// Show error from URL params (e.g., ?error=2fa_required from form POST redirect) (function() { const params = new URLSearchParams(window.location.search) const err = params.get('error') if (err === '2fa_required') { const errorDiv = document.getElementById('error-message') errorDiv.classList.remove('hidden') errorDiv.querySelector('p').textContent = 'Your grace period has expired. Two-factor authentication must be enabled before you can log in. Contact your administrator.' } })() document.querySelector('form').addEventListener('submit', async (e) => { e.preventDefault() const form = e.target const email = form.email.value const password = form.password.value const errorDiv = document.getElementById('error-message') try { const res = await fetch('/api/v1/auth', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email, password }) }) const data = await res.json() if (!res.ok) { errorDiv.classList.remove('hidden') errorDiv.querySelector('p').textContent = data.error?.message || 'Login failed' return } // Org picker — multiple tenants matched if (data.data.orgPickerRequired) { const orgs = data.data.organizations function escapeHtml(s) { var d = document.createElement('div'); d.textContent = s; return d.innerHTML; } const pickerHtml = orgs.map(function(org) { return '' }).join('') document.querySelector('form').innerHTML = '

' + '

Select an account to sign in to:

' + pickerHtml + '

' window._orgPickerToken = data.data.orgPickerToken window.selectOrg = async function(index) { try { var res2 = await fetch('/api/v1/auth/select-org', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ orgPickerToken: window._orgPickerToken, index: index }) }) var d2 = await res2.json() if (!res2.ok) { errorDiv.classList.remove('hidden') errorDiv.querySelector('p').textContent = d2.error?.message || 'Selection failed' return } if (d2.data.twoFactorSetupRequired) { window.location.href = '/setup-2fa?token=' + encodeURIComponent(d2.data.setupToken); return } if (d2.data.twoFactorRequired) { window.location.href = '/two-factor?token=' + encodeURIComponent(d2.data.challengeToken); return } if (d2.data.twoFactorWarning) { localStorage.setItem('twoFactorWarning', 'true'); localStorage.setItem('twoFactorLoginsRemaining', String(d2.data.twoFactorLoginsRemaining ?? 0)) } window.location.href = d2.data.role === 'superadmin' ? '/superadmin' : d2.data.role === 'admin' ? '/admin' : d2.data.role === 'partner' ? '/partner' : '/buyer' } catch(e) { errorDiv.classList.remove('hidden'); errorDiv.querySelector('p').textContent = 'Network error.' } } return } // 2FA setup required — grace period expired, redirect to self-service setup if (data.data.twoFactorSetupRequired) { window.location.href = '/setup-2fa?token=' + encodeURIComponent(data.data.setupToken) return } // 2FA challenge — redirect to TOTP entry if (data.data.twoFactorRequired) { window.location.href = '/two-factor?token=' + encodeURIComponent(data.data.challengeToken) return } if (data.data.twoFactorWarning) { localStorage.setItem('twoFactorWarning', 'true') localStorage.setItem('twoFactorLoginsRemaining', String(data.data.twoFactorLoginsRemaining ?? 0)) } window.location.href = data.data.role === 'superadmin' ? '/superadmin' : data.data.role === 'admin' ? '/admin' : data.data.role === 'partner' ? '/partner' : '/buyer' } catch (err) { errorDiv.classList.remove('hidden') errorDiv.querySelector('p').textContent = 'Network error. Please try again.' } })

Lead Router