tegwick 11ce29af8b Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033). ... Authelia 4.38 refuses prompt=login for every real login because it registers the authorization request after authentication. Send a bounded max_age upstream and check the verified upstream auth_time against prompt=login / max_age in the callback, failing closed when auth_time is missing. Also update the service-client example count left stale by 651625c/1620ce2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 352750@bnt-lap001 Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b		2026-09-23 21:59:21 +02:00
..
assurance.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
assurance_test.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
auth.go	Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).	2026-09-23 21:59:21 +02:00
conformance_test.go	Reconcile the canonical model and discovery with the runtime	2026-09-07 00:22:49 +02:00
mfa.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
model.go	Support opt-in MFA per browser client with authoritative enrollment checks	2026-09-13 00:27:28 +02:00
repository.go	Make the LLDAP export report its own completeness	2026-09-07 08:45:50 +02:00