Modification des pages d'authentification

2026-06-14 21:58:05 +02:00
parent dc28b12c27
commit 9f6363ec20
20 changed files with 2494 additions and 172 deletions
@@ -48,13 +48,24 @@ const router = Router();
 /** Liste tous les utilisateurs */
 router.get('/users', (req, res) => {
  const users = db.prepare(`
-    SELECT id, email, display_name, role, created_at
+    SELECT id, email, display_name, role, email_verified, created_at
    FROM users
    ORDER BY id ASC
  `).all();
  res.json(users);
 });

+/** Vérifier manuellement l'email d'un utilisateur */
+router.patch('/users/:id/verify-email', (req, res, next) => {
+  try {
+    const targetId = Number(req.params.id);
+    const r = db.prepare("UPDATE users SET email_verified=1, updated_at=datetime('now') WHERE id=?").run(targetId);
+    if (r.changes === 0) throw new HttpError(404, 'Utilisateur introuvable');
+    db.prepare('UPDATE email_verification_tokens SET used=1 WHERE user_id=? AND used=0').run(targetId);
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
 /** Crée un utilisateur */
 const CreateUserSchema = z.object({
  email:       z.string().email(),
@@ -387,7 +398,7 @@ router.get('/smtp', (req, res) => {
    username:    row.username    || '',
    hasPassword: !!(row.password),
    allowUnauth: !!row.allow_unauth,
-    appName:     row.app_name   || 'Crowdlending',
+    appName:     row.app_name   || 'Crowdlending Tracker',
    appUrl:      row.app_url    || '',
  });
 });
@@ -450,7 +461,7 @@ router.put('/smtp', (req, res, next) => {
      body.username    ?? null,
      passwordToStore,
      body.allowUnauth ? 1 : 0,
-      body.appName     ?? 'Crowdlending',
+      body.appName     ?? 'Crowdlending Tracker',
      body.appUrl      ?? '',
    );

@@ -1,9 +1,11 @@
 import { Router } from 'express';
 import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
 import { z } from 'zod';
 import db from '../db/index.js';
 import { signToken, requireAuth } from '../middleware/auth.js';
 import { HttpError } from '../middleware/errorHandler.js';
+import { sendMail, buildEmailHtml, getSmtpConfig } from '../utils/mailer.js';

 const router = Router();

@@ -18,7 +20,7 @@ const LoginSchema = z.object({
  password: z.string().min(1),
 });

-router.post('/register', (req, res, next) => {
+router.post('/register', async (req, res, next) => {
  try {
    const body = RegisterSchema.parse(req.body);
    const exists = db.prepare('SELECT id FROM users WHERE email = ?').get(body.email);
@@ -28,10 +30,15 @@ router.post('/register', (req, res, next) => {
    const isFirst = db.prepare('SELECT COUNT(*) AS n FROM users').get().n === 0;
    const role = isFirst ? 'admin' : 'user';

+    // Le 1er utilisateur (admin) est auto-vérifié ; les suivants si SMTP désactivé
+    const cfg = getSmtpConfig();
+    const smtpReady = cfg.enabled && cfg.host && cfg.email;
+    const autoVerified = isFirst || !smtpReady ? 1 : 0;
+
    const hash = bcrypt.hashSync(body.password, 10);
    const result = db
-      .prepare('INSERT INTO users (email, password_hash, display_name, role) VALUES (?, ?, ?, ?)')
-      .run(body.email, hash, body.displayName || null, role);
+      .prepare('INSERT INTO users (email, password_hash, display_name, role, email_verified) VALUES (?, ?, ?, ?, ?)')
+      .run(body.email, hash, body.displayName || null, role, autoVerified);

    const userId = result.lastInsertRowid;

@@ -47,36 +54,104 @@ router.post('/register', (req, res, next) => {
      'INSERT INTO comptes (user_id, nom, type, investisseur_id) VALUES (?,?,?,?)'
    ).run(userId, `Compte courant — ${fullName}`, 'compte_courant', invResult.lastInsertRowid);

