Native app uses supabase.auth.signInWithPassword directly, bypassing /api/auth/login. This authenticated endpoint runs the same device-lock check post-auth: 409 DEVICE_LOCKED if bound to another user, 200+bind if Pro/Legend user, no-op bind for Free users. CORS headers extended to include x-device-name/model/os. 34 tests green. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Description
Self-hosted mirror of rebreak monorepo
Languages
TypeScript
68%
Vue
7.9%
Swift
7.7%
Shell
4.2%
JavaScript
3.1%
Other
8.9%