mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-09-16 14:57:15 +00:00
a40051daf1
- store the per-Account shared secret encrypted at rest (Fernet keyed off the instance JWT secret via HKDF); never persist it in plaintext - store recovery codes only as salted PBKDF2-HMAC-SHA256 digests - add TotpService covering enrol / verify / disable and recovery-code use - expose the login second-factor challenge (code `totp_required`) and the recovery-code path in the auth / reset flows - add the `totp_credentials` migration (0025, revises 0024_passkey_credentials) - web: TOTP challenge step on login, TOTP / recovery-code methods on reset-password, TotpEnrollDialog in account settings, i18n for all locales
Debug LangBot Frontend
Please refer to the Development Guide for more information.
Tests
Run the frontend smoke tests without a backend process:
pnpm test:e2e
The Playwright suite starts Vite and mocks the LangBot backend and Space APIs.