| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2026-07-24 | Complete the login only after the second factor | erdgeist | |
| Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. | |||
