chore: migrate 2FA TOTP DDP methods to /v1/users.totp.* REST endpoints
Summary
Continues the DDP→REST sweep (#40659, #40711, #40675, #40724, #40728). This batch migrates the five 2fa:* TOTP DDP methods that backed account/security/TwoFactorTOTP. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes.
New endpoints
| DDP method | REST endpoint | Body | Response |
|---|---|---|---|
2fa:enable | POST /v1/users.totp.enable | — | { secret, url } |
2fa:disable | POST /v1/users.totp.disable | { code } | { disabled } |
2fa:validateTempToken | POST /v1/users.totp.validate | { code } | { codes } |
2fa:regenerateCodes | POST /v1/users.totp.regenerateCodes | { code } | { codes } |
2fa:checkCodesRemaining | GET /v1/users.totp.codesRemaining | — | { remaining } |
All five extract the original method body into a shared function (apps/meteor/app/2fa/server/functions/totp.ts) reused by both DDP + REST entrypoints.
Validate flow note
validate keeps the DDP-era post-enable login-token rotation: REST forwards the caller's X-Auth-Token (this.token) so non-PAT tokens get revoked just like the DDP path did via this.connection.httpHeaders['x-auth-token'].
Client changes
TwoFactorTOTP.tsx swapped five useMethod hooks for five useEndpoint hooks. Disable response shape changed from bare boolean to { disabled: boolean }; verify/regenerate continue to return { codes }.
Test plan
- CI green (lint + typecheck pass)
- Account → Security → Two-factor authentication → toggle on → QR appears, scan, verify code → backup codes modal renders
- Re-load page → "You have N codes remaining" reads right
- Regenerate backup codes → modal with new codes
- Toggle 2FA off → enter current code → success toast; reload to confirm disabled state
- Validate path revokes other login tokens (open second tab, validate, second tab gets kicked)
🤖 Generated with Claude Code
Summary by CodeRabbit
- New Features
- Added new REST API endpoints for TOTP two-factor management (enable/disable, validate setup codes, regenerate backup codes, and check remaining backup codes).
- Updated the account security TOTP UI to use the new REST endpoints with improved invalid-code handling and rate limiting.
- Documentation
- Documented the new TOTP REST endpoints and that legacy DDP TOTP methods remain available until version 9.0.0 (with deprecation logging).
Task: ARCH-2268