moontraze 2.0.4 → 2.0.5

package/lib/auth.js

@@ -68,11 +68,23 @@ async function loginWithEmail({ apiUrl, label }) {
   });
 
   const data = await res.json().catch(() => ({}));
+
   if (!res.ok) throw new Error(data.error || 'Invalid email or password');
+
+  // ---------- TOTP required ----------
+  if (data.requiresTotp && data.loginTicket) {
+    const token = await promptAndVerifyTotp({
+      apiUrl,
+      loginTicket: data.loginTicket,
+      label,
+    });
+    await saveAndValidateToken(token, { apiUrl, label });
+    return;
+  }
+
   if (!data.token) throw new Error('Login succeeded but no token returned');
 
   setConfig({ token: data.token, apiUrl });
-
   console.log('');
   console.log(chalk.green('✓ Logged in'));
   if (data.user?.email) console.log(chalk.gray(` ${data.user.email}`));
@@ -123,12 +135,33 @@ async function loginWithMoonID({ apiUrl, label }) {
   console.log(chalk.gray('Waiting for approval... (Ctrl+C to cancel)'));
   console.log('');
 
-  const token = await pollWebStatus({ apiUrl, state, timeoutMs: 180000 });
-  if (!token) throw new Error('MoonID login timed out or denied');
+  const result = await pollWebStatus({ apiUrl, state, timeoutMs: 180000 });
 
-  await saveAndValidateToken(token, { apiUrl, label });
+  if (!result) throw new Error('MoonID login timed out or denied');
+
+  // ---------- TOTP required ----------
+  if (result.requiresTotp && result.loginTicket) {
+    const token = await promptAndVerifyTotp({
+      apiUrl,
+      loginTicket: result.loginTicket,
+      label,
+    });
+    await saveAndValidateToken(token, { apiUrl, label });
+    return;
+  }
+
+  if (!result.token) throw new Error('MoonID login succeeded but no token returned');
+
+  await saveAndValidateToken(result.token, { apiUrl, label });
 }
 
+/**
+ * Poll /moonid/status
+ * Returns:
+ *   { token }                    → success
+ *   { requiresTotp, loginTicket } → need authenticator code
+ *   null                         → timeout
+ */
 async function pollWebStatus({ apiUrl, state, timeoutMs }) {
   const fetch = require('node-fetch');
   const start = Date.now();
@@ -136,18 +169,26 @@ async function pollWebStatus({ apiUrl, state, timeoutMs }) {
 
   while (Date.now() - start < timeoutMs) {
     await new Promise((r) => setTimeout(r, interval));
+
     try {
       const res = await fetch(
         `${apiUrl}/api/platform/moonid/status?state=${encodeURIComponent(state)}`
       );
       const data = await res.json().catch(() => ({}));
 
-      if (
-        (data.status === 'success' || data.status === 'done') &&
-        data.token
-      ) {
-        return data.token;
+      if ((data.status === 'success' || data.status === 'done') && data.token) {
+        return { token: data.token };
       }
+
+      // Authenticator required
+      if (data.status === 'requires_totp' && data.loginTicket) {
+        return {
+          requiresTotp: true,
+          loginTicket: data.loginTicket,
+          user: data.user,
+        };
+      }
+
       if (data.status === 'error' || data.status === 'denied') {
         throw new Error(data.error || 'MoonID login denied');
       }
@@ -160,9 +201,54 @@ async function pollWebStatus({ apiUrl, state, timeoutMs }) {
       }
     }
   }
+
   return null;
 }
 
+/**
+ * Prompt for 6-digit code and verify against loginTicket
+ */
+async function promptAndVerifyTotp({ apiUrl, loginTicket, label }) {
+  console.log('');
+  console.log(chalk.yellow('MOON Authenticator required'));
+  console.log(chalk.gray('Enter the 6-digit code from the MOON Authenticator app'));
+  console.log('');
+
+  const { code } = await prompts({
+    type: 'text',
+    name: 'code',
+    message: 'Authenticator code',
+    validate: (v) =>
+      /^\d{6}$/.test(String(v || '').trim())
+        ? true
+        : 'Enter a valid 6-digit code',
+  });
+
+  if (!code) throw new Error('Login cancelled');
+
+  const fetch = require('node-fetch');
+  const res = await fetch(`${apiUrl}/api/authenticator/verify-login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      loginTicket,
+      code: String(code).trim(),
+    }),
+  });
+
+  const data = await res.json().catch(() => ({}));
+
+  if (!res.ok) {
+    throw new Error(data.error || 'Invalid authenticator code');
+  }
+
+  if (!data.token) {
+    throw new Error('Verification succeeded but no token returned');
+  }
+
+  return data.token;
+}
+
 async function saveAndValidateToken(token, { apiUrl, label }) {
   const fetch = require('node-fetch');
   const res = await fetch(`${apiUrl}/api/hosting/quota`, {
@@ -174,7 +260,6 @@ async function saveAndValidateToken(token, { apiUrl, label }) {
   }
 
   setConfig({ token, apiUrl });
-
   console.log('');
   console.log(chalk.green('✓ Logged in'));
   console.log(chalk.gray(` Config: ${GLOBAL_FILE}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moontraze",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "Deploy to Moontraze hosting",
   "main": "./bin/moontraze.js",
   "bin": {