Reverted to commit 0091584677

src/components/auth/AuthModal.tsx

@@ -35,8 +35,6 @@ export function AuthModal({ open, onOpenChange, defaultTab = 'signin' }: AuthMod
   const [signInCaptchaToken, setSignInCaptchaToken] = useState<string | null>(null);
   const [signInCaptchaKey, setSignInCaptchaKey] = useState(0);
   const [mfaFactorId, setMfaFactorId] = useState<string | null>(null);
-  const [mfaChallengeId, setMfaChallengeId] = useState<string | null>(null);
-  const [mfaPendingUserId, setMfaPendingUserId] = useState<string | null>(null);
   const [formData, setFormData] = useState({
     email: '',
     password: '',
@@ -72,57 +70,73 @@ export function AuthModal({ open, onOpenChange, defaultTab = 'signin' }: AuthMod
     setSignInCaptchaToken(null);
 
     try {
-      // Call server-side auth check with MFA detection
-      const { data: authResult, error: authError } = await supabase.functions.invoke(
-        'auth-with-mfa-check',
-        {
-          body: {
-            email: formData.email,
-            password: formData.password,
-            captchaToken: tokenToUse,
-          },
-        }
-      );
-
-      if (authError || authResult.error) {
-        throw new Error(authResult?.error || authError?.message || 'Authentication failed');
+      const signInOptions: any = {
+        email: formData.email,
+        password: formData.password,
+      };
+      
+      if (tokenToUse) {
+        signInOptions.options = { captchaToken: tokenToUse };
       }
 
-      // Check if user is banned
-      if (authResult.banned) {
-        const reason = authResult.banReason
-          ? `Reason: ${authResult.banReason}`
-          : 'Contact support for assistance.';
+      const { data, error } = await supabase.auth.signInWithPassword(signInOptions);
+      if (error) throw error;
 
+      // CRITICAL: Check ban status immediately after successful authentication
+      const { data: profile } = await supabase
+        .from('profiles')
+        .select('banned, ban_reason')
+        .eq('user_id', data.user.id)
+        .single();
+      
+      if (profile?.banned) {
+        // Sign out immediately
+        await supabase.auth.signOut();
+        
+        const reason = profile.ban_reason 
+          ? `Reason: ${profile.ban_reason}`
+          : 'Contact support for assistance.';
+        
         toast({
           variant: "destructive",
           title: "Account Suspended",
           description: `Your account has been suspended. ${reason}`,
-          duration: 10000,
+          duration: 10000
         });
         setLoading(false);
-        return;
+        return; // Stop authentication flow
       }
 
-      // Check if MFA is required
-      if (authResult.mfaRequired) {
-        // NO SESSION EXISTS YET - show MFA challenge
-        console.log('[AuthModal] MFA required - no session created yet');
-        setMfaFactorId(authResult.factorId);
-        setMfaChallengeId(authResult.challengeId);
-        setMfaPendingUserId(authResult.userId);
-        setLoading(false);
-        return; // User has NO session - MFA modal will show
+      // Check if MFA is required (user exists but no session)
+      if (data.user && !data.session) {
+        const totpFactor = data.user.factors?.find(f => f.factor_type === 'totp' && f.status === 'verified');
+        
+        if (totpFactor) {
+          setMfaFactorId(totpFactor.id);
+          setLoading(false);
+          return;
+        }
       }
-
-      // No MFA required - user has session
-      console.log('[AuthModal] No MFA required - user authenticated');
       
-      // Set the session in Supabase client
-      if (authResult.session) {
-        await supabase.auth.setSession(authResult.session);
-      }
+      // Track auth method for audit logging
+      setAuthMethod('password');
 
+      // Check if MFA step-up is required
+      const { handlePostAuthFlow } = await import('@/lib/authService');
+      const postAuthResult = await handlePostAuthFlow(data.session, 'password');
+
+      if (postAuthResult.success && postAuthResult.data.shouldRedirect) {
+        // Get the TOTP factor ID
+        const { data: factors } = await supabase.auth.mfa.listFactors();
+        const totpFactor = factors?.totp?.find(f => f.status === 'verified');
+        
+        if (totpFactor) {
+          setMfaFactorId(totpFactor.id);
+          setLoading(false);
+          return; // Stay in modal, show MFA challenge
+        }
+      }
+      
       toast({
         title: "Welcome back!",
         description: "You've been signed in successfully."
@@ -148,34 +162,30 @@ export function AuthModal({ open, onOpenChange, defaultTab = 'signin' }: AuthMod
   };
 
   const handleMfaSuccess = async () => {
-    console.log('[AuthModal] MFA verification succeeded - no further action needed');
+    // Verify AAL upgrade was successful
+    const { data: { session } } = await supabase.auth.getSession();
+    const verification = await verifyMfaUpgrade(session);
+    
+    if (!verification.success) {
+      toast({
+        variant: "destructive",
+        title: "MFA Verification Failed",
+        description: verification.error || "Failed to upgrade session. Please try again."
+      });
+      
+      // Force sign out on verification failure
+      await supabase.auth.signOut();
+      setMfaFactorId(null);
+      return;
+    }
     
-    // Clear state
     setMfaFactorId(null);
-    setMfaChallengeId(null);
-    setMfaPendingUserId(null);
-    
-    toast({
-      title: "Authentication complete",
-      description: "You've been signed in successfully.",
-    });
-    
     onOpenChange(false);
   };
 
-  const handleMfaCancel = async () => {
-    console.log('[AuthModal] User cancelled MFA verification');
-    
-    // Clear state
+  const handleMfaCancel = () => {
     setMfaFactorId(null);
-    setMfaChallengeId(null);
-    setMfaPendingUserId(null);
     setSignInCaptchaKey(prev => prev + 1);
-    
-    toast({
-      title: "Authentication cancelled",
-      description: "Please sign in again when you're ready to complete two-factor authentication.",
-    });
   };
 
   const handleSignUp = async (e: React.FormEvent) => {
@@ -234,7 +244,6 @@ export function AuthModal({ open, onOpenChange, defaultTab = 'signin' }: AuthMod
         email: formData.email,
         password: formData.password,
         options: {
-          emailRedirectTo: `${window.location.origin}/auth/callback`,
           data: {
             username: formData.username,
             display_name: formData.displayName
@@ -369,8 +378,6 @@ export function AuthModal({ open, onOpenChange, defaultTab = 'signin' }: AuthMod
             {mfaFactorId ? (
               <MFAChallenge
                 factorId={mfaFactorId}
-                challengeId={mfaChallengeId}
-                userId={mfaPendingUserId}
                 onSuccess={handleMfaSuccess}
                 onCancel={handleMfaCancel}
               />