@actuate-media/cms-admin 0.28.0 → 0.29.0

package/dist/views/settings/SecurityTab.js

@@ -36,6 +36,6 @@ export function SecurityTab({ role, onNavigate, }) {
                                 ? 'Ask an administrator to review the Security tab.'
                                 : (loadError ?? 'The security service could not be reached. Try again shortly.') })] })] }));
     }
-    return (_jsxs("div", { className: "space-y-4 pb-4", children: [_jsx(SecurityStatusCard, { status: data.status, onNavigate: onNavigate }), issues.length > 0 && _jsx(SettingsValidationSummary, { issues: issues }), !canEdit && (_jsx("p", { className: "text-muted-foreground text-sm", children: "You have read-only access. Only administrators can change security settings." })), _jsx(AuthMfaCard, { form: form, setField: setField, canEdit: canEdit, viewerHasMfa: data.viewerHasMfa, withMfa: data.users.withMfa, totalAdmins: data.users.totalAdmins }), _jsx("div", { id: "security-sessions", children: _jsx(SessionPolicyCard, { form: form, setField: setField, canEdit: canEdit, sessionMaxAgeHours: data.sessionMaxAgeHours, activeSessions: data.activeSessions, revokeState: revokeState, onRevokeAll: () => void revokeAllOtherSessions() }) }), _jsx("div", { id: "security-ip-allowlist", children: _jsx(AccessProtectionCard, { ipAllowlist: data.ipAllowlist, secrets: data.secrets, csrfEnabled: data.csrfEnabled, uploadValidation: data.uploadValidation, sources: data.sources, onNavigate: onNavigate }) }), _jsx("div", { id: "security-audit", children: _jsx(SecretsAuditCard, { secrets: data.secrets, auditEnabled: data.auditEnabled, failedLogins24h: data.failedLogins24h, users: data.users, apiKeys: data.apiKeys, sources: data.sources, onNavigate: onNavigate }) }), saveState === 'error' && (_jsx("p", { className: "text-destructive text-sm", role: "alert", children: "Failed to save security settings. Please try again." })), _jsx(SettingsSaveBar, { dirty: dirty, canEdit: canEdit, hasErrors: hasErrors, saveState: saveState, onSave: () => void save(), onReset: reset })] }));
+    return (_jsxs("div", { className: "space-y-4 pb-4", children: [_jsx(SecurityStatusCard, { status: data.status, onNavigate: onNavigate }), issues.length > 0 && _jsx(SettingsValidationSummary, { issues: issues }), !canEdit && (_jsx("p", { className: "text-muted-foreground text-sm", children: "You have read-only access. Only administrators can change security settings." })), _jsx(AuthMfaCard, { form: form, setField: setField, canEdit: canEdit, viewerHasMfa: data.viewerHasMfa, withMfa: data.users.withMfa, totalAdmins: data.users.totalAdmins, onNavigate: onNavigate }), _jsx("div", { id: "security-sessions", children: _jsx(SessionPolicyCard, { form: form, setField: setField, canEdit: canEdit, sessionMaxAgeHours: data.sessionMaxAgeHours, activeSessions: data.activeSessions, revokeState: revokeState, onRevokeAll: () => void revokeAllOtherSessions() }) }), _jsx("div", { id: "security-ip-allowlist", children: _jsx(AccessProtectionCard, { ipAllowlist: data.ipAllowlist, secrets: data.secrets, csrfEnabled: data.csrfEnabled, uploadValidation: data.uploadValidation, sources: data.sources, onNavigate: onNavigate }) }), _jsx("div", { id: "security-audit", children: _jsx(SecretsAuditCard, { secrets: data.secrets, auditEnabled: data.auditEnabled, failedLogins24h: data.failedLogins24h, users: data.users, apiKeys: data.apiKeys, sources: data.sources, onNavigate: onNavigate }) }), saveState === 'error' && (_jsx("p", { className: "text-destructive text-sm", role: "alert", children: "Failed to save security settings. Please try again." })), _jsx(SettingsSaveBar, { dirty: dirty, canEdit: canEdit, hasErrors: hasErrors, saveState: saveState, onSave: () => void save(), onReset: reset })] }));
 }
 //# sourceMappingURL=SecurityTab.js.map