+    // Si l'utilisateur doit vérifier son email → envoyer l'email de bienvenue
+    if (!autoVerified) {
+      const vToken    = crypto.randomBytes(32).toString('hex');
+      const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+      db.prepare('INSERT INTO email_verification_tokens (user_id, token, expires_at) VALUES (?,?,?)').run(userId, vToken, expiresAt);
+
+      const appUrl = cfg.appUrl?.replace(/\/$/, '') || '';
+      try {
+        await sendMail({
+          to:      body.email,
+          subject: `Bienvenue sur ${cfg.appName} — Vérifiez votre adresse email`,
+          html: buildEmailHtml({
+            title: `Bienvenue ${prenom || ''} !`,
+            body: `<p>Votre compte a été créé avec succès. Pour commencer à utiliser ${cfg.appName}, veuillez confirmer votre adresse email en cliquant sur le bouton ci-dessous.</p>
+                   <p>Ce lien est valable <strong>24 heures</strong>.</p>`,
+            ctaLabel: 'Vérifier mon adresse email',
+            ctaUrl:   `${appUrl}/verify-email?token=${vToken}`,
+          }),
+        });
+      } catch (mailErr) {
+        console.error('[auth] Échec envoi email bienvenue:', mailErr.message);
+        // Ne pas faire échouer l'inscription si le mail échoue
+      }
+
+      return res.status(201).json({ requiresVerification: true, email: body.email });
+    }
+
    const token = signToken({ sub: userId, email: body.email });
    res.status(201).json({
      token,
-      user: { id: userId, email: body.email, displayName: body.displayName || null, role },
+      user: { id: userId, email: body.email, displayName: body.displayName || null, role, email_verified: 1 },
    });
  } catch (e) { next(e); }
 });

-router.post('/login', (req, res, next) => {
+const LoginSchema2FA = LoginSchema.extend({
+  deviceToken: z.string().optional(),
+});
+
+router.post('/login', async (req, res, next) => {
  try {
-    const body = LoginSchema.parse(req.body);
+    const body = LoginSchema2FA.parse(req.body);
    const user = db
-      .prepare('SELECT id, email, password_hash, display_name, role FROM users WHERE email = ?')
+      .prepare('SELECT id, email, password_hash, display_name, role, email_verified, totp_enabled FROM users WHERE email = ?')
      .get(body.email);
    if (!user) throw new HttpError(401, 'Invalid credentials');

    const ok = bcrypt.compareSync(body.password, user.password_hash);
    if (!ok) throw new HttpError(401, 'Invalid credentials');

+    if (!user.email_verified) {
+      return res.status(403).json({
+        error: 'Veuillez vérifier votre adresse email avant de vous connecter.',
+        code:  'EMAIL_NOT_VERIFIED',
+        email: user.email,
+      });
+    }
+
+    // ── 2FA ──────────────────────────────────────────────────────────────
+    if (user.totp_enabled) {
+      // Vérifier si l'appareil est déjà de confiance
+      if (body.deviceToken) {
+        const dev = db.prepare(
+          'SELECT id FROM two_fa_trusted_devices WHERE token = ? AND user_id = ? AND expires_at > datetime(\'now\')'
+        ).get(body.deviceToken, user.id);
+        if (dev) {
+          // Appareil de confiance — émettre le JWT directement
+          const token = signToken({ sub: user.id, email: user.email });
+          return res.json({
+            token,
+            user: { id: user.id, email: user.email, displayName: user.display_name, role: user.role, email_verified: 1, totp_enabled: 1 },
+          });
+        }
+      }
+
+      // Créer une session 2FA temporaire (5 minutes)
+      const sessionToken = crypto.randomBytes(32).toString('hex');
+      const expiresAt    = new Date(Date.now() + 5 * 60 * 1000).toISOString();
+      db.prepare('INSERT INTO two_fa_sessions (user_id, token, expires_at) VALUES (?,?,?)').run(user.id, sessionToken, expiresAt);
+
+      return res.json({
+        requires2FA: true,
+        sessionToken,
+        email: user.email,
+      });
+    }
+
    const token = signToken({ sub: user.id, email: user.email });
    res.json({
      token,
-      user: { id: user.id, email: user.email, displayName: user.display_name, role: user.role },
+      user: { id: user.id, email: user.email, displayName: user.display_name, role: user.role, email_verified: 1, totp_enabled: 0 },
    });
  } catch (e) { next(e); }
 });

 router.get('/me', requireAuth, (req, res) => {
  const user = db
-    .prepare('SELECT id, email, display_name, role FROM users WHERE id = ?')
+    .prepare('SELECT id, email, display_name, role, email_verified FROM users WHERE id = ?')
    .get(req.user.id);
  res.json({ user });
 });
@@ -88,12 +163,12 @@ const UpdateMeSchema = z.object({
  newPassword:     z.string().min(8).optional(),
 });

