ProblemThere is no 2FA; a compromised password/JWT gives full access. The auth layer has no TOTP or recovery codes.
Solution
- Add a TOTP enrollment flow in settings: generate secret, QR provisioning URI, confirm code, and persist verified flag.
- Require the TOTP code on login after
POST /api/auth/login verification (server-issued challenge when 2FA enabled).
- Provide one-time recovery codes (stored hashed server-side) and a reset path.
- Show enrollment status in the auth/session views.
Acceptance Criteria
- Enabling 2FA requires a valid TOTP code before activation.
- Logging in with 2FA enabled demands the code.
- Recovery codes work once and rotate.
npm run build passes.
Note for Contributors: Write a clear PR description. Show the enrollment QR and a successful TOTP login.
ProblemThere is no 2FA; a compromised password/JWT gives full access. The auth layer has no TOTP or recovery codes.
Solution
POST /api/auth/loginverification (server-issued challenge when 2FA enabled).Acceptance Criteria
npm run buildpasses.Note for Contributors: Write a clear PR description. Show the enrollment QR and a successful TOTP login.