Skip to main content

Security & 2FA

Closegram provides two-factor authentication, session management, security event logging, and GDPR-compliant data export.

Each property has its own checkbox marking whether that specific piece is fully implemented and functional end to end (frontend + backend) — update these yourself as work lands; this page won't overwrite them.

  • Two-factor authentication setup & verification — TOTP (authenticator app), SMS, and email methods. All 2FA state now persists in the dedicated user_two_factor table (previously written to non-existent user columns, so nothing persisted and the flow was silently broken), and 2FA is now enforced at login across every sign-in path.
  • Disable 2FA
  • Generate / verify backup codes — 10 codes issued at 2FA setup and regenerable from Settings → Security; the login 2FA step accepts a backup code in place of the authenticator/SMS/email code (verifyTwoFactorCode checks backup codes first and consumes the used one).
  • View active sessions and login history
  • Sign out one session or all other sessions
  • Security alerts list and dismissal — Settings → Security alerts lists persisted alerts (securityAlerts, backed by the new security_alert table) with mark-as-read and dismiss (markSecurityAlertRead/dismissSecurityAlert); a password_change alert is emitted automatically on password change. (The manager previously returned mock data in a shape that didn't match the schema.)
  • Security event log and security score dashboard
  • Suspicious-login and real-time activity risk detection
  • Request a verification badge
  • Admin review: approve, reject, or remove a badge — frontend-admin /verification page backed by adminGetPendingVerificationRequests (queue), adminVerifyUser (approve), adminRejectVerificationRequest (reject) and adminRemoveVerification (remove)

See the technical reference for GraphQL schemas, routes, source file links, and per-field wiring status.