The fallback hardcoded username/password/uri/totp_seed and silently
destroyed live API-key fields on any enroll (bit vpentops 2026-09-09).
Rebuilds the full field set from the item JSON now.
https://projects.knownelement.com/issues/942#note-5514
- sed kept the URL prefix in the auth-code extraction; the garbage code
was the cause of every invalid_grant on the token exchange
- enrollment now uses the Cloudron 10 profile-scoped routes mined from
the dashboard bundle: POST /api/v1/profile/totp_secret and
POST /api/v1/profile/totp_enable
- seed storage verifies the setfield write and falls back to a full
vault item recreate (smcli setfield 400s on some ciphers)
- prompt=login added to the auth URL for session-switch flows
Verified: 32 COO-org identities enrolled end-to-end (seed in vault +
real TOTP login as each identity). Full detail on the #942 comment.
https://projects.knownelement.com/issues/942
mrcharles
TSYS Group COO