package/dist/views/settings/SecurityTab.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityTab.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,SAAS,YAAY;IACnB,OAAO,CACL,eAAK,SAAS,EAAC,2DAA2D,aACxE,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,eAAK,SAAS,EAAC,WAAW,aACxB,cAAK,SAAS,EAAC,6BAA6B,GAAG,EAC/C,cAAK,SAAS,EAAC,4BAA4B,GAAG,IAC1C,IACF,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAA;IAChC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,WAAW,EACX,sBAAsB,GACvB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEhC,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACpD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QACzD,EAAE,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,IACZ,CACP,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,CACL,eAAK,SAAS,EAAC,kGAAkG,aAC/G,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,8BAA8B,iBAAa,MAAM,GAAG,EACrF,0BACE,YAAG,SAAS,EAAC,6BAA6B,YACvC,SAAS;gCACR,CAAC,CAAC,6CAA6C;gCAC/C,CAAC,CAAC,+BAA+B,GACjC,EACJ,YAAG,SAAS,EAAC,MAAM,YAChB,SAAS;gCACR,CAAC,CAAC,kDAAkD;gCACpD,CAAC,CAAC,CAAC,SAAS,IAAI,+DAA+D,CAAC,GAChF,IACA,IACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,kBAAkB,IAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,GAAI,EAElE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,yBAAyB,IAAC,MAAM,EAAE,MAAM,GAAI,EAElE,CAAC,OAAO,IAAI,CACX,YAAG,SAAS,EAAC,+BAA+B,6FAExC,CACL,EAED,KAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GACnC,EAEF,cAAK,EAAE,EAAC,mBAAmB,YACzB,KAAC,iBAAiB,IAChB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAC3C,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,sBAAsB,EAAE,GAChD,GACE,EAEN,cAAK,EAAE,EAAC,uBAAuB,YAC7B,KAAC,oBAAoB,IACnB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEN,cAAK,EAAE,EAAC,gBAAgB,YACtB,KAAC,gBAAgB,IACf,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,EACrC,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEL,SAAS,KAAK,OAAO,IAAI,CACxB,YAAG,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,oEAEhD,CACL,EAED,KAAC,eAAe,IACd,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EACzB,OAAO,EAAE,KAAK,GACd,IACE,CACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"SecurityTab.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,SAAS,YAAY;IACnB,OAAO,CACL,eAAK,SAAS,EAAC,2DAA2D,aACxE,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,eAAK,SAAS,EAAC,WAAW,aACxB,cAAK,SAAS,EAAC,6BAA6B,GAAG,EAC/C,cAAK,SAAS,EAAC,4BAA4B,GAAG,IAC1C,IACF,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAA;IAChC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,WAAW,EACX,sBAAsB,GACvB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEhC,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACpD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QACzD,EAAE,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,IACZ,CACP,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,CACL,eAAK,SAAS,EAAC,kGAAkG,aAC/G,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,8BAA8B,iBAAa,MAAM,GAAG,EACrF,0BACE,YAAG,SAAS,EAAC,6BAA6B,YACvC,SAAS;gCACR,CAAC,CAAC,6CAA6C;gCAC/C,CAAC,CAAC,+BAA+B,GACjC,EACJ,YAAG,SAAS,EAAC,MAAM,YAChB,SAAS;gCACR,CAAC,CAAC,kDAAkD;gCACpD,CAAC,CAAC,CAAC,SAAS,IAAI,+DAA+D,CAAC,GAChF,IACA,IACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,kBAAkB,IAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,GAAI,EAElE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,yBAAyB,IAAC,MAAM,EAAE,MAAM,GAAI,EAElE,CAAC,OAAO,IAAI,CACX,YAAG,SAAS,EAAC,+BAA+B,6FAExC,CACL,EAED,KAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EACnC,UAAU,EAAE,UAAU,GACtB,EAEF,cAAK,EAAE,EAAC,mBAAmB,YACzB,KAAC,iBAAiB,IAChB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAC3C,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,sBAAsB,EAAE,GAChD,GACE,EAEN,cAAK,EAAE,EAAC,uBAAuB,YAC7B,KAAC,oBAAoB,IACnB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEN,cAAK,EAAE,EAAC,gBAAgB,YACtB,KAAC,gBAAgB,IACf,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,EACrC,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEL,SAAS,KAAK,OAAO,IAAI,CACxB,YAAG,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,oEAEhD,CACL,EAED,KAAC,eAAe,IACd,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EACzB,OAAO,EAAE,KAAK,GACd,IACE,CACP,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -58,6 +58,7 @@
     "cmdk": "^1.1.1",
     "lowlight": "^3.0.0",
     "lucide-react": "^1.7.0",
+    "qrcode.react": "^4.2.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "recharts": "^3.8.1",
@@ -87,7 +88,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.37.0",
+    "@actuate-media/cms-core": "0.38.0",
     "@actuate-media/component-blocks": "0.2.0"
   },
   "scripts": {

