Secure admin login flow

2026-04-28 09:16:15 +08:00
parent 21cb5c9c15
commit 98e32a4385
15 changed files with 646 additions and 0 deletions
@@ -12,6 +12,7 @@ Use this checklist before every production deployment.
 - [ ] `npm run build` passes.
 - [ ] `npm run payload:migrate:status` shows all migrations as `Yes` on the release database.
 - [ ] `payload_migrations` has no `batch = -1` dev marker before exporting/importing the database.
+- [ ] Admin login shows a verification code, invalid captcha fails before password validation, and `/admin` redirects to `/admin/login` when logged out.
 - [ ] No new user-facing fallback copy was introduced without a CMS field.

 ## Environment
@@ -51,7 +52,9 @@ Required manual spot checks:
 - `/en/support`
 - `/en/support/tutorial`
 - `/admin`
+- `/admin/login`
 - `/api/health`
+- `/api/admin/captcha`

 ## Launch Notes