harden(api-login): remove account-state leak and equalize failure timing

2026-04-25 21:37:09 +02:00
parent e775ed2800
commit 61c1d18e95
3 changed files with 20 additions and 26 deletions
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -66,12 +66,6 @@ paths:
                    request_id: 550e8400-e29b-41d4-a716-446655440000
                    error_code: invalid_credentials
                    details: {}
-                account_inactive:
-                  value:
-                    ok: false
-                    request_id: 550e8400-e29b-41d4-a716-446655440000
-                    error_code: account_inactive
-                    details: {}
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':