feat: handle PAM password policy changes

2026-09-26 01:50:02 +05:30
parent 9492dbd7c9
commit 83345a1842
12 changed files with 697 additions and 57 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog

+## 0.5.0 — PAM password policy flow
+
+- Added PAM password-change handling for accounts that return
+  `PAM_NEW_AUTHTOK_REQD` or `PAM_AUTHTOK_EXPIRED` during login.
+- Added an explicit TUI new-password state. PAM still enforces password
+  history, strength, and token policy; the login screen never implements its
+  own password rules.
+- Added zeroizing old/new password buffers and conversation tests for the
+  current-password/new-password prompt sequence.
+- Added redacted structured audit events for authentication, password changes,
+  and session handoff. Raw PAM messages and password material are excluded.
+- Added TUI and core policy-transition tests; the workspace now contains 33
+  Rust unit tests.
+
 ## 0.4.0 — Advanced login workflow

 - Added account policy inspection for locked passwords, password expiry,