diff options
| author | Adam Soltys <[email protected]> | 2026-06-27 07:53:38 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-06-27 07:53:38 -0700 |
| commit | ea23e9a5ba360ab77a16dfb8e48e5b2471fee8c4 (patch) | |
| tree | c182be6d54b974ba9a406d7a404c310d811def0f /lib/auth.ts | |
| parent | d2762384156e3310ca08d7c295dea0e3856f8c9d (diff) | |
| download | coinos-server-ea23e9a5ba360ab77a16dfb8e48e5b2471fee8c4.tar.gz coinos-server-ea23e9a5ba360ab77a16dfb8e48e5b2471fee8c4.zip | |
users: return generic 404 from /reset for non-admins
The admin-only password-reset endpoint returned "disabled" to non-admin
callers, which confirmed both that the endpoint exists and that it is
admin-gated. Return a generic 404 identical to an unregistered route
instead; still log the rejected attempt server-side for monitoring.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to 'lib/auth.ts')
0 files changed, 0 insertions, 0 deletions