Kyle Pope b2d81f7015 Block inactive user login + fix login flicker + inline error alerts ...

- Backend: reject is_active=False users with HTTP 403 after password
  verification but before session creation (prevents last_login_at
  update, lockout reset, and MFA token issuance for disabled accounts)
- Frontend: optimistic setQueryData on successful login eliminates the
  form flash between mutation success and auth query refetch
- LockScreen: replace lockoutMessage + toast.error with unified
  loginError inline alert for 401/403/423 responses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-28 01:21:06 +08:00

..

jobs

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00

models

Add user profile fields + IAM search, email column, detail panel

2026-02-27 22:40:20 +08:00

routers

Block inactive user login + fix login flicker + inline error alerts

2026-02-28 01:21:06 +08:00

schemas

Add user profile fields + IAM search, email column, detail panel

2026-02-27 22:40:20 +08:00

services

L-03: Session 7-day sliding window with 30-day hard ceiling

2026-02-27 15:45:15 +08:00

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

config.py

L-03: Session 7-day sliding window with 30-day hard ceiling

2026-02-27 15:45:15 +08:00

database.py

Fix code review findings: security hardening and frontend fixes

2026-02-16 07:49:21 +08:00

main.py

H-01: Add global CSRF middleware for all mutating endpoints

2026-02-27 15:39:42 +08:00