Security key support

app/api/auth/login/route.ts

@@ -1,14 +1,14 @@
 import { NextRequest, NextResponse } from "next/server";
 
 export async function POST(req: NextRequest) {
-	const { username, password, totp } = await req.json();
+	const { username, password } = await req.json();
 
 	const res = await fetch("http://localhost:3001/auth/login", {
 		method: "POST",
 		headers: {
 			Authorization:
 				"Basic " +
-				Buffer.from(`${username}:${password}${totp}`).toString("base64"),
+				Buffer.from(`${username}:${password}`).toString("base64"),
 		},
 	});
 
@@ -16,14 +16,6 @@ export async function POST(req: NextRequest) {
 		return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
 	}
 
-	const { token } = await res.json();
-	const response = NextResponse.json({ success: true });
-	response.cookies.set("token", token, {
-		httpOnly: true,
-		secure: true,
-		sameSite: "strict",
-		maxAge: 60 * 60 * 8,
-		path: "/",
-	});
-	return response;
+	// Returns { session_id, challenge } — browser completes the WebAuthn step
+	return NextResponse.json(await res.json());
 }