package/src/AdminRoot.tsx

@@ -10,6 +10,7 @@ import { CollectionList } from './views/CollectionList.js'
 import { DocumentEdit } from './views/DocumentEdit.js'
 import { MediaBrowser } from './views/MediaBrowser.js'
 import { Settings } from './views/Settings.js'
+import { Profile } from './views/Profile.js'
 import { Forms } from './views/Forms.js'
 import { FormEditor } from './views/FormEditor.js'
 import { FormSubmissions } from './views/FormSubmissions.js'
@@ -56,6 +57,16 @@ export interface AdminRootProps {
     email: string,
     password: string,
     captchaToken?: string,
+  ) => Promise<{
+    success: boolean
+    error?: string
+    requiresTOTP?: boolean
+    mfaPendingToken?: string
+  }>
+  /** Completes the TOTP second-factor step for accounts with MFA enabled. */
+  onVerifyTotp?: (
+    mfaPendingToken: string,
+    code: string,
   ) => Promise<{ success: boolean; error?: string }>
   captchaConfig?: { provider: 'recaptcha' | 'turnstile' | 'none'; siteKey: string | null }
 }
@@ -68,6 +79,7 @@ function AdminShell({
   setupRequired,
   onSetupComplete,
   onLogin,
+  onVerifyTotp,
   captchaConfig,
 }: AdminRootProps) {
   const { currentPath, navigate, matchRoute, buildHref } = useAdminRouter(basePath, initialPath)
@@ -197,6 +209,7 @@ function AdminShell({
       return (
         <Login
           onLogin={onLogin}
+          onVerifyTotp={onVerifyTotp}
           onNavigate={navigate}
           captchaConfig={captchaConfig}
           branding={branding}
@@ -437,6 +450,10 @@ function AdminShell({
       return <Settings onNavigate={navigate} config={config} session={session} />
     }
 
+    if (matchRoute('/profile')) {
+      return <Profile onNavigate={navigate} session={session} />
+    }
+
     // Page Builder routes — explicit /page-builder/* takes precedence over
     // the collection-derived routing below, but we ALSO route a collection
     // declared as `type: 'page'` through the Page Builder by default.
@@ -467,6 +484,7 @@ function AdminShell({
       'widgets',
       'users',
       'settings',
+      'profile',
       'page-builder',
       'collections',
       // `pages` is reserved so the Pages list/editor/tag routes above

