Lemon-miaow d1ec40f738 fix(users): an admin email edit must clear the stale verification ...

UpdateUser wrote a new address but kept email_verified, so patching a verified
account asserted a proof of an address nobody had proven — and the
pre-session login mails and resolves on exactly that flag, so a typo'd edit
could hand the account's sign-in codes to the wrong mailbox.

Changing the address now clears the flag in the same write; a no-op patch that
passes the same value keeps it. The fake mirrors the semantics, and the pgint
suite pins both halves (same value keeps proof, new value drops it).

2026-09-23 03:19:55 +08:00

..

api_test.go

fix(users): an admin email edit must clear the stale verification

2026-09-23 03:19:55 +08:00

api.go

feat(build): make the user-modpack build lane read its context (closes the last functional gap)

2026-09-22 22:45:09 +08:00

auth.go

feat(api): let in-game staff manage any server without claiming it

2026-07-20 11:10:23 +09:00

backuper_wire_test.go

feat(api): add on-demand world backup endpoint and Job executor (§B4 Sync)

2026-07-07 10:04:30 +09:00

backuper.go

feat(api): add on-demand world backup endpoint and Job executor (§B4 Sync)

2026-07-07 10:04:30 +09:00

cluster.go

fix(api): implement /readyz with real DB + K8s API + CRD checks (§7)

2026-07-05 16:22:08 +08:00

console.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

errors.go

fix(auth): enforce the verified-email uniqueness that email login assumes

2026-09-23 03:19:35 +08:00

handlers_access_test.go

feat(panel): player management

2026-07-02 03:30:50 +08:00

handlers_access.go

chore: drop tool-name markers from source comments

2026-09-22 12:57:19 +09:00

handlers_account_migrate_test.go

feat(account): migrate a live account's owned servers to a new account (§B3 inherit)

2026-07-05 20:50:48 +09:00

handlers_account_migrate.go

feat(account): migrate a live account's owned servers to a new account (§B3 inherit)

2026-07-05 20:50:48 +09:00

handlers_account_test.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_account.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_auth_email_test.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_auth_email.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_auth_options_test.go

feat(auth): migrate console login to passwordless

2026-07-04 21:47:12 +09:00

handlers_auth_options.go

feat(auth): migrate console login to passwordless

2026-07-04 21:47:12 +09:00

handlers_auth.go

feat(auth): migrate console login to passwordless

2026-07-04 21:47:12 +09:00

handlers_backup_now_test.go

feat(breakglass): add "back up a world now" console peer (§B4 Sync)

2026-07-07 19:32:13 +09:00

handlers_backups_test.go

test(api): pin restore's owner gate against a superseded former owner

2026-07-08 05:58:00 +09:00

handlers_backups.go

feat(breakglass): add "back up a world now" console peer (§B4 Sync)

2026-07-07 19:32:13 +09:00

handlers_console_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

handlers_console.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

handlers_create_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

handlers_email_otp_test.go

fix(auth): enforce the verified-email uniqueness that email login assumes

2026-09-23 03:19:35 +08:00

handlers_email_otp.go

fix(auth): enforce the verified-email uniqueness that email login assumes

2026-09-23 03:19:35 +08:00

handlers_files_test.go

feat(files): add the server file editor

2026-07-20 14:33:29 +09:00

handlers_files.go

feat(files): add the server file editor

2026-07-20 14:33:29 +09:00

handlers_hasjoined_test.go

fix(nano): stop trusting an expired free name while mojang is failing

2026-09-22 14:17:53 +09:00

handlers_hasjoined.go

fix(nano): stop trusting an expired free name while mojang is failing

2026-09-22 14:17:53 +09:00

handlers_internal_menu_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

handlers_internal_wake_test.go

feat(api): let in-game staff manage any server without claiming it

2026-07-20 11:10:23 +09:00

handlers_internal.go

fix: keep internal section numbers out of runtime messages

2026-09-22 13:44:38 +09:00

handlers_logstream_test.go

feat(auth): migrate console login to passwordless

2026-07-04 21:47:12 +09:00

handlers_logstream.go

fix(api): cap concurrent SSE streams per principal

2026-07-01 22:04:19 +09:00

handlers_onboard_test.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_onboard.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_op_login_test.go

