Portal-Login: Appwrite-Sitzung merken, MFA-Aufrufe im Namen der Sitzung

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/services/appwriteClient.js

@@ -7,13 +7,14 @@ function appwriteHeaders() {
   }
 }
 
-async function appwriteFetch(path, { method = 'GET', body } = {}) {
+async function appwriteFetch(path, { method = 'GET', body, headers = {}, onResponse } = {}) {
   const url = `${config.appwrite.endpoint}${path}`
   const response = await fetch(url, {
     method,
-    headers: appwriteHeaders(),
+    headers: { ...appwriteHeaders(), ...headers },
     body: body ? JSON.stringify(body) : undefined,
   })
+  onResponse?.(response)
 
   let data = null
   const text = await response.text()
@@ -41,6 +42,28 @@ async function appwriteFetch(path, { method = 'GET', body } = {}) {
   return data
 }
 
+function readSessionCookie(response) {
+  const name = `a_session_${config.appwrite.projectId}=`
+  const cookies = response.headers.getSetCookie?.() || []
+  const cookie = cookies.find((c) => c.startsWith(name))
+  return cookie ? decodeURIComponent(cookie.slice(name.length).split(';')[0]) : ''
+}
+
+/**
+ * Appwrite-Aufruf im Namen einer Sitzung aus loginWithAppwrite (z. B. MFA-Challenge). Deutsche Sprache,
+ * damit Appwrite die deutsche Mailvorlage nimmt.
+ */
+export function appwriteSessionFetch(path, { method = 'GET', body, sessionCookie } = {}) {
+  return appwriteFetch(path, {
+    method,
+    body,
+    headers: {
+      Cookie: `a_session_${config.appwrite.projectId}=${encodeURIComponent(sessionCookie || '')}`,
+      'X-Appwrite-Locale': 'de',
+    },
+  })
+}
+
 /**
  * Login via Appwrite Auth REST. userId kommt aus der Session – kein users.read nötig.
  */
@@ -69,10 +92,14 @@ export async function loginWithAppwrite(email, password) {
   }
 
   let session
+  let sessionCookie = ''
   try {
     session = await appwriteFetch('/account/sessions/email', {
       method: 'POST',
       body: { email, password },
+      onResponse: (response) => {
+        sessionCookie = readSessionCookie(response)
+      },
     })
   } catch (err) {
     if (err.status === 429) {
@@ -89,7 +116,8 @@ export async function loginWithAppwrite(email, password) {
     throw error
   }
 
-  const user = { $id: session.userId, email, name: '' }
+  // sessionCookie: fuer den zweiten Faktor (Mitarbeiter-2FA) arbeitet der Server im Namen dieser Sitzung weiter
+  const user = { $id: session.userId, email, name: '', sessionCookie }
 
   clearLoginCooldown()
   return user