package/src/__tests__/views/account-security.render.test.tsx

@@ -0,0 +1,140 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+/**
+ * Exercises the per-user MFA enrollment loop in AccountSecurity against a
+ * mocked auth API:
+ *   GET  /auth/me           → current totpEnabled state
+ *   POST /auth/totp/setup   → provisioning URI + one-time backup codes
+ *   POST /auth/totp/verify  → flips MFA on
+ *   POST /auth/totp/disable → turns MFA off
+ */
+interface ApiCall {
+  endpoint: string
+  options?: { method?: string; headers?: Record<string, string>; body?: unknown }
+}
+
+let totpEnabled = false
+const calls: ApiCall[] = []
+
+const cmsApi = vi.fn(async (endpoint: string, options?: ApiCall['options']) => {
+  calls.push({ endpoint, options })
+  const method = options?.method ?? 'GET'
+  if (endpoint === '/auth/me') return { data: { totpEnabled }, status: 200 }
+  if (endpoint === '/auth/totp/setup' && method === 'POST') {
+    const pw = options?.headers?.['x-reauth-password']
+    if (!pw || pw === 'wrong') return { error: 'Re-authentication failed.', status: 401 }
+    return {
+      data: {
+        uri: 'otpauth://totp/Actuate%20CMS:admin@example.com?secret=ABCDEF',
+        secret: 'ABCDEF234567',
+        backupCodes: ['aaaa1111', 'bbbb2222', 'cccc3333', 'dddd4444'],
+      },
+      status: 200,
+    }
+  }
+  if (endpoint === '/auth/totp/verify' && method === 'POST') {
+    totpEnabled = true
+    return { data: { enabled: true }, status: 200 }
+  }
+  if (endpoint === '/auth/totp/disable' && method === 'POST') {
+    totpEnabled = false
+    return { data: { enabled: false }, status: 200 }
+  }
+  return { data: {}, status: 200 }
+})
+
+vi.mock('../../lib/api.js', () => ({ cmsApi: (e: string, o?: unknown) => cmsApi(e, o as any) }))
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }))
+vi.mock('qrcode.react', () => ({
+  QRCodeSVG: ({ value }: { value: string }) => <svg data-testid="qr" data-value={value} />,
+}))
+
+const { AccountSecurity } = await import('../../views/profile/AccountSecurity.js')
+
+beforeEach(() => {
+  cmsApi.mockClear()
+  calls.length = 0
+  totpEnabled = false
+})
+
+describe('AccountSecurity — enrollment', () => {
+  it('walks through reauth → QR + backup codes → verify and enables MFA', async () => {
+    render(<AccountSecurity />)
+    await screen.findByText('Not set up')
+
+    fireEvent.click(screen.getByRole('button', { name: /Set up two-factor/i }))
+
+    // Reauth step: enter current password.
+    const pw = await screen.findByLabelText('Current password')
+    fireEvent.change(pw, { target: { value: 'correct-horse' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Continue' }))
+
+    // Setup posts the password as a reauth header.
+    await waitFor(() =>
+      expect(
+        calls.some(
+          (c) =>
+            c.endpoint === '/auth/totp/setup' &&
+            c.options?.headers?.['x-reauth-password'] === 'correct-horse',
+        ),
+      ).toBe(true),
+    )
+
+    // Enrollment step shows the QR, the manual key and the backup codes.
+    await screen.findByTestId('qr')
+    expect(screen.getByText('ABCDEF234567')).toBeTruthy()
+    expect(screen.getByText('aaaa1111')).toBeTruthy()
+
+    // Verify is gated on acknowledging the backup codes + a 6-digit code.
+    const verify = screen.getByRole('button', { name: /Verify & enable/i }) as HTMLButtonElement
+    expect(verify.disabled).toBe(true)
+
+    fireEvent.click(screen.getByLabelText(/saved my backup codes/i))
+    fireEvent.change(screen.getByLabelText('Authentication code'), { target: { value: '123456' } })
+    expect(verify.disabled).toBe(false)
+    fireEvent.click(verify)
+
+    await waitFor(() =>
+      expect(
+        calls.some(
+          (c) =>
+            c.endpoint === '/auth/totp/verify' && String(c.options?.body ?? '').includes('123456'),
+        ),
+      ).toBe(true),
+    )
+    await screen.findByText('Enabled')
+  })
+
+  it('surfaces a reauth failure without advancing to the QR step', async () => {
+    render(<AccountSecurity />)
+    await screen.findByText('Not set up')
+
+    fireEvent.click(screen.getByRole('button', { name: /Set up two-factor/i }))
+    const pw = await screen.findByLabelText('Current password')
+    fireEvent.change(pw, { target: { value: 'wrong' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Continue' }))
+
+    await screen.findByText('Re-authentication failed.')
+    expect(screen.queryByTestId('qr')).toBeNull()
+  })
+})
+
+describe('AccountSecurity — disable', () => {
+  it('shows Enabled and disables with a password confirmation', async () => {
+    totpEnabled = true
+    render(<AccountSecurity />)
+    await screen.findByText('Enabled')
+
+    fireEvent.click(screen.getByRole('button', { name: /Disable two-factor/i }))
+    const pw = await screen.findByLabelText('Current password')
+    fireEvent.change(pw, { target: { value: 'correct-horse' } })
+    // The confirm button is the destructive one inside the panel.
+    const confirmButtons = screen.getAllByRole('button', { name: /Disable two-factor/i })
+    fireEvent.click(confirmButtons[confirmButtons.length - 1]!)
+
+    await waitFor(() => expect(calls.some((c) => c.endpoint === '/auth/totp/disable')).toBe(true))
+    await screen.findByText('Not set up')
+  })
+})

