrettruth closed this issue

2026-05-11 18:22:59 +00:00

barrettruth referenced this issue from a commit

2026-05-11 18:23:00 +00:00

Retire login flow (#289)