Remove mastodon posts on delete and OTP

backend/app/api/auth.py

@@ -13,6 +13,7 @@ from backend.app.services.email_service import send_password_reset_email, smtp_c
 from backend.app.services.email_verification import verify_email
 from backend.app.services.password_reset import create_reset_token, reset_password
 from backend.app.services.token_service import issue_token, revoke_token, validate_token
+from backend.app.services.otp_service import verify_code
 
 router = APIRouter()
 
@@ -22,6 +23,7 @@ init_db()
 class LoginRequest(BaseModel):
     username: str
     password: str
+    otp: str | None = None
 
 
 class PasswordResetRequest(BaseModel):
@@ -44,6 +46,8 @@ def login(payload: LoginRequest):
         raise HTTPException(status_code=401, detail='Invalid username or password')
     if not user['email_verified']:
         raise HTTPException(status_code=403, detail='Email address is not verified')
+    if user['otp_enabled'] and not verify_code(user['otp_secret'], payload.otp):
+        raise HTTPException(status_code=401, detail='One-time password required or invalid')
 
     token_data = issue_token(user['id'], user['username'])
     return {
@@ -51,7 +55,7 @@ def login(payload: LoginRequest):
         'token_type': 'bearer',
         'expires_at': token_data['expires_at'],
         'refresh_token': token_data['refresh_token'],
-        'user': {'id': user['id'], 'username': user['username'], 'email': user['email']}
+        'user': {'id': user['id'], 'username': user['username'], 'email': user['email'], 'otp_enabled': bool(user['otp_enabled'])}
     }