Authentication

This inventory links test cases to pytest markers. Accordingly, “Active” indicates automation only; it is neither a code-coverage percentage nor proof of production validation.

MariaDB variants require an available isolated database; skipped checks are not successes. Since SQLite does not prove MariaDB locking, this inventory describes automated checks without attesting to a VPS or CI run.

Status	ID	Title
● Active	tc-auth01	Explicit transition for an unactivated account
● Active	tc-auth02	Missing or incorrect factors rejected
● Active	tc-auth03	Internal destination and protected access after TOTP login
● Active	tc-auth04	Direct private page and transaction access rejected
● Active	tc-auth05	Missing, invalid or obsolete session generation rejected
● Active	tc-auth06	TOTP login, POST logout and replay rejection
● Active	tc-auth07	Unreadable protection fails closed without password-only fallback
● Active	tc-auth08	Persistent account and origin rate limits
● Active	tc-auth09	Code format, clock tolerance and consumed periods
● Active	tc-auth10	Confirmed activation, preparation resumption and expiry
● Active	tc-auth11	Administered replacement and previous-session revocation
● Active	tc-auth12	Atomicity, concurrency and persistence after restart
● Active	tc-auth13	CSRF, no-store responses and HTTPS transport
● Active	tc-auth14	External and ambiguous return destinations rejected
● Active	tc-auth15	Bounded proxy trust and secure cookies
● Active	tc-auth16	Interactive administrative CLI without secret arguments