From c40741c023c373fc56eef3a3ae1658ccb3bea0bd Mon Sep 17 00:00:00 2001
From: Olivier <olivier@croguennec.net>
Date: Sun, 14 Jun 2026 22:01:29 +0200
Subject: [PATCH] Fix 2FA

---
 backend/src/routes/auth.js | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/backend/src/routes/auth.js b/backend/src/routes/auth.js
index 2fc0534..fe0608d 100644
--- a/backend/src/routes/auth.js
+++ b/backend/src/routes/auth.js
@@ -6,6 +6,8 @@ import db from '../db/index.js';
 import { signToken, requireAuth } from '../middleware/auth.js';
 import { HttpError } from '../middleware/errorHandler.js';
 import { sendMail, buildEmailHtml, getSmtpConfig } from '../utils/mailer.js';
+import { authenticator } from 'otplib';
+import QRCode from 'qrcode';
 
 const router = Router();
 
@@ -365,9 +367,6 @@ router.post('/reset-password', async (req, res, next) => {
 // GET /2fa/setup — génère un secret TOTP + QR code pour l'utilisateur
 router.get('/2fa/setup', requireAuth, async (req, res, next) => {
   try {
-    const { authenticator } = await import('otplib');
-    const QRCode = (await import('qrcode')).default;
-
     const cfg    = getSmtpConfig();
     const issuer = cfg.appName || 'Crowdlending Tracker';
     const user   = db.prepare('SELECT id, email, totp_secret, totp_enabled FROM users WHERE id=?').get(req.user.id);
@@ -390,8 +389,6 @@ router.get('/2fa/setup', requireAuth, async (req, res, next) => {
 router.post('/2fa/confirm-setup', requireAuth, async (req, res, next) => {
   try {
     const { code } = z.object({ code: z.string().length(6) }).parse(req.body);
-    const { authenticator } = await import('otplib');
-
     const user = db.prepare('SELECT totp_secret, totp_enabled FROM users WHERE id=?').get(req.user.id);
     if (!user.totp_secret) throw new HttpError(400, 'Lancez d\'abord la configuration 2FA.');
     if (user.totp_enabled)  throw new HttpError(400, 'Le 2FA est déjà activé.');
@@ -485,8 +482,7 @@ router.post('/2fa/verify', async (req, res, next) => {
     const user = db.prepare('SELECT id, email, display_name, role, totp_secret, totp_enabled FROM users WHERE id=?').get(sess.user_id);
 
     if (method === 'totp') {
-      const { authenticator } = await import('otplib');
-      authenticator.options = { window: 1 };
+    authenticator.options = { window: 1 };
       const valid = authenticator.verify({ token: code, secret: user.totp_secret });
       if (!valid) throw new HttpError(400, 'Code invalide.');
     } else {