notandClaude Opus 5 716b8d03e0 test(e2e): a medewerker login must not reuse a spent TOTP counter (refs #132) ...

Two beheer specs log in as bram-beheerder back to back, so both submit the
code for the same 30-second counter. Keycloak's otpPolicyCodeReusable
defaults to false, so it refuses the second one as invalid credentials and
the beheer portal never loads — which is how verify-e2e went red on #158.

Pins the counter choice as a pure function of "now" and the last counter
this medewerker spent, so the guard is checkable without a browser.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-04 09:53:55 +02:00

..

acceptance

feat: read projection sourced from the register in Objecten (closes #153) (#155)

2026-09-01 07:26:33 +00:00

e2e

test(e2e): a medewerker login must not reuse a spent TOTP counter (refs #132)

2026-09-04 09:53:55 +02:00