feat(files): password, email-OTP, and SSO auth for public file shares#5140

Merged

TheodoreSpeaks merged 11 commits into

feat/file-share-passwords

Jun 19, 2026

Commits on Jun 19, 2026

feat(files): password, email-OTP, and SSO auth for public file shares
TheodoreSpeaks
committed
merge: resolve conflicts with staging (platform-authz rename, migration renumber 0243→0244)
TheodoreSpeaks
committed
fix(files): suppress filename in share previews for email/sso, not just password
TheodoreSpeaks
committed
fix(files): normalize allow-list emails to lowercase; genericize shared SSO denial message
TheodoreSpeaks
committed
fix(security): make isEmailAllowed case-insensitive; normalize email at client gates
TheodoreSpeaks
committed
test(security): cover isEmailAllowed case-insensitive matching
TheodoreSpeaks
committed
merge: resolve conflicts with staging (migration renumber 0244→0245, api-validation baseline 859)
TheodoreSpeaks
committed
fix(security): bind auth cookie to auth type; password endpoint rejects non-password shares
TheodoreSpeaks
committed
chore(db): format generated migration meta
TheodoreSpeaks
committed
fix(files): share upsert validation returns 400 not 500; disabling always succeeds
TheodoreSpeaks
committed
feat(access-control): org admins can restrict allowed file-share auth types
TheodoreSpeaks
committed