package/src/__tests__/views/login-mfa.render.test.tsx

@@ -0,0 +1,88 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+import { Login } from '../../views/Login.js'
+
+/**
+ * The login screen must advance to a second-factor challenge when the account
+ * has MFA enabled (`onLogin` returns `requiresTOTP` + `mfaPendingToken`), and
+ * must complete it via `onVerifyTotp` — including the backup-code fallback.
+ */
+function fillCredentials() {
+  fireEvent.change(screen.getByLabelText('Email Address'), {
+    target: { value: 'admin@example.com' },
+  })
+  fireEvent.change(screen.getByLabelText('Password'), { target: { value: 'pw' } })
+}
+
+describe('Login — MFA challenge', () => {
+  it('shows the TOTP step after the password step requires it', async () => {
+    const onLogin = vi.fn(async () => ({
+      success: false,
+      requiresTOTP: true,
+      mfaPendingToken: 'pending-token',
+    }))
+    const onVerifyTotp = vi.fn(async () => ({ success: true }))
+
+    render(<Login onLogin={onLogin} onVerifyTotp={onVerifyTotp} />)
+    fillCredentials()
+    fireEvent.click(screen.getByRole('button', { name: 'Sign In' }))
+
+    await screen.findByText('Two-factor authentication')
+
+    fireEvent.change(screen.getByLabelText('Authentication code'), { target: { value: '654321' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Verify' }))
+
+    await waitFor(() => expect(onVerifyTotp).toHaveBeenCalledWith('pending-token', '654321'))
+  })
+
+  it('supports the backup-code fallback', async () => {
+    const onLogin = vi.fn(async () => ({
+      success: false,
+      requiresTOTP: true,
+      mfaPendingToken: 'pending-token',
+    }))
+    const onVerifyTotp = vi.fn(async () => ({ success: true }))
+
+    render(<Login onLogin={onLogin} onVerifyTotp={onVerifyTotp} />)
+    fillCredentials()
+    fireEvent.click(screen.getByRole('button', { name: 'Sign In' }))
+    await screen.findByText('Two-factor authentication')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Use a backup code' }))
+    fireEvent.change(screen.getByLabelText('Backup code'), { target: { value: 'aaaa1111' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Verify' }))
+
+    await waitFor(() => expect(onVerifyTotp).toHaveBeenCalledWith('pending-token', 'aaaa1111'))
+  })
+
+  it('shows an error returned from the verify step', async () => {
+    const onLogin = vi.fn(async () => ({
+      success: false,
+      requiresTOTP: true,
+      mfaPendingToken: 'pending-token',
+    }))
+    const onVerifyTotp = vi.fn(async () => ({ success: false, error: 'Invalid code' }))
+
+    render(<Login onLogin={onLogin} onVerifyTotp={onVerifyTotp} />)
+    fillCredentials()
+    fireEvent.click(screen.getByRole('button', { name: 'Sign In' }))
+    await screen.findByText('Two-factor authentication')
+
+    fireEvent.change(screen.getByLabelText('Authentication code'), { target: { value: '000000' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Verify' }))
+
+    await screen.findByText('Invalid code')
+  })
+
+  it('does not show the challenge for a normal successful login', async () => {
+    const onLogin = vi.fn(async () => ({ success: true }))
+    render(<Login onLogin={onLogin} />)
+    fillCredentials()
+    fireEvent.click(screen.getByRole('button', { name: 'Sign In' }))
+
+    await waitFor(() => expect(onLogin).toHaveBeenCalled())
+    expect(screen.queryByText('Two-factor authentication')).toBeNull()
+  })
+})

package/src/components/Breadcrumbs.tsx

@@ -14,6 +14,7 @@ const LABEL_MAP: Record<string, string> = {
   users: 'Users',
   'script-tags': 'Script Tags',
   settings: 'Settings',
+  profile: 'Your Profile',
   collections: 'Collections',
   submissions: 'Submissions',
   new: 'New',