Password Vault relay and 5-minute re-confirm; attempt limit on the hosted-computer password confirm (TPVAULT)

Shipped

November 6, 2026 at 7:21 PM UTC

Author

Kamo

Commit

d94fe3d

/api/security/vault/** resolves the session, refuses impersonation, computes the re-confirm freshness on every request (the KREAUTH password marker within 5 minutes, plus the authenticator when enrolled; an emailed code for accounts with no password) and relays an allowlist of people's paths to VaultService. The hosted-computer password confirm now shares the re-check limiter (5 wrong per session per 15 minutes).