@scalio-cloud/ui 0.31.0 → 0.32.0

package/README.md

@@ -319,9 +319,13 @@ sorts the group `system` that way). The reset block talks to scalio-platform `fa
 import { FactoryReset, factoryResetApi, SettingsField, SettingsRow } from "@scalio-cloud/ui/react";
 
 const reset = factoryResetApi(api);   // once, outside the component
-<FactoryReset client={reset} lang={lang} tokenKey="citadel_token" backupTo="/settings/backup" link={Link} />
+<FactoryReset client={reset} lang={lang} tokenKey="citadel_token" backupTo="/settings/backup" accountTo="/profile" link={Link} />
 ```
 
+Since 0.32.0 (N21, security review 2026-10-27) the reset needs the code of the signed-in admin's authenticator app
+or a backup code (`code` in the request, scalio-platform 0.11.0). Without a second factor the block says so and links
+to `accountTo` (the profile page) instead of allowing the reset.
+
 `SettingsField` (label, field, help) and `SettingsRow` (title and help left, a switch or button right; `tone="danger"`)
 keep the fields inside a `SettingsSection` the same in every app.
 

package/auth.css

@@ -102,7 +102,7 @@
   padding: 1.5rem 0; border-top: 1px solid hsl(var(--border));
 }
 .scalio-profile-section:first-of-type { border-top: 0; padding-top: 0; }
-@media (min-width: 768px) { .scalio-profile-section { grid-template-columns: minmax(0, 1fr) minmax(0, 2fr); gap: 2rem; } }
+@media (min-width: 768px) { .scalio-profile-section { grid-template-columns: minmax(0, 1fr) minmax(0, 3fr); gap: 2rem; } }
 .scalio-profile-section-title {
   margin: 0; font-family: 'Chivo', sans-serif; font-weight: 900; font-size: 0.875rem;
   text-transform: uppercase; letter-spacing: 0.02em;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalio-cloud/ui",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Scalio Control Room design tokens, Tailwind preset, self-hosted fonts, the shared app header, sign-in layout, sidebar and page blocks",
   "license": "SEE LICENSE IN README.md",
   "private": false,

package/react/labels.js

@@ -336,6 +336,9 @@ const LABELS = {
       removeLicense: "Lizenz ebenfalls entfernen",
       removeLicenseHint: "Danach läuft die Instanz als freie Edition, bis wieder ein Lizenzschlüssel eingetragen ist. Die Installations-ID bleibt.",
       password: "Ihr Passwort",
+      code: "Code aus der Authenticator-App oder Backup-Code",
+      noFactor: "Zum Zurücksetzen braucht Ihr Konto eine Authenticator-App; richten Sie sie zuerst im Profil ein. Ein Konto, das sich nur mit Microsoft anmeldet, kann nicht zurücksetzen: Das macht ein lokaler Admin mit Authenticator-App.",
+      setUpFactor: "Zum Profil",
       run: "Auf Werkseinstellungen zurücksetzen",
     },
     license: {
@@ -744,6 +747,9 @@ const LABELS = {
       removeLicense: "Remove the license as well",
       removeLicenseHint: "Afterwards the instance runs as the free edition until a license key is entered again. The installation ID stays.",
       password: "Your password",
+      code: "Code from the authenticator app or a backup code",
+      noFactor: "To reset, your account needs an authenticator app; set it up in your profile first. An account that signs in only with Microsoft cannot reset: a local admin with an authenticator app does it.",
+      setUpFactor: "Go to profile",
       run: "Reset to factory settings",
     },
     license: {

package/react/maintenance.js

@@ -32,6 +32,7 @@ function FactoryReset(props) {
   const [info, setInfo] = React.useState(null);
   const [confirm, setConfirm] = React.useState("");
   const [password, setPassword] = React.useState("");
+  const [code, setCode] = React.useState("");
   const [removeLicense, setRemoveLicense] = React.useState(false);
   const [busy, setBusy] = React.useState(false);
   const [error, setError] = React.useState("");
@@ -42,14 +43,17 @@ function FactoryReset(props) {
     return () => { alive = false; };
   }, [client]);
 
-  const ready = confirm.trim() === "RESET" && (!info || !info.password || !!password);
+  // N21: the backend says second_factor true (code needed) or false (set one up first); an older backend says nothing.
+  const factor = info ? info.second_factor : undefined;
+  const ready = confirm.trim() === "RESET" && (!info || !info.password || !!password)
+    && factor !== false && (factor !== true || !!code.trim());
   const run = async (e) => {
     e.preventDefault();
     if (!ready) return;
     setBusy(true);
     setError("");
     try {
-      await client.run({ confirm, password, remove_license: removeLicense });
+      await client.run({ confirm, password, code, remove_license: removeLicense });
       try { if (props.tokenKey) window.localStorage.removeItem(props.tokenKey); } catch (x) { /* private mode */ }
       if (props.onDone) props.onDone();
       else window.location.href = "/login";
@@ -94,6 +98,19 @@ function FactoryReset(props) {
                 h("input", { id: "factory-reset-password", type: "password", className: "scalio-input", value: password, disabled: busy,
                   autoComplete: "current-password", "data-testid": "factory-reset-password", onChange: (e) => setPassword(e.target.value) }))
             : null,
+          factor === true
+            ? h(Field, { id: "factory-reset-code", label: L.code },
+                h("input", { id: "factory-reset-code", className: "scalio-input", value: code, disabled: busy, inputMode: "numeric",
+                  autoComplete: "one-time-code", "data-testid": "factory-reset-code", onChange: (e) => setCode(e.target.value) }))
+            : null,
+          factor === false
+            ? h("div", { className: "scalio-notice is-warn", "data-testid": "factory-reset-no-factor" },
+                h("span", null, L.noFactor),
+                props.accountTo && info.password
+                  ? h(props.link || "a", Object.assign({ className: "scalio-btn" },
+                      props.link ? { to: props.accountTo } : { href: props.accountTo }), L.setUpFactor)
+                  : null)
+            : null,
           error ? h("div", { className: "scalio-notice is-error", role: "alert", "data-testid": "factory-reset-error" }, error) : null,
           h("div", { className: "scalio-settings-section-footer" },
             h("button", { type: "submit", className: "scalio-btn is-danger is-solid", disabled: busy || !ready, "data-testid": "factory-reset-run" },