-router.put('/me', requireAuth, (req, res, next) => {
+router.put('/me', requireAuth, async (req, res, next) => {
  try {
    const body = UpdateMeSchema.parse(req.body);

    const current = db
-      .prepare('SELECT id, email, password_hash, display_name FROM users WHERE id = ?')
+      .prepare('SELECT id, email, password_hash, display_name, email_verified FROM users WHERE id = ?')
      .get(req.user.id);

    let newHash = undefined;
@@ -114,18 +189,331 @@ router.put('/me', requireAuth, (req, res, next) => {
    const newEmail        = body.email       ?? current.email;
    const newDisplayName  = body.displayName !== undefined ? body.displayName : current.display_name;
    const newPasswordHash = newHash ?? current.password_hash;
+    const emailChanged    = newEmail !== current.email;
+    const newEmailVerified = emailChanged ? 0 : (current.email_verified ?? 1);

    db.prepare(
-      "UPDATE users SET email=?, display_name=?, password_hash=?, updated_at=datetime('now') WHERE id=?"
-    ).run(newEmail, newDisplayName, newPasswordHash, req.user.id);
+      "UPDATE users SET email=?, display_name=?, password_hash=?, email_verified=?, updated_at=datetime('now') WHERE id=?"
+    ).run(newEmail, newDisplayName, newPasswordHash, newEmailVerified, req.user.id);

-    const token = newEmail !== current.email
-      ? signToken({ sub: req.user.id, email: newEmail })
-      : undefined;
+    // Si l'email change, envoyer un email de vérification sur la nouvelle adresse
+    if (emailChanged) {
+      const cfg = getSmtpConfig();
+      if (cfg.enabled && cfg.host) {
+        try {
+          db.prepare('UPDATE email_verification_tokens SET used=1 WHERE user_id=? AND used=0').run(req.user.id);
+          const vToken    = crypto.randomBytes(32).toString('hex');
+          const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+          db.prepare('INSERT INTO email_verification_tokens (user_id, token, expires_at) VALUES (?,?,?)').run(req.user.id, vToken, expiresAt);
+          const appUrl = cfg.appUrl?.replace(/\/$/, '') || '';
+          await sendMail({
+            to: newEmail,
+            subject: `Vérifiez votre nouvelle adresse email — ${cfg.appName}`,
+            html: buildEmailHtml({
+              title: 'Vérification de votre nouvel email',
+              body: `<p>Vous avez modifié votre adresse email. Cliquez ci-dessous pour confirmer cette nouvelle adresse.</p>`,
+              ctaLabel: 'Vérifier mon adresse email',
+              ctaUrl:   `${appUrl}/verify-email?token=${vToken}`,
+            }),
+          });
+        } catch (_) { /* Ne pas bloquer la réponse si SMTP échoue */ }
+      }
+    }
+
+    const newToken    = emailChanged ? signToken({ sub: req.user.id, email: newEmail }) : undefined;
+    const updatedUser = db.prepare('SELECT id, email, display_name, role, email_verified FROM users WHERE id=?').get(req.user.id);

