The login API route was not receiving or forwarding TOTP codes from the
frontend, causing MFA login failures.
Changes:
1. Added 'totp' field to LoginPayload interface in routes/api/auth/login.ts
2. Updated handleLogin() to receive and forward TOTP codes to backend
3. Added logging for TOTP presence in login attempts
4. Updated LOGIN_FLOW.md to clarify the single-step login flow with optional TOTP
Login Flow:
- Frontend pre-checks MFA status via GET /api/auth/mfa/status
- If MFA enabled, frontend shows TOTP input field
- User submits email, password, and optionally TOTP code
- Backend receives and validates TOTP if provided
- Backend returns success or appropriate error
This implements the correct single-step login flow where users provide
credentials and TOTP together, as documented in LOGIN_FLOW.md
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Major cleanup to align with Fresh/Deno standard structure:
Deleted:
- app/ directory - Next.js 13+ App Router (38 files, 3795 deletions)
This includes all Next.js page routes and API routes that were conflicting
with Fresh's routes/ structure
Updated:
- tsconfig.json - Removed Next.js specific configuration:
* Removed "plugins": [{ "name": "next" }]
* Removed "app" from include paths
* Removed ".next/types/**/*.ts" from include
* Added Fresh-specific paths: routes, islands, api, static
Preserved:
- routes/login.tsx - Fresh page route for login
- routes/api/auth/login.ts - Fresh API route
- islands/LoginForm.tsx - Client-side login component (already fixed)
- api/ - Utility functions for content handling
- static/styles/globals.css - Global styles (correct location)
Known Issues (pending migration):
- 17+ component files use Next.js specific imports and features:
* components/Navbar.tsx - uses next/link, next/navigation
* components/Footer.tsx - uses Next.js imports
* components/home/*.tsx - multiple files with Next.js dependencies
* components/iac/*.tsx - Infrastructure components with Next.js code
These components need to be:
1. Migrated to Fresh/Deno compatible code (replace Next.js APIs)
2. Or moved to islands/ directory with Preact hooks
3. Or replaced with Fresh-native solutions
Next steps: Migrate problematic components to Fresh/Deno standards
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Allow users to submit login form without TOTP code first, then require
TOTP based on backend response (error: "mfa_code_required"). This fixes
the issue where frontend blocked all submissions when MFA was enabled.
Changes:
- Removed mandatory TOTP validation in both Fresh and Next.js versions
- Only validate TOTP format if provided (6 digits)
- Keep error handling logic to show TOTP input when backend requires it
Fixes mfaToken verification failure during login flow.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove needMfa field from login API responses
- MFA setup redirection now only occurs in registration flow
- Registration always redirects to /panel/account?NeedSetupMfa=1
- Update documentation to reflect simplified login flow
- Clarify that login API returns error: 'mfa_code_required' instead of needMfa: true
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix MFA detection logic to recognize mfa_code_required error
- Remove strict mfaToken requirement when needMfa is determined by error code
- Update mfa/status route to use async getAuthUrl() from runtime-loader
- Update mfa/verify route to use async getAuthUrl() from runtime-loader
- Add comprehensive structured logging across all MFA endpoints
- Add timeout control (10s) for backend requests
- Improve error handling with detailed console output
- Add LOGIN_FLOW.md documentation in Chinese
This completes the migration of all MFA-related endpoints to the new Deno
native runtime configuration system.
- Create islands/UserMenu.tsx with self-contained user menu functionality
- Refactor islands/Navbar.tsx to use UserMenu component
- Support both desktop and mobile layouts with single component
API Routes Migration:
- Migrated /api/auth/mfa/status endpoint for checking MFA status
- Migrated /api/auth/mfa/setup endpoint for TOTP provisioning
- Migrated /api/auth/mfa/verify endpoint for code verification
- Migrated /api/auth/mfa/disable endpoint for disabling MFA
- All routes properly handle cookies (session and MFA tokens)
- Implemented proper error handling and status codes
Bug Fixes:
- Added favicon.ico to static folder (fixes 404 error)
- Updated fresh.gen.ts with new route manifests
Migration Details:
- Converted Next.js route handlers to Fresh Handlers pattern
- Updated cookie management from Next.js cookies() to Deno's getCookies()
- Changed Response handling from NextResponse to standard Response
- Maintained compatibility with existing authentication flow
- Proxies requests to backend account service API
- Panel Infrastructure:
- Add lib/userSession.ts for user session utilities
- Create islands/panel/Sidebar.tsx with navigation and MFA
warnings
- Create islands/panel/Header.tsx with user info and role badges
- Create islands/panel/PanelLayout.tsx as layout wrapper
- Add routes/panel/index.tsx as dashboard home page
- Add routes/panel/account.tsx for account settings
- Add routes/panel/mail.tsx for mail service (placeholder)
- Migrate /components/auth/AuthLayout.tsx to Preact
- Create /routes/login.tsx using Fresh handlers and SSR
- Create /islands/LoginForm.tsx with MFA (TOTP) support
