thevoidforge 21.0.9 → 21.0.10

package/dist/wizard/api/auth.js

@@ -9,8 +9,8 @@ import { audit } from '../lib/audit-log.js';
 import { sendJson } from '../lib/http-helpers.js';
 // POST /api/auth/setup — Create initial admin user (only when no users exist)
 addRoute('POST', '/api/auth/setup', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 400, { success: false, error: 'Auth setup is only available in remote mode' });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 400, { success: false, error: 'Auth setup is only available in remote or LAN mode' });
         return;
     }
     // Rate-limit the setup endpoint (prevents race-to-setup attacks)
@@ -58,8 +58,8 @@ addRoute('POST', '/api/auth/setup', async (req, res) => {
 });
 // POST /api/auth/login — Authenticate with username + password + TOTP
 addRoute('POST', '/api/auth/login', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 400, { success: false, error: 'Auth is only required in remote mode' });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 400, { success: false, error: 'Auth is only required in remote or LAN mode' });
         return;
     }
     const body = await parseJsonBody(req);
@@ -68,19 +68,25 @@ addRoute('POST', '/api/auth/login', async (req, res) => {
         return;
     }
     const { username, password, totpCode } = body;
-    if (typeof username !== 'string' || typeof password !== 'string' || typeof totpCode !== 'string') {
-        sendJson(res, 400, { success: false, error: 'username, password, and totpCode are required strings' });
+    if (typeof username !== 'string' || typeof password !== 'string') {
+        sendJson(res, 400, { success: false, error: 'username and password are required strings' });
+        return;
+    }
+    // LAN mode: TOTP is optional (password-only auth)
+    const requireTotp = isRemoteMode();
+    const totp = typeof totpCode === 'string' ? totpCode : '';
+    if (requireTotp && (totp.length !== 6 || !/^\d{6}$/.test(totp))) {
+        sendJson(res, 400, { success: false, error: 'totpCode must be exactly 6 digits' });
         return;
     }
     // Cap field lengths to prevent DoS via oversized PBKDF2 input
-    // QA-R3-018 + CROSS-R4-010: TOTP must be exactly 6 digits per RFC 6238
-    if (username.length > 64 || password.length > 256 || totpCode.length !== 6 || !/^\d{6}$/.test(totpCode)) {
+    if (username.length > 64 || password.length > 256) {
         sendJson(res, 400, { success: false, error: 'Field length exceeded' });
         return;
     }
     const ip = getClientIp(req);
-    await audit('login_attempt', ip, username.slice(0, 64), { method: 'password+totp' });
-    const result = await login(username, password, totpCode, ip);
+    await audit('login_attempt', ip, username.slice(0, 64), { method: requireTotp ? 'password+totp' : 'password' });
+    const result = await login(username, password, totp, ip);
     if ('error' in result) {
         await audit('login_failure', ip, username.slice(0, 64), { reason: result.error });
         const status = result.retryAfterMs ? 429 : 401;

package/dist/wizard/ui/login.js

@@ -92,12 +92,19 @@
 
     try {
       const data = await setupAccount(username, password);
-      // Show TOTP setup
-      setupStatus.textContent = '';
-      setupStatus.className = 'status-row';
-      totpSecret.textContent = data.totpSecret;
-      totpSetup.style.display = 'block';
-      setupSubmit.style.display = 'none';
+      if (requireTotp && data.totpSecret) {
+        // Show TOTP setup (remote mode)
+        setupStatus.textContent = '';
+        setupStatus.className = 'status-row';
+        totpSecret.textContent = data.totpSecret;
+        totpSetup.style.display = 'block';
+        setupSubmit.style.display = 'none';
+      } else {
+        // LAN mode — skip TOTP, go straight to login
+        setupStatus.textContent = 'Account created. Please log in.';
+        setupStatus.className = 'status-row success';
+        setTimeout(function () { showLogin(); }, 1000);
+      }
     } catch (err) {
       setupStatus.textContent = err.message;
       setupStatus.className = 'status-row error';
@@ -111,7 +118,15 @@
 
   // ── Login flow ─────────────────────────────────────
 
-  // TOTP field is always visible (removed conditional show — accessibility fix)
+  // Detect if TOTP is required (remote mode) or optional (LAN mode)
+  var requireTotp = true;
+  fetch('/api/auth/session').then(function (r) { return r.json(); }).then(function (d) {
+    var data = d.data || {};
+    if (data.lanMode && !data.remoteMode) {
+      requireTotp = false;
+      if (totpField) totpField.style.display = 'none';
+    }
+  }).catch(function () {});
 
   loginSubmit.addEventListener('click', async () => {
     const username = loginUsername.value.trim();
@@ -123,7 +138,7 @@
       loginStatus.className = 'status-row error';
       return;
     }
-    if (!totp || totp.length !== 6) {
+    if (requireTotp && (!totp || totp.length !== 6)) {
       loginStatus.textContent = 'Enter your 6-digit authenticator code';
       loginStatus.className = 'status-row error';
       loginTotp.focus();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge",
-  "version": "21.0.9",
+  "version": "21.0.10",
   "description": "From nothing, everything. A methodology framework for building with Claude Code.",
   "type": "module",
   "engines": {