    res.json({
-      user: { id: req.user.id, email: newEmail, display_name: newDisplayName },
-      ...(token ? { token } : {}),
+      user: updatedUser,
+      ...(newToken ? { token: newToken } : {}),
+      ...(emailChanged ? { requiresVerification: true } : {}),
+    });
+  } catch (e) { next(e); }
+});
+
+// ── Vérification d'adresse email ──────────────────────────────────────────
+router.get('/verify-email', (req, res, next) => {
+  try {
+    const token = req.query.token;
+    if (!token) throw new HttpError(400, 'Token manquant.');
+
+    const row = db.prepare(
+      `SELECT evt.*, u.id AS uid FROM email_verification_tokens evt
+       JOIN users u ON u.id = evt.user_id
+       WHERE evt.token = ? AND evt.used = 0`
+    ).get(token);
+
+    if (!row) throw new HttpError(400, 'Lien invalide ou déjà utilisé.');
+    if (new Date(row.expires_at) < new Date()) throw new HttpError(400, 'Ce lien a expiré. Demandez un nouvel email de vérification.');
+
+    db.prepare("UPDATE users SET email_verified=1, updated_at=datetime('now') WHERE id=?").run(row.uid);
+    db.prepare('UPDATE email_verification_tokens SET used=1 WHERE id=?').run(row.id);
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// ── Renvoi de l'email de vérification ─────────────────────────────────────
+router.post('/resend-verification', async (req, res, next) => {
+  try {
+    const { email } = z.object({ email: z.string().email() }).parse(req.body);
+    const user = db.prepare('SELECT id, email, display_name, email_verified FROM users WHERE email=?').get(email);
+
+    // Répondre OK même si l'email n'existe pas
+    if (!user || user.email_verified) return res.json({ ok: true });
+
+    const cfg = getSmtpConfig();
+    if (!cfg.enabled) throw new HttpError(503, "SMTP désactivé — impossible d'envoyer l'email.");
+
+    // Invalider les anciens tokens
+    db.prepare('UPDATE email_verification_tokens SET used=1 WHERE user_id=? AND used=0').run(user.id);
+
+    const vToken    = crypto.randomBytes(32).toString('hex');
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+    db.prepare('INSERT INTO email_verification_tokens (user_id, token, expires_at) VALUES (?,?,?)').run(user.id, vToken, expiresAt);
+
+    const appUrl = cfg.appUrl?.replace(/\/$/, '') || '';
+    const prenom = (user.display_name || user.email).split(' ')[0];
+
+    await sendMail({
+      to:      user.email,
+      subject: `Vérifiez votre adresse email — ${cfg.appName}`,
+      html: buildEmailHtml({
+        title: 'Confirmez votre adresse email',
+        body: `<p>Bonjour ${prenom},</p>
+               <p>Cliquez sur le bouton ci-dessous pour vérifier votre adresse email. Ce lien est valable <strong>24 heures</strong>.</p>`,
+        ctaLabel: 'Vérifier mon adresse email',
+        ctaUrl:   `${appUrl}/verify-email?token=${vToken}`,
+      }),
+    });
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// ── Mot de passe oublié ───────────────────────────────────────────────────
+router.post('/forgot-password', async (req, res, next) => {
+  try {
+    const { email } = z.object({ email: z.string().email() }).parse(req.body);
+    const user = db.prepare('SELECT id, email, display_name FROM users WHERE email = ?').get(email);
+
+    // Toujours répondre OK pour ne pas divulguer si l'email existe
+    if (!user) return res.json({ ok: true });
+
+    const cfg = getSmtpConfig();
+    if (!cfg.enabled) throw new HttpError(503, 'La réinitialisation par email n\'est pas disponible (SMTP désactivé).');
+
+    // Invalider les anciens tokens non utilisés
+    db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE user_id = ? AND used = 0').run(user.id);
+
+    // Générer un token sécurisé (1h de validité)
+    const token     = crypto.randomBytes(32).toString('hex');
+    const expiresAt = new Date(Date.now() + 60 * 60 * 1000).toISOString();
+    db.prepare('INSERT INTO password_reset_tokens (user_id, token, expires_at) VALUES (?, ?, ?)').run(user.id, token, expiresAt);
+
+    const appUrl   = cfg.appUrl?.replace(/\/$/, '') || '';
+    const resetUrl = `${appUrl}/reset-password?token=${token}`;
+    const prenom   = (user.display_name || user.email).split(' ')[0];
+
+    await sendMail({
+      to:      user.email,
+      subject: `Réinitialisation de votre mot de passe — ${cfg.appName}`,
+      html: buildEmailHtml({
+        title: 'Réinitialisation du mot de passe',
