Wanjohi 7c200ff092 fix(auth): bound sign-in code sends per mailbox and per caller ...

The send budget was keyed by every submitted form field, so adding a field
with a new value each time made a fresh budget, and one mailbox could be sent
codes without limit. A claim is now built only from the claim fields (email,
phone by default); anything else is dropped before it is counted and before
it reaches sendCode.

A budget per mailbox does nothing against a caller holding a list of
addresses: each send goes to a different stranger, and the deployment's
whole sending allowance goes with them. Add a second budget per requesting
address, 10 codes per 24 hours by default. The window is a day rather than an
hour because a caller that paces itself stays under any hourly figure a
person would also fit under.

The address lookup the device flow used is moved into util so both read the
caller the same way.

2026-11-05 12:17:39 +03:00

..

auth

fix(auth): bound sign-in code sends per mailbox and per caller

2026-11-05 12:17:39 +03:00

core

fix(rooms): a fleet room is found by the name clients show, and a box is named by its pinned card

2026-10-20 00:25:09 +03:00