Danijel Martinek 2747feab46 fix(auth): stop leaking usernames via emailDomain span attribute ...

getUserByUsername emitted the FULL username as the emailDomain span
attribute whenever the username contained no "@" (audit finding B6),
violating the PII-free telemetry rule (ADR-017 §7). Emit only a boolean
hasAtSign in both the production repository and its mock; regression
tests pin that no username-derived string reaches span attributes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 17:22:00 +02:00

..

__contracts__

fix: drop .js extensions from remaining relative imports

2026-05-26 12:04:44 +02:00

__factories__

fix: drop .js extensions from remaining relative imports

2026-05-26 12:04:44 +02:00

__seeds__

fix: drop .js extensions from remaining relative imports

2026-05-26 12:04:44 +02:00

application

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00

di

fix(di): drop .js extensions from bind-dev-seed imports

2026-05-26 11:45:37 +02:00

entities

test(auth): add cookie schema test

2026-05-21 11:25:42 +02:00

events

refactor: remove core-events from main (scaffoldable via gen core-package events)

2026-05-09 14:00:35 +02:00

infrastructure

fix(auth): stop leaking usernames via emailDomain span attribute

2026-07-10 17:22:00 +02:00

integrations

fix(auth): add username + passwordHash fields to users collection

2026-07-10 17:21:16 +02:00

interface-adapters/controllers

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00

ui

chore(fallow): make the whole-codebase gate pass without hiding signal

2026-07-10 16:53:16 +02:00

config.ts

feat(auth): add User, Cookie, Session entities + errors + config

2026-05-05 00:38:49 +02:00

feature.manifest.ts

fix(auth): declare userSignedUpEvent in signUp manifest publishes

2026-05-21 11:25:35 +02:00

index.ts

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00