+        body: `<p>Bonjour ${prenom},</p>
+               <p>Vous avez demandé la réinitialisation de votre mot de passe. Cliquez sur le bouton ci-dessous pour en définir un nouveau. Ce lien est valable <strong>1 heure</strong>.</p>
+               <p>Si vous n'êtes pas à l'origine de cette demande, ignorez simplement cet email.</p>`,
+        ctaLabel: 'Réinitialiser mon mot de passe',
+        ctaUrl:   resetUrl,
+      }),
+    });
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// ── Réinitialisation du mot de passe ──────────────────────────────────────
+router.post('/reset-password', async (req, res, next) => {
+  try {
+    const { token, password } = z.object({
+      token:    z.string().min(1),
+      password: z.string().min(8),
+    }).parse(req.body);
+
+    const row = db.prepare(
+      `SELECT prt.*, u.id AS uid FROM password_reset_tokens prt
+       JOIN users u ON u.id = prt.user_id
+       WHERE prt.token = ? AND prt.used = 0`
+    ).get(token);
+
+    if (!row) throw new HttpError(400, 'Lien invalide ou déjà utilisé.');
+    if (new Date(row.expires_at) < new Date()) throw new HttpError(400, 'Ce lien a expiré. Faites une nouvelle demande.');
+
+    const hash = bcrypt.hashSync(password, 10);
+    db.prepare("UPDATE users SET password_hash = ?, updated_at = datetime('now') WHERE id = ?").run(hash, row.uid);
+    db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE id = ?').run(row.id);
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+
+// ════════════════════════════════════════════════════════════════════════════
+// ── 2FA — Configuration TOTP ─────────────────────────────────────────────
+// ════════════════════════════════════════════════════════════════════════════
+
+// GET /2fa/setup — génère un secret TOTP + QR code pour l'utilisateur
+router.get('/2fa/setup', requireAuth, async (req, res, next) => {
+  try {
+    const { authenticator } = await import('otplib');
+    const QRCode = (await import('qrcode')).default;
+
+    const cfg    = getSmtpConfig();
+    const issuer = cfg.appName || 'Crowdlending Tracker';
+    const user   = db.prepare('SELECT id, email, totp_secret, totp_enabled FROM users WHERE id=?').get(req.user.id);
+
+    // Générer un nouveau secret (ou réutiliser si setup pas encore confirmé)
+    const secret = (user.totp_enabled ? null : user.totp_secret) || authenticator.generateSecret();
+
+    if (!user.totp_enabled) {
+      db.prepare("UPDATE users SET totp_secret=? WHERE id=?").run(secret, req.user.id);
+    }
+
+    const uri     = authenticator.keyuri(user.email, issuer, secret);
+    const qrCode  = await QRCode.toDataURL(uri);
+
+    res.json({ secret, qrCode, issuer, email: user.email, totp_enabled: !!user.totp_enabled });
+  } catch (e) { next(e); }
+});
+
+// POST /2fa/confirm-setup — vérifie le code TOTP et active le 2FA
+router.post('/2fa/confirm-setup', requireAuth, async (req, res, next) => {
+  try {
+    const { code } = z.object({ code: z.string().length(6) }).parse(req.body);
+    const { authenticator } = await import('otplib');
+
+    const user = db.prepare('SELECT totp_secret, totp_enabled FROM users WHERE id=?').get(req.user.id);
+    if (!user.totp_secret) throw new HttpError(400, 'Lancez d\'abord la configuration 2FA.');
+    if (user.totp_enabled)  throw new HttpError(400, 'Le 2FA est déjà activé.');
+
+    authenticator.options = { window: 1 };
+    const valid = authenticator.verify({ token: code, secret: user.totp_secret });
+    if (!valid) throw new HttpError(400, 'Code invalide. Réessayez.');
+
+    db.prepare("UPDATE users SET totp_enabled=1 WHERE id=?").run(req.user.id);
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// POST /2fa/disable — désactive le 2FA (mot de passe requis)
+router.post('/2fa/disable', requireAuth, async (req, res, next) => {
+  try {
+    const { password } = z.object({ password: z.string().min(1) }).parse(req.body);
+
+    const user = db.prepare('SELECT password_hash, totp_enabled FROM users WHERE id=?').get(req.user.id);
+    if (!user.totp_enabled) throw new HttpError(400, 'Le 2FA n\'est pas activé.');
+
+    const ok = bcrypt.compareSync(password, user.password_hash);
+    if (!ok) throw new HttpError(401, 'Mot de passe incorrect.');
+
+    db.prepare("UPDATE users SET totp_enabled=0, totp_secret=NULL WHERE id=?").run(req.user.id);
+    // Supprimer tous les appareils de confiance
