kristianwindandClaude Opus 4.8 f62ffc8d92 feat(2fa): show a scannable QR code when enabling two-factor auth ...

The setup screen showed the secret and the otpauth URI as text and asked
you to scan — with nothing to scan. It renders the URI as a QR now, an SVG
(one dark path on a white card, so it reads in either theme) generated from
the barcode encoder already in the module graph via pquerna/otp. The secret
stays below it for a device that cannot scan.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-09-03 16:27:11 +02:00

..

audit_handlers.go

feat(admin): what has been done on this server, across every project

2026-08-18 09:04:12 +02:00

audit_test.go

feat(admin): what has been done on this server, across every project

2026-08-18 09:04:12 +02:00

auth_handlers.go

feat(security): a TOTP code can be used once

2026-08-23 23:34:34 +02:00

auth_test.go

feat(security): a TOTP code can be used once

2026-08-23 23:34:34 +02:00

backup_handlers.go

feat(admin): the nightly backup, made visible

2026-08-18 09:04:43 +02:00

backup_test.go

feat(admin): the nightly backup, made visible

2026-08-18 09:04:43 +02:00

beacon_handlers.go

feat(beacon): tæl installationer, sig præcis hvad der sendes, og lad folk sige nej

2026-08-20 06:59:50 +02:00

caldav_handlers.go

fix(sikkerhed): CalDAV lod en viewer skrive, og Web Push kunne ringe indad

2026-08-20 15:15:28 +02:00

calendar_handlers.go

feat(calendar): abonnement på flere kalendere, ICS og webcal

2026-08-20 21:26:13 +02:00

calendar_test.go

feat(calendar): en læst Google-kalender, med sit eget endpoint og sin egen sweep

2026-08-20 07:01:14 +02:00

comments_handlers.go

fix(sikkerhed): resten af gennemgangen — SSRF, tre ubegrænsede veje, og fire hemmeligheder

2026-08-20 08:39:52 +02:00

context.go

feat(phase2,phase4): comments, attachments, notifications, Web Push, import/export

2026-08-17 07:42:55 +02:00

csp_header_test.go

feat(security): trust a forwarded IP only from a proxy, and set COOP

2026-08-23 23:34:34 +02:00

csp.go

feat(web): SvelteKit PWA with the Nordic design system

2026-08-17 00:03:20 +02:00

errorcodes_test.go

fix: say the true thing when Gmail, AI or mail is not set up

2026-08-17 14:35:36 +02:00

errorlog_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

errors.go

feat(calendar): en læst Google-kalender, med sit eget endpoint og sin egen sweep

2026-08-20 07:01:14 +02:00

feeds_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

filters_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

gmail_handlers.go

feat(kvasir): én mail bliver til én opgave, uanset hvem der læser den

2026-08-22 09:19:41 +02:00

gmail_test.go

feat(calendar): en læst Google-kalender, med sit eget endpoint og sin egen sweep

2026-08-20 07:01:14 +02:00

import_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

integrations_handlers.go

fix(ai): din egen model kunne ikke sættes op — tre fejl i én oplevelse

2026-08-22 00:03:45 +02:00

integrations_test.go

fix(ai): din egen model kunne ikke sættes op — tre fejl i én oplevelse

2026-08-22 00:03:45 +02:00

mailbox_handlers.go

feat(kvasir): én mail bliver til én opgave, uanset hvem der læser den

2026-08-22 09:19:41 +02:00

mcp_handlers.go

feat(notes): titlen er første linje, og # foreslår projektet

2026-08-19 18:36:31 +02:00

middleware.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

notes_handlers.go

fix(notes): export the notes in a stable order

2026-08-24 12:39:11 +02:00

notes_import_filter_test.go

fix(notes): en note med tre prikker i titlen blev smidt væk ved importen

2026-08-20 00:04:08 +02:00

notes_import_limits_test.go

fix(sikkerhed): resten af gennemgangen — SSRF, tre ubegrænsede veje, og fire hemmeligheder

2026-08-20 08:39:52 +02:00

notes_share_handlers.go

feat(notes): share a note with a person, not only through a project

2026-08-24 07:36:55 +02:00

notes_share_test.go

feat(notes): share a note with a person, not only through a project

2026-08-24 07:36:55 +02:00

notes_test.go

perf(notes): listen sendte hele noter for at vise halvfems tegn af dem

2026-08-20 10:36:35 +02:00

notifications_handlers.go

fix(push): Apple rejected the notifications; use the site's own URL as VAPID subject

2026-08-25 08:24:20 +02:00

openapi_test.go

docs(api): an OpenAPI spec, checked against the router

2026-08-17 10:56:33 +02:00

panel_handlers.go

fix(panel): bed om en planlagt genstart, ikke en der dør med afsenderen

2026-08-18 23:15:10 +02:00

panel_test.go

feat(calendar): en læst Google-kalender, med sit eget endpoint og sin egen sweep

2026-08-20 07:01:14 +02:00

passkey_handlers.go

feat(auth): passkeys, as a way in and as a second factor

2026-08-18 11:56:54 +02:00

passkey_test.go

feat(auth): passkeys, as a way in and as a second factor

2026-08-18 11:56:54 +02:00

projectgroups_handlers.go

feat(groups): a group becomes somewhere you can go

2026-08-18 09:20:03 +02:00

projectgroups_test.go

feat(groups): a group becomes somewhere you can go

2026-08-18 09:20:03 +02:00

projects_handlers.go

feat(projects): sektioner kan trækkes op og ned, og båndet står ikke længere skævt

2026-08-20 14:56:26 +02:00

projects_test.go

feat(projects): sektioner kan trækkes op og ned, og båndet står ikke længere skævt

2026-08-20 14:56:26 +02:00

push_subject_test.go

fix(push): Apple rejected the notifications; use the site's own URL as VAPID subject

2026-08-25 08:24:20 +02:00

ratelimit.go

feat(api): authentication — login, two-step TOTP, invites and resets

2026-08-16 23:31:29 +02:00

realip_test.go

feat(security): trust a forwarded IP only from a proxy, and set COOP

2026-08-23 23:34:34 +02:00

realip.go

feat(security): trust a forwarded IP only from a proxy, and set COOP

2026-08-23 23:34:34 +02:00

realtime_handlers.go

feat(realtime): keep projects and labels current too, not only tasks

2026-08-17 17:27:18 +02:00

server.go

feat(tasks): snooze — park a task at the bottom until a time

2026-08-25 10:59:34 +02:00

sessions_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

tasks_handlers.go

feat(tasks): snooze — park a task at the bottom until a time

2026-08-25 10:59:34 +02:00

tasks_test.go

feat(tasks): snooze — park a task at the bottom until a time

2026-08-25 10:59:34 +02:00

tokens_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

tokens_test.go

feat(api): personal API tokens, and let people change their own profile

2026-08-17 10:56:33 +02:00

totp_handlers.go

feat(2fa): show a scannable QR code when enabling two-factor auth

2026-09-03 16:27:11 +02:00

users_handlers.go

feat(admin): deleting an account stops deleting other people's work

2026-08-18 09:03:59 +02:00

users_test.go

feat(admin): deleting an account stops deleting other people's work

2026-08-18 09:03:59 +02:00

views_handlers.go

feat(admin): keep server errors where a restart cannot take them

2026-08-17 22:58:02 +02:00

views_test.go

feat: an assignee on the row, and the activity log made visible

2026-08-17 22:31:43 +02:00