3 Commits

Author	SHA1	Message	Date
keyhan	8163665c86	fix(platform): close remaining audit findings from security review ... Harden preview/deploy flows, OTP generation, zip extraction, and multi-replica billing races; document full remediation status in AUDIT-STATUS.fa.md. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-03 12:30:22 +03:30
keyhan	fc3d0a7e04	feat(auth): add MizbanSMS OTP provider with per-flow messages and signup recovery ... - Add MizbanSMS as selectable SMS provider (SMS_PROVIDER), keep Kavenegar - Distinct OTP wording per flow via OtpMessageKind (register/login/change-phone) - register() resumes an unverified account instead of blocking re-registration - Hourly cleanup of abandoned unverified accounts (>24h) + expired OTP codes Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-17 17:44:58 +03:30
keyhan	37c103fa20	feat(auth): mobile-only register/login with OTP verification ... - Register and login by mobile number; email is now an optional contact field only (never used to authenticate) - After registration, the phone is verified via a 6-digit SMS code - Login supports both password and one-time-code (OTP) methods - Phone OTP delivered via Kavenegar (verify/lookup); API key in env - Account page: edit name/optional email, change password, and change mobile number with OTP re-verification - Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited - Seed gives the admin a verified phone so mobile login still works Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-16 16:40:08 +03:30