+    db.prepare('DELETE FROM two_fa_trusted_devices WHERE user_id=?').run(req.user.id);
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// ════════════════════════════════════════════════════════════════════════════
+// ── 2FA — Vérification lors de la connexion ──────────────────────────────
+// ════════════════════════════════════════════════════════════════════════════
+
+// POST /2fa/send-email-code — envoie un OTP par email (flow 2FA)
+router.post('/2fa/send-email-code', async (req, res, next) => {
+  try {
+    const { sessionToken } = z.object({ sessionToken: z.string().min(1) }).parse(req.body);
+
+    const sess = db.prepare(
+      "SELECT * FROM two_fa_sessions WHERE token=? AND used=0 AND expires_at > datetime('now')"
+    ).get(sessionToken);
+    if (!sess) throw new HttpError(401, 'Session expirée. Reconnectez-vous.');
+
+    const user = db.prepare('SELECT id, email, display_name FROM users WHERE id=?').get(sess.user_id);
+
+    // Invalider les anciens codes
+    db.prepare('UPDATE two_fa_email_codes SET used=1 WHERE user_id=? AND used=0').run(user.id);
+
+    const code      = String(Math.floor(100000 + Math.random() * 900000));
+    const expiresAt = new Date(Date.now() + 5 * 60 * 1000).toISOString();
+    db.prepare('INSERT INTO two_fa_email_codes (user_id, code, expires_at) VALUES (?,?,?)').run(user.id, code, expiresAt);
+
+    const cfg = getSmtpConfig();
+    if (!cfg.enabled) throw new HttpError(503, "SMTP désactivé — impossible d'envoyer le code.");
+
+    const prenom = (user.display_name || user.email).split(' ')[0];
+    await sendMail({
+      to: user.email,
+      subject: `${code} — Votre code de connexion`,
+      html: buildEmailHtml({
+        title: 'Code de vérification',
+        body: `<p>Bonjour ${prenom},</p>
+               <p>Voici votre code de vérification à usage unique :</p>
+               <p style="font-size:32px;font-weight:700;letter-spacing:8px;text-align:center;margin:24px 0;">${code}</p>
+               <p>Ce code est valable <strong>5 minutes</strong>. Ne le communiquez à personne.</p>`,
+      }),
+    });
+
+    res.json({ ok: true });
+  } catch (e) { next(e); }
+});
+
+// POST /2fa/verify — vérifie le code (TOTP ou email) et émet le JWT final
+router.post('/2fa/verify', async (req, res, next) => {
+  try {
+    const { sessionToken, code, method, trustDevice } = z.object({
+      sessionToken: z.string().min(1),
+      code:         z.string().min(6).max(6),
+      method:       z.enum(['totp', 'email']),
+      trustDevice:  z.boolean().optional(),
+    }).parse(req.body);
+
+    const sess = db.prepare(
+      "SELECT * FROM two_fa_sessions WHERE token=? AND used=0 AND expires_at > datetime('now')"
+    ).get(sessionToken);
+    if (!sess) throw new HttpError(401, 'Session expirée. Reconnectez-vous.');
+
+    const user = db.prepare('SELECT id, email, display_name, role, totp_secret, totp_enabled FROM users WHERE id=?').get(sess.user_id);
+
+    if (method === 'totp') {
+      const { authenticator } = await import('otplib');
+      authenticator.options = { window: 1 };
+      const valid = authenticator.verify({ token: code, secret: user.totp_secret });
+      if (!valid) throw new HttpError(400, 'Code invalide.');
+    } else {
+      // Email OTP
+      const row = db.prepare(
+        "SELECT id FROM two_fa_email_codes WHERE user_id=? AND code=? AND used=0 AND expires_at > datetime('now')"
+      ).get(user.id, code);
+      if (!row) throw new HttpError(400, 'Code invalide ou expiré.');
+      db.prepare('UPDATE two_fa_email_codes SET used=1 WHERE id=?').run(row.id);
+    }
+
+    // Invalider la session 2FA
+    db.prepare('UPDATE two_fa_sessions SET used=1 WHERE id=?').run(sess.id);
+
+    // Appareil de confiance (30 jours)
+    let deviceToken = null;
+    if (trustDevice) {
+      deviceToken = crypto.randomBytes(32).toString('hex');
+      const devExpires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString();
+      db.prepare('INSERT INTO two_fa_trusted_devices (user_id, token, expires_at) VALUES (?,?,?)').run(user.id, deviceToken, devExpires);
+    }
+
+    const token = signToken({ sub: user.id, email: user.email });
+    res.json({
+      token,
+      user: { id: user.id, email: user.email, displayName: user.display_name, role: user.role, email_verified: 1, totp_enabled: 1 },
+      ...(deviceToken ? { deviceToken } : {}),
    });
  } catch (e) { next(e); }
 });