Repository navigation
feat(portal): two-factor step at sign-in and password change - #89
Merged
Merged
Conversation
An account that turned on two-factor sign-in (VoltiusApp/server#105) gets 428 TWO_FACTOR_REQUIRED from /v1/auth/login. The portal showed that as a raw JSON error, so those accounts could not reach billing. Sign-in now moves to a code step when the server asks for one and finishes through /v1/auth/login/2fa, with a switch to a recovery code. Changing the master password asks for a code when the account has two-factor on, since the server refuses the change without one. ApiError exposes the parsed `{error: CODE}` body so a refusal can be told apart without matching on text.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Portal half of optional two-factor sign-in (VoltiusApp/server#105, client VoltiusApp/voltius#615).
Without this, an account that turns two-factor on cannot sign in to the portal:
/v1/auth/loginanswers428 TWO_FACTOR_REQUIREDand the page printed the JSON body as the error.Changes
POST /v1/auth/login/2fa. A server that only offers recovery codes (methods: ["recovery"]) gets only that field. A pending sign-in that ran past its five minutes goes back to the password form with a message.two_factor_enabledis set on/v1/auth/me, and sends it with the change.ApiError.bodyparses the{error: CODE}body;twoFactorMessageturns the four codes into text.Safe to deploy before or after the server: a server without the feature never answers 428 and never sets
two_factor_enabled.Checked
pnpm exec tsc --noEmitinportal/. Not driven in a browser against a live server.Enrolment stays in the desktop and mobile app; the portal only needs to get an enrolled account in.