[mckaragoz]

Summary

This PR strengthens UltimateAuth's authentication security in two areas:

1. Preventing account enumeration through externally observable login failure responses.
2. Improving EF Core authentication security state consistency under concurrent operations, including PostgreSQL account-level uniqueness.

The changes preserve existing authentication flows, lockout enforcement, and public DTO contracts while introducing safer default behavior and stronger persistence guarantees.

Changes

Login Failure Enumeration Protection

• Disable UAuthLoginOptions.IncludeFailureDetails by default.
• Centralize public authentication failure mapping in LoginOrchestrator.
• Return generic InvalidCredentials responses without remaining-attempt counts or lockout timestamps when detailed feedback is disabled.
• Apply the same behavior to unknown identifiers, incorrect credentials, ineligible accounts, and account/factor lockouts.
• Prevent login failure redirects from leaking account-specific failure information.
• Preserve detailed failure responses through explicit opt-in.

Authentication Security State Persistence

• Translate expected EF Core optimistic concurrency failures into UAuthConflictException.
• Translate recognized security-state uniqueness violations into the existing conflict contract.
• Detach affected EF Core entries after persistence conflicts to support subsequent operations.
• Enforce PostgreSQL NULLS NOT DISTINCT uniqueness for authentication security state records, preventing duplicate account-level rows where CredentialType is null.
• Preserve existing security versioning and retry behavior.

Database Migrations

• Add the PostgreSQL uniqueness migration for Identity Lab.
• Update EF Core migration snapshots for the Blazor Server and UAuthHub SQLite samples.
• Keep SQLite schema migrations empty where no physical database change is required.

Tests

• Add login enumeration regression tests covering standard login, login preview, PKCE preview, redirects, and explicit detailed-feedback mode.
• Update existing login tests to reflect the secure default.
• Introduce PostgreSQL integration testing using Testcontainers.
• Verify account-level uniqueness, concurrent account creation, and stale security-version rejection.

Compatibility

This PR intentionally changes the default public login failure behavior.

Applications that require detailed failure feedback can opt in:

options.Login.IncludeFailureDetails = true;

No public authentication DTO types or properties are removed.

Authentication security state persistence changes are internal. Existing login, lockout, and session contracts remain unchanged.

Deployment Notes

Before applying the migration to an existing database:

• Ensure duplicate account-level security state records have been identified and resolved.
• Take a database backup.
• Execute pending database migrations before starting the updated application.

Scope

This PR does not redesign lockout policies, introduce trusted-device authentication, or change login verification boundaries. Those concerns remain separate from the persistence integrity fixes included here.

[codecov]

Codecov Report

❌ Patch coverage is 71.79487% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.19%. Comparing base (d2398b7) to head (2b95629).

Files with missing lines	Patch %	Lines
...e/Stores/EfCoreAuthenticationSecurityStateStore.cs	61.90%	5 Missing and 3 partials ⚠️
...timateAuth.Server/Flows/Login/LoginOrchestrator.cs	80.00%	2 Missing ⚠️
...er/Infrastructure/Redirect/AuthRedirectResolver.cs	85.71%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #160      +/-   ##
==========================================
- Coverage   87.24%   87.19%   -0.05%     
==========================================
  Files         580      580              
  Lines       18935    18964      +29     
  Branches     2227     2233       +6     
==========================================
+ Hits        16519    16536      +17     
- Misses       1614     1621       +7     
- Partials      802      807       +5     

Flag	Coverage Δ
framework	87.19% <71.79%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.