mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-24 19:32:10 +00:00
xarmian
022280a1ee
handleDeleteAccount previously verified only the password (or, in cloud mode, a confirm-only session) and never re-checked TOTP even when the account had 2FA enabled. That made an irreversible account destroy a lower bar than login for 2FA users — a hijacked live session (cloud confirm-only needs no password) could wipe the account. Add an optional totp_code to the delete-account request body. When the authenticated user has TOTP enabled, require and verify the code server-side (via the existing totp.Validate path used by login and 2FA disable) AFTER the password/confirm identity check and BEFORE the Stripe cancel + local delete — so neither the password nor the cloud-confirm path can bypass it, and a failed code never leaks a cancel RPC. Missing code → 400 totp_required; wrong code → 401 totp_invalid. Users without TOTP are unaffected (no code required, same behavior as before). Tests cover TOTP-enabled + valid code (success), missing code (totp_required), invalid code (totp_invalid), and non-TOTP (unaffected), reusing the fakeSidecar + bootstrapAccountDeleteUser + deleteAccountReq harness. Closes TASK-1958 Claude-Session: https://claude.ai/code/session_01HxBkAMiFBtCRJ2tKSCt3ST