feat(login): answer unknown identifiers with decoy pre-auth tokens - #257

Merged

Bccorb merged 6 commits into

mainfrom

feat/login-decoy-pre-auth-tokens

Sep 4, 2026

Commits on Sep 4, 2026

feat(login): answer unknown identifiers with decoy pre-auth tokens
Brandon Corbett
committed
6c6acc3
fix(login): derive a decoy's account shape so a narrow method list proves nothing
Brandon Corbett
committed
8fa2b4a
fix(login): answer a phoneless decoy the way a phoneless account is answered
Brandon Corbett
committed
9668935
fix(login): reproduce the magic link rejections a caller can trigger on purpose
Brandon Corbett
committed
573543f
fix(webauthn): reproduce the refusals the decoy responders were skipping
Brandon Corbett
committed
1b26e73
docs(login): say what a decoy does not write, rather than that it writes nothing
Brandon Corbett
committed
65644d9