From 360c5d5f64eb04832e855a97d15df6b283879f82 Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Wed, 5 Nov 2025 15:59:19 +0800 Subject: [PATCH] fix(login): add both 'totp' and 'totpCode' fields for backend compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To resolve MFA validation issues, now sending TOTP code using both field names: 1. loginBody.totp = totpCode 2. loginBody.totpCode = totpCode This ensures maximum compatibility with backend API expectations, regardless of which field name it expects. The account export confirms: - User has mfaTotpSecret configured: QGTZSUOHIFSKHLTN3LKHOSCYTLKBDAYD - MFA is enabled for this user - Expected flow: email + password + totp → success With detailed logging added in previous commit, we can now see: - Exact request body sent to backend - Backend response including all fields - TOTP validation status This should resolve the mfa_code_required error that was occurring even when TOTP was provided. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- dashboard-fresh/routes/api/auth/login.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dashboard-fresh/routes/api/auth/login.ts b/dashboard-fresh/routes/api/auth/login.ts index d2692a2..cd84a98 100644 --- a/dashboard-fresh/routes/api/auth/login.ts +++ b/dashboard-fresh/routes/api/auth/login.ts @@ -239,6 +239,8 @@ async function handleLogin(payload: LoginPayload): Promise { console.log('[login/handleLogin] Calling proxy to backend...') const loginBody: Record = { email, password } if (totpCode) { + // Try both field names for maximum compatibility + loginBody.totp = totpCode loginBody.totpCode = totpCode console.log('[login/handleLogin] → Including TOTP code in request:', totpCode) } else {