fix 2fa and move communication language to setting

apps/api/src/modules/auth/auth.employee.routes.ts

@@ -6,6 +6,7 @@ import { setSessionCookie, clearSessionCookie } from '../../security/sessionCook
 import { getEmployeeMenu } from '../menu/menu.service'
 import {
   employeeForgotPasswordSchema,
+  employee2faVerifySchema,
   employeeLanguageSchema,
   employeeLoginSchema,
   employeeResetPasswordSchema,
@@ -30,9 +31,12 @@ router.post('/login', async (req, res, next) => {
   try {
     const body = parseBody(employeeLoginSchema, req)
     const result = await service.login(body)
+    if ('twoFactorRequired' in result) {
+      return res.status(401).json({ error: 'two_factor_required', message: '2FA code required', method: result.method, statusCode: 401 })
+    }
     if ('token' in result) {
       clearSessionCookie(res, 'admin')
-      setSessionCookie(res, 'employee', result.token, 8 * 60 * 60 * 1000)
+      setSessionCookie(res, 'employee', String(result.token), 8 * 60 * 60 * 1000)
     }
     ok(res, result)
   } catch (err) { next(err) }
@@ -43,6 +47,38 @@ router.post('/logout', (_req, res) => {
   ok(res, { success: true })
 })
 
+router.post('/2fa/setup', requireCompanyAuth, async (req, res, next) => {
+  try {
+    ok(res, await service.setupTotp(req.employee.id))
+  } catch (err) { next(err) }
+})
+
+router.post('/2fa/verify', requireCompanyAuth, async (req, res, next) => {
+  try {
+    const { code } = parseBody(employee2faVerifySchema, req)
+    const result = await service.verifyTotp(req.employee.id, code)
+    if (!result) return res.status(400).json({ error: 'invalid_code', message: 'Invalid 2FA code', statusCode: 400 })
+    if ('token' in result) setSessionCookie(res, 'employee', String(result.token), 8 * 60 * 60 * 1000)
+    ok(res, result)
+  } catch (err) { next(err) }
+})
+
+router.post('/2fa/email/setup', requireCompanyAuth, async (req, res, next) => {
+  try {
+    ok(res, await service.setupEmail2fa(req.employee.id))
+  } catch (err) { next(err) }
+})
+
+router.post('/2fa/email/verify', requireCompanyAuth, async (req, res, next) => {
+  try {
+    const { code } = parseBody(employee2faVerifySchema, req)
+    const result = await service.verifyEmail2fa(req.employee.id, code)
+    if (!result) return res.status(400).json({ error: 'invalid_code', message: 'Invalid email verification code', statusCode: 400 })
+    if ('token' in result) setSessionCookie(res, 'employee', String(result.token), 8 * 60 * 60 * 1000)
+    ok(res, result)
+  } catch (err) { next(err) }
+})
+
 router.post('/forgot-password', async (req, res, next) => {
   try {
     const { email } = parseBody(employeeForgotPasswordSchema, req)