7 Commits

Include renames

Author	SHA1	Message	Date
Dan MilneandClaude Opus 4.7	cc93f72f0a	Notify users out-of-band when security settings change ... Previously only TOTP-enabled triggered an email. Every other security-relevant change — password change, TOTP disable, passkey add/remove, API key create/revoke, email address change, backup-code regeneration — happened silently, so an attacker on a stolen session could quietly drop 2FA or hijack the email with no signal to the account holder. Add SecurityMailer with one method per event. Each email carries the request IP, user-agent, and timestamp so the user can spot unfamiliar activity. Email-address changes notify both the old and new addresses with directional language; the old-address copy explicitly warns that whoever made the change can now receive password reset emails. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 23:52:12 +10:00
Dan MilneandClaude Opus 4.6	65c19fa732	Upgrade to Ruby 4.0.1, bump version to 0.9.0 ... Replace CGI.parse (removed in Ruby 4.0) with Rack::Utils.parse_query in application controller, sessions controller, and OIDC tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 21:52:11 +11:00
Dan Milne	46ae65f4d2	Move the 'remove_query_param' to the application controller	2026-01-05 13:03:03 +11:00
Dan Milne	93a0edb0a2	StandardRB fixes	2026-01-01 13:29:44 +11:00
Dan Milne	4df2eee4d9	Bug fix for domain names with empty string instead of null. Form errors and some security fixes	2025-11-09 12:22:41 +11:00
Dan Milne	56f7dd7b3c	First crack	2025-10-23 16:45:00 +11:00
Dan Milne	1ff0a95392	First commit	2025-10-23 16:19:56 +11:00