Kamron Batman e7ab7e8738 feat(accounts): add a config-gated repair for mis-migrated passwords ... Accounts corrupted by the pre-fix SetPassword hold argon2(username + password) tagged with an algorithm whose phrase rule omits the username. Nothing in the hash distinguishes that from a forgotten password, so the only detection is to retry with the other phrase on a failed verify -- which doubles the cost of every failed login, and failed logins are the credential-stuffing surface. Hence accountSecurity.repairMigratedPasswords, default false: an operator turns it on for a migration window and off again. Repaired accounts are force-rehashed because their stored parameters may already be current, in which case NeedsRehash would decline and the account would verify once and stay broken. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-08-07 17:00:12 -07:00
..
Fixtures	fix(accounts): derive the password phrase from the target algorithm	2026-08-07 16:24:37 -07:00
Tests	feat(accounts): add a config-gated repair for mis-migrated passwords	2026-08-07 17:00:12 -07:00
UOContent.Tests.csproj	fix: Bumps dependencies. (#2531)	2026-07-14 15:17:55 -07:00