fix: prevent repeated Doodstream OTP requests

Coalesce concurrent and repeated Doodstream login checks by credential identity, keep the challenged cookie session for OTP verification, and rate-limit explicit code resends. Prefer an existing Doodstream API key during health checks and add regression coverage for imports with duplicate accounts, concurrent checks, expired challenges, and session reuse.
2026-08-31 18:45:37 +02:00
parent 317ff3f035
commit 40ce83d413
10 changed files with 300 additions and 38 deletions
@@ -45,7 +45,7 @@ test('public release verifier accepts only the exact source manifest and target
  assert.equal(baseline.status, 0, baseline.stderr);
  assert.equal(
    baseline.stdout,
-    `public-release-source-ok files=159 denied-paths=0 internal-terms=0 version=${currentVersion} scripts=8 build-files=7 layout=exact screenshot=deferred\n`
+    `public-release-source-ok files=160 denied-paths=0 internal-terms=0 version=${currentVersion} scripts=8 build-files=7 layout=exact screenshot=deferred\n`
  );

  fs.writeFileSync(path.join(stage, 'tests', 'unexpected.json'), '{}');