- 已发运
- 2026年11月15日 12:48 UTC
- 作者
- Kamo
- 承诺
- ee0d001
- SignInRiskService scores every decided sign-in (password, MFA, picker, social, SSO, passwordless, passkey step) off the request thread: NEW_DEVICE 30 / NEW_COUNTRY 40 / IMPOSSIBLE_TRAVEL 60 (GeoLite), signin_risk_events + user_signin_devices upsert, SIGNIN_UNUSUAL when score >= 50, one SIGNIN_NEW_DEVICE notification per new device row (never the first) with a KSECURE 7-day single-use Secure My Account link. - adaptiveStepUp policy field (GET/PUT/describe/change log); when ON an unusual sign-in on a remembered browser gets the standard MFA step (inline <= 300 ms, fail-open) -> STEPPED_UP; never a refusal. - signin/secure-account (token) + my-account/secure (***): every ***, phones, remembered browsers; password marked PASSWORD_RESET_REQUIRED (Redis flag, read after the password is verified, cleared by any password change; also refuses a retired password as link proof); reset letter; ACCOUNT_SECURED HIGH. - phishing_resistant_admins enforced: PASSKEY_REQUIRED (login/MFA/select LoginResponse code, outcome elsewhere) + **************** via PasskeyService; Continue only without a passkey here (PASSKEY_POLICY_GRACE) - never a lock-out; a passkey sign-in is never asked; switch OFF = unchanged answers. - signin/breach-nudge -> 204 + PASSWORD_BREACH_NUDGED. MFA and picker completions now write their success row.