fix(aurora): 2FA login broken after rc.22 (send flow_token) - #68
Merged
Conversation
Users with 2FA could not log in on dev: the 2FA step failed with 'session expired'. rc.22 (QuantumNous#6329) replaced the server-side 2FA login session with a stateless AuthFlow token — the password step now returns data.flow_token and /api/user/login/2fa requires it in the body. The aurora frontend was still built for the old session-based flow and sent only { code }, so the backend's GetAuthFlow lookup failed. - Capture data.flow_token from the login response and stash it in sessionStorage before navigating to the OTP page. - Send it back as flow_token on login2fa (covers both TOTP and backup code, same endpoint); clear it once verification succeeds. - Type flow_token on LoginResponse.data and TwoFAPayload. aurora build + typecheck clean (6 pre-existing warnings, no new).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
dev 上开了 2FA 的账号登录时,2FA 步骤报「会话已过期,请重新登录」,登不进。
根因
rc.22 的 QuantumNous#6329 把服务端 2FA 登录 session 换成了无状态 AuthFlow token:密码步骤现在返回
data.flow_token,/api/user/login/2fa要求请求体带flow_token。aurora 前端仍按旧的 session 契约写、只发了{ code }→ 后端GetAuthFlow查不到 → 会话已过期。修复(纯前端)
data.flow_token,跳转 OTP 前存入sessionStorageflow_token(TOTP 和备用码同一 endpoint,一并修复);成功后清除LoginResponse.data/TwoFAPayload补类型验证
aurora build + typecheck 通过(无新增错误)。
说明
passkey / OAuth 登录路径 rc.22 也可能有类似契约变化,本 PR 只修 TOTP/备用码登录(当前阻断项)。若 passkey 登录也异常再单独跟进。