chore: migrate 2FA TOTP DDP methods to /v1/users.totp.* REST endpoints#40734
chore: migrate 2FA TOTP DDP methods to /v1/users.totp.* REST endpoints#40734ggazzo wants to merge 1 commit into
Conversation
Added five new REST endpoints under /v1/users.totp.* covering the TOTP
flows that previously only existed as DDP methods:
- POST /v1/users.totp.enable (2fa:enable)
- POST /v1/users.totp.disable (2fa:disable)
- POST /v1/users.totp.validate (2fa:validateTempToken)
- POST /v1/users.totp.regenerateCodes (2fa:regenerateCodes)
- GET /v1/users.totp.codesRemaining (2fa:checkCodesRemaining)
Each DDP method body was extracted into a shared function under
apps/meteor/app/2fa/server/functions/totp.ts; the DDP methods now log
deprecation pointing at the new routes and delegate.
validate keeps the post-enable login-token rotation: the REST endpoint
forwards the request's X-Auth-Token (this.token) so non-PAT tokens get
revoked just like the DDP path did via this.connection.httpHeaders.
Client TwoFactorTOTP swapped from five useMethod hooks to five
useEndpoint hooks. disable response shape changed from bare boolean to
{ disabled: boolean }; verify/regenerate continue to return { codes }.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
🦋 Changeset detectedLatest commit: 1be9c7b The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## develop #40734 +/- ##
===========================================
- Coverage 69.76% 69.75% -0.01%
===========================================
Files 3327 3327
Lines 123134 123134
Branches 21963 21909 -54
===========================================
- Hits 85902 85893 -9
- Misses 33873 33881 +8
- Partials 3359 3360 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
1 participant
Summary
Continues the DDP→REST sweep (#40659, #40711, #40675, #40724, #40728). This batch migrates the five
2fa:*TOTP DDP methods that backedaccount/security/TwoFactorTOTP. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes.New endpoints
2fa:enablePOST /v1/users.totp.enable{ secret, url }2fa:disablePOST /v1/users.totp.disable{ code }{ disabled }2fa:validateTempTokenPOST /v1/users.totp.validate{ code }{ codes }2fa:regenerateCodesPOST /v1/users.totp.regenerateCodes{ code }{ codes }2fa:checkCodesRemainingGET /v1/users.totp.codesRemaining{ remaining }All five extract the original method body into a shared function (
apps/meteor/app/2fa/server/functions/totp.ts) reused by both DDP + REST entrypoints.Validate flow note
validatekeeps the DDP-era post-enable login-token rotation: REST forwards the caller'sX-Auth-Token(this.token) so non-PAT tokens get revoked just like the DDP path did viathis.connection.httpHeaders['x-auth-token'].Client changes
TwoFactorTOTP.tsxswapped fiveuseMethodhooks for fiveuseEndpointhooks. Disable response shape changed from bare boolean to{ disabled: boolean }; verify/regenerate continue to return{ codes }.Test plan
🤖 Generated with Claude Code