2 Commits

Author	SHA1	Message	Date
Jakub Zych	15ff9793ba	fix: login refuses a not-activated account while require_activation is on ... The refusal is the same 401 invalid-login answer as a wrong password and is counted by the login throttle. The activation is checked after the password and before the deactivation restore, so a refused account stays deactivated. require_activation false keeps the previous behaviour.	2026-10-22 21:25:53 +02:00
Jakub Zych	35cf16689d	test: email_verified_at writers, non-writers and the migration ... - TestEmailVerifiedAt: register (auto, admin), activate, activate-by-code, reset-password, change-password, update - TestAdminEmailVerifiedAt: admin create, activate action, invitation link, email change, JSON - TestEmailVerifiedAtMigration: column shape, no backfill, existing column kept, rollback keeps column	2026-10-21 14:01:52 +02:00