- sed kept the URL prefix in the auth-code extraction; the garbage code
was the cause of every invalid_grant on the token exchange
- enrollment now uses the Cloudron 10 profile-scoped routes mined from
the dashboard bundle: POST /api/v1/profile/totp_secret and
POST /api/v1/profile/totp_enable
- seed storage verifies the setfield write and falls back to a full
vault item recreate (smcli setfield 400s on some ciphers)
- prompt=login added to the auth URL for session-switch flows
Verified: 32 COO-org identities enrolled end-to-end (seed in vault +
real TOTP login as each identity). Full detail on the #942 comment.
https://projects.knownelement.com/issues/942
mrcharles