docs: trusted devices & MFA improvements #32

wtclaude · 2026-07-22T04:40:06Z

wtclaude commented

2026-07-22 04:40:06 +00:00

What & why

Documentation for the trusted-device + MFA-hardening feature (code PR: RunicGateway/website#93).

New website/TRUSTED_DEVICES_MFA.md — the approved design/implementation plan (scope, decisions, hashing rationale, schema, API, cap behavior, security, roadmap).
website/BACKEND_DESIGN.md — §3 adds the trusted_devices (sha256) + recovery_codes (bcrypt) tables; §4 documents login/totp trust+recovery, /auth/me/trusted-devices*, recovery-codes endpoints, and the admin trusted-device + /mfa/reset routes; §6 adds the trusted-device security model + audit actions.
android/PLAN.md — §4 notes the app-side trust-token (X-Trust-Token / EncryptedSharedPreferences) + recovery-code flow, sequenced after the backend lands.

Keeps docs/ in sync with the website change per the repo's docs-with-code rule.

How it was tested

Markdown only — proofread; endpoint/table/audit-action names cross-checked against the implementation in website#93.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing tests/checks pass locally.
I have added or updated tests/docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

AI tools were used. Tool(s): Claude Code (Opus 4.8). I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a Co-Authored-By trailer.

License

I agree that my contribution is licensed under this project's license (GNU GPL v3.0 or later), and I have the right to contribute it.

## What & why Documentation for the trusted-device + MFA-hardening feature (code PR: RunicGateway/website#93). - **New `website/TRUSTED_DEVICES_MFA.md`** — the approved design/implementation plan (scope, decisions, hashing rationale, schema, API, cap behavior, security, roadmap). - **`website/BACKEND_DESIGN.md`** — §3 adds the `trusted_devices` (sha256) + `recovery_codes` (bcrypt) tables; §4 documents login/totp trust+recovery, `/auth/me/trusted-devices*`, recovery-codes endpoints, and the admin trusted-device + `/mfa/reset` routes; §6 adds the trusted-device security model + audit actions. - **`android/PLAN.md`** — §4 notes the app-side trust-token (`X-Trust-Token` / EncryptedSharedPreferences) + recovery-code flow, sequenced after the backend lands. Keeps `docs/` in sync with the website change per the repo's docs-with-code rule. ## How it was tested Markdown only — proofread; endpoint/table/audit-action names cross-checked against the implementation in website#93. ## Checklist - [x] I have read [CONTRIBUTING.md](CONTRIBUTING.md). - [x] The change builds and existing tests/checks pass locally. - [x] I have added or updated tests/docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [x] AI tools were used. Tool(s): `Claude Code (Opus 4.8)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a `Co-Authored-By` trailer. ## License - [x] I agree that my contribution is licensed under this project's license (**GNU GPL v3.0 or later**), and I have the right to contribute it.

wtclaude added 1 commit 2026-07-22 04:40:08 +00:00

docs: trusted devices & MFA improvements (design + API/security/schema) 6e7da3acbe

Add TRUSTED_DEVICES_MFA.md (the approved design/implementation plan) and fold
the feature into BACKEND_DESIGN §3 (trusted_devices + recovery_codes schema),
§4 (login/totp trust+recovery, /auth/me/trusted-devices*, recovery-codes*,
admin trusted-device + /mfa/reset routes), and §6 (trusted-device security
model + audit actions). Note the app-side trust/recovery flow in android PLAN §4.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-22 04:50:42 +00:00

whitlocktech merged commit f495db572a into main

2026-07-22 04:50:50 +00:00

whitlocktech deleted branch docs/trusted-devices-mfa

2026-07-22 04:50:51 +00:00

whitlocktech referenced this issue from a commit

2026-07-22 04:50:52 +00:00

Merge pull request 'docs: trusted devices & MFA improvements' (#32) from docs/trusted-devices-mfa into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/docs#32