DC-044: fix slice(13) -> slice(12) for /api/v1/auth/totp/check-session drift

Slice(13) was off by one — it dropped the leading '/' before 'totp/' producing /api/v1totp/check-session. Should be slice(12) so the '/' stays.
2026-07-08 21:43:12 -07:00
parent 1baef432c4
commit 2169ec9853
1 changed files with 2 additions and 2 deletions
@@ -220,8 +220,8 @@ async function createApp() {
      req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
    } else if (req.url.startsWith('/api/v1/auth/totp/check-session')) {
      // Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session
-      // Drop the '/api/v1' prefix AND the '/auth' middle segment (13 chars total).
-      req.url = '/api/v1' + req.url.slice(13); // '/api/v1/auth'.length === 13
+      // Drop the '/api/v1/auth' prefix (12 chars), keep the leading '/'.
+      req.url = '/api/v1' + req.url.slice(12); // '/api/v1/auth'.length === 12
    }
    next();
  });