2026-11-10: security hardening (Wave 6.7)#

• Account.secret is removed from the schema. It was a random value written at sign-up that nothing used. The field is gone from Account, its filters and sort fields, and from the generated CreateAccountDto and UpdateAccountDto inputs. A query that selected secret on an account now fails validation. (AccountDevice.secret and TotpEnrolment.secret are unchanged.)
• Reading an account by id needs a tenant in common. account(id) and relations that end at an account (createdBy, reviewedBy, ...) return the caller's own account and accounts that share a company, bookkeeper firm or enterprise with the caller. Any other id answers like an unknown one. Platform users see the other users of the same platform company only.
• Password grant takes otp. POST /v2/oauth2/token with grant_type=password accepts an optional otp (authenticator or recovery code). A valid code puts otp in the token's amr claim; a wrong code is invalid_grant. Without it nothing changes.
• Schema file. apps/api/schema.gql is regenerated from the running API; two enums changed order, nothing else changed besides the removals above.