admin login fixed.

2026-07-28 22:56:18 -04:00
parent 5649ab02c7
commit 50c74b9007
29 changed files with 1155 additions and 118 deletions
@@ -45,8 +45,12 @@ router.post('/auth/login', async (req, res, next) => {
    const { email, password, totpCode, recoveryCode } = parseBody(loginSchema, req)
    const result = await service.login(email, password, totpCode, recoveryCode)
    if (!result)                        return res.status(401).json({ error: 'invalid_credentials', message: 'Invalid email or password', statusCode: 401 })
-    if ('totpRequired'  in result)      return res.status(401).json({ error: 'totp_required',       message: '2FA code required',           statusCode: 401 })
+    if ('totpRequired'  in result) {
+      clearSessionCookie(res, 'employee')
+      return res.status(401).json({ error: 'totp_required', message: '2FA code required', statusCode: 401 })
+    }
    if ('invalidTotp'   in result)      return res.status(401).json({ error: 'invalid_totp',        message: 'Invalid 2FA code',            statusCode: 401 })
+    clearSessionCookie(res, 'employee')
    setSessionCookie(res, 'admin', result.token, 8 * 60 * 60 * 1000)
    ok(res, result)
  } catch (err) { next(err) }