OXYGENHUB

Changes up to # fb8f35d025ab touching crates/hub/src/web/session.rs · 12

See as swimlanes (independent work side by side)

A phone as the second factor: Keystore keys approve sign-ins by the number the browser shows, and the sudo step asks a stale session again before sensitive changes (closes #356)
Andy McCall via agent:claude@andymccall agent ·
◈ a22e4aec2e28
A new hub gives administrator only to whoever brings its setup code
Andy McCall via Claude Code agent ·
✔ c8684d44d549
Sign up through an invitation with GitHub, GitLab or Google
Andy McCall via Claude Code agent ·
✔ 3ff52534f69b
Sessions are server-side records: random ids, expiry, listed and ended per browser
Andy McCall via Claude Code agent ·
✔ 0024ccb1b050
Sign-in, 2FA codes, device codes and reset requests slow guessing
Andy McCall via Claude Code agent ·
✔ aa0bfbd11f02
HTTPS only: nothing taken over plain http through a proxy
Andy McCall via Claude Code agent ·
✔ 9a8e3b4419e0
Sign in with GitLab, and branded sign-in buttons v0.5.1
Andy McCall via Claude Code agent ·
✔ 810896d41be7
Notifications that reach you, and 2FA without the password twice
Andy McCall ·
✔ bff9106edcba
Sign in with GitHub or Google
Andy McCall ·
✔ 83940d53664f
Admins disable, enable and delete accounts
Andy McCall ·
✔ 6a1780558353
Password reset and email verification: single-use hashed links, reset by verified email or an administrator's link, verification on every address change, notification mail only to verified addresses, and a file:// mail transport for development
Andy McCall ·
✔ 34beb1a7e376
Milestone 0.2: accounts and access
Andy McCall ·
✔ 19bb31ff1f5c