Claude a957cc59f8 Add /api/amber/set-pin: hidden pinHash rejects client writes (#13/#14) ... Testing verify-pin against the live DB showed the correct PIN failing: the server never held a hash at all. PocketBase silently drops client PATCHes to hidden fields, so the app's best-effort `PATCH {pinHash}` had never landed — the device-local verifier masked it on the PC. The new owner-scoped route writes the hash from superuser context (which can set hidden fields); pin "" clears it. Hash shape matches the app and verify-pin: sha256("<profileId>:<pin>") hex. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-21 21:29:02 +02:00
..
device_auth.pb.js	fix(device-auth): inline helpers into each hook handler (JSVM scope)	2026-07-19 19:48:03 +02:00
device_page.pb.js	device approve page: manual code-entry for the QR-less path (#55)	2026-07-20 11:06:51 +02:00
profile_pin.pb.js	Add /api/amber/set-pin: hidden pinHash rejects client writes (#13/#14)	2026-07-21 21:29:02 +02:00
update.pb.js	Auto-update backend: releases collection + gated manifest (#16)	2026-07-20 11:36:03 +02:00