rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(club-004): club recovery: recovery codes and device reassignment

Browse Source
This commit is contained in:
Deploy
2026-08-26 20:47:06 +02:00
parent 3ccbf9f450
commit 3aecd2bec0
16 changed files with 510 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
work/artifacts/CLUB-004/security.json Normal file
View File

@@ -0,0 +1,16 @@
{
"feature_id": "CLUB-004",
"agent": "security",
"stage": "security_gate",
"verdict": "APPROVED",
"security_check": "security",
"summary": "Códigos hasheados con SHA-256, plaintext nunca persiste en DB. Race condition mitigada con FOR UPDATE.",
"checks": {
"storage": "OK: code_hash = SHA-256(plaintext), code_fingerprint = truncated hash",
"race_condition": "OK: consumeRecoveryCode usa FOR UPDATE + COMMIT en la misma transacción",
"expiry": "OK: códigos caducan a los 30 días",
"single_use": "OK: used_at se marca tras consumo exitoso",
"token_storage": "OK: device token hasheado igual que en DEVICE flow"
},
"timestamp": "2026-08-26T20:48:10Z"
}