feat(api): let in-game staff manage any server without claiming it

2026-07-20 11:10:23 +09:00

handlers_op_login.go

feat(api): let in-game staff manage any server without claiming it

2026-07-20 11:10:23 +09:00

handlers_passkey_discoverable_test.go

feat(passkey): advance sign_count, reject clone-warned assertions

2026-07-05 16:02:30 +09:00

handlers_passkey_discoverable.go

feat(passkey): advance sign_count, reject clone-warned assertions

2026-07-05 16:02:30 +09:00

handlers_passkey_login_test.go

fix(passkey): serve flat WebAuthn options to register and username login

2026-07-16 13:26:56 +09:00

handlers_passkey_test.go

fix(passkey): serve flat WebAuthn options to register and username login

2026-07-16 13:26:56 +09:00

handlers_passkey.go

fix(passkey): serve flat WebAuthn options to register and username login

2026-07-16 13:26:56 +09:00

handlers_patch_test.go

feat(api): enforce CPU/memory/storage quotas (spec §9.3, §22)

2026-07-05 02:05:44 +08:00

handlers_player_reclaim_test.go

feat(auth): migrate console login to passwordless

2026-07-04 21:47:12 +09:00

handlers_player_reclaim.go

docs(auth): cite MultiLogin reference for UUID-keyed reclaim split

2026-07-05 04:05:56 +09:00

handlers_qr_login_test.go

feat(auth)!: go fully passwordless and fix cross-check review findings

2026-07-20 04:47:32 +09:00

handlers_setup_lockdown_test.go

fix(setup): stop the forced-onboarding gate trapping players who have no email

2026-07-22 14:40:28 +09:00

handlers_setup_test.go

test: use placeholder domains in setup and system-server tests

2026-09-22 12:43:54 +09:00

handlers_setup.go

fix(setup): stop the forced-onboarding gate trapping players who have no email

2026-07-22 14:40:28 +09:00

handlers_updates_shape_test.go

fix(updates): tag Window JSON so the persisted maintenance window round-trips

2026-07-01 18:26:42 +09:00

handlers_updates_test.go

feat(api): add admin API for the SysAdmin-set auto-update maintenance window

2026-07-01 18:17:07 +09:00

handlers_updates.go

feat(api): add admin API for the SysAdmin-set auto-update maintenance window

2026-07-01 18:17:07 +09:00

handlers_user.go

chore: gofmt the tree, clear staticcheck, add a CI gofmt gate

2026-09-22 17:49:54 +08:00

handlers_users.go

chore: apply the missed S1016 conversions in handlers_users

2026-09-22 17:57:03 +08:00

images_logs_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

images_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

images.go

fix(api): cap concurrent SSE streams per principal

2026-07-01 22:04:19 +09:00

jobstatus_test.go

feat(api): expose async backup/restore job status (fixes #7)

2026-09-22 20:36:36 +08:00

jobstatus.go

feat(api): expose async backup/restore job status (fixes #7)

2026-09-22 20:36:36 +08:00

k8scluster_test.go

feat(rcon): provision per-server RCON so the console, player list and permissions work

2026-07-21 00:12:37 +09:00

k8scluster.go

feat(rcon): provision per-server RCON so the console, player list and permissions work

2026-07-21 00:12:37 +09:00

k8sjobstatus.go

feat(api): expose async backup/restore job status (fixes #7)

2026-09-22 20:36:36 +08:00

logstream.go

fix(api): clear the SSE write deadline on return so it can't leak to a reused connection

2026-07-01 23:06:26 +09:00

main_test.go

test(api): keep the package's tests off the live mojang profile api

2026-09-22 13:31:53 +09:00

middleware_test.go

fix(api): validate inbound X-Request-Id before echo and audit persist

2026-07-01 21:07:08 +09:00

middleware.go

fix(api): a session-store outage answers 503, not 401

2026-09-22 20:30:43 +08:00

openapi_test.go

feat(panel): implement user management administration panel with sessions and minecraft link support

2026-07-04 04:08:14 +08:00

pgrepo.go

fix(users): an admin email edit must clear the stale verification

2026-09-23 03:19:55 +08:00

repo.go

fix(auth): enforce the verified-email uniqueness that email login assumes

2026-09-23 03:19:35 +08:00

restore_wire_test.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

restorer.go

feat(api): add felis-api service with permissions, modpack lane, and fleet read

2026-06-26 23:32:38 +09:00

session.go

fix(api): a session-store outage answers 503, not 401

2026-09-22 20:30:43 +08:00

submissions_test.go

feat(build): make the user-modpack build lane read its context (closes the last functional gap)

2026-09-22 22:45:09 +08:00

submissions.go

feat(build): make the user-modpack build lane read its context (closes the last functional gap)

2026-09-22 22:45:09 +08:00

util.go

refactor(api): drop dead login concurrency limiter and reconcile passwordless comments

2026-07-04 21:47:12 +09:00