feat(files): password, email-OTP, and SSO auth for public file shares - #5140

Merged

TheodoreSpeaks merged 11 commits into

feat/file-share-passwords

Jun 19, 2026

Commits on Jun 19, 2026

feat(files): password, email-OTP, and SSO auth for public file shares
TheodoreSpeaks
committed
4165781
merge: resolve conflicts with staging (platform-authz rename, migration renumber 0243→0244)
TheodoreSpeaks
committed
3836f0a
fix(files): suppress filename in share previews for email/sso, not just password
TheodoreSpeaks
committed
7578702
fix(files): normalize allow-list emails to lowercase; genericize shared SSO denial message
TheodoreSpeaks
committed
daebe62
fix(security): make isEmailAllowed case-insensitive; normalize email at client gates
TheodoreSpeaks
committed
82db6c2
test(security): cover isEmailAllowed case-insensitive matching
TheodoreSpeaks
committed
990bc03
merge: resolve conflicts with staging (migration renumber 0244→0245, api-validation baseline 859)
TheodoreSpeaks
committed
6940548
fix(security): bind auth cookie to auth type; password endpoint rejects non-password shares
TheodoreSpeaks
committed
74b56b4
chore(db): format generated migration meta
TheodoreSpeaks
committed
2120a46
fix(files): share upsert validation returns 400 not 500; disabling always succeeds
TheodoreSpeaks
committed
32afa71
feat(access-control): org admins can restrict allowed file-share auth types
TheodoreSpeaks
committed
ec5de63