From 46aaf46619cab70fa37ddf5c4530dfa61e613fc2 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 11:50:02 +0100
Subject: [PATCH 01/27] Add API route for retreiving auth token Switch the
 login process from the web to api controller

---
 docs/openapi.json                             | 83 +++++++++++++++++++
 public/js/login.js                            | 36 ++++++++
 settings/routes.php                           |  1 +
 src/Domain/User/Exception/InvalidTotpCode.php | 11 +++
 src/Domain/User/Service/Authentication.php    | 34 ++++++--
 .../Api/AuthenticationController.php          | 66 +++++++++++++++
 .../Web/AuthenticationController.php          |  1 +
 .../Web/LandingPageController.php             | 17 ----
 src/ValueObject/Http/Request.php              | 14 +++-
 templates/page/login.html.twig                | 66 +++++++--------
 10 files changed, 268 insertions(+), 61 deletions(-)
 create mode 100644 public/js/login.js
 create mode 100644 src/Domain/User/Exception/InvalidTotpCode.php
 create mode 100644 src/HttpController/Api/AuthenticationController.php

diff --git a/docs/openapi.json b/docs/openapi.json
index 83a6e182..9a277de7 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1065,6 +1065,89 @@
           }
         }
       }
+    },
+    "/authentication/request-token": {
+      "post": {
+        "description": "Get an authentication token by submitting an email, password and optionally a time-based 6-digit code. This token can be stored and used for future requests to protected endpoints.",
+        "parameters": [{
+          "in": "header",
+          "name": "X-Movary-Client",
+          "schema": {
+            "type": "string"
+          },
+          "required": true,
+          "example": "Client Name"
+        }],
+        "requestBody": {
+          "description": "The credentials and optionally a two-factor Authentication code",
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "type": "object",
+                "required": ["email", "password"],
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "example": "user@email.com",
+                    "description": "An email address"
+                  },
+                  "password": {
+                    "type": "string",
+                    "example": "mysecurepassword123",
+                    "description": "A password"
+                  },
+                  "totpCode": {
+                    "type": "integer",
+                    "pattern": "/^[0-9]{6}$/gm",
+                    "example": "123456",
+                    "description": "A 6-digit two-factor authentication code",
+                    "nullable": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "token": {
+                      "type": "string",
+                      "description": "The authentication token to be used in future requests."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "An authentication error. Either missing credentials or the credentials were invalid.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "error": {
+                      "type": "string",
+                      "description": "The name of the error"
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "The message of the error"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   "components": {
diff --git a/public/js/login.js b/public/js/login.js
new file mode 100644
index 00000000..1ce090e5
--- /dev/null
+++ b/public/js/login.js
@@ -0,0 +1,36 @@
+const MOVARY_CLIENT_IDENTIFIER = 'Movary Web';
+
+async function submitCredentials() {
+    const request = await fetch('/api/authentication/request-token', {
+        method: 'POST',
+        headers: {
+            'Content-type': 'application/json',
+            'X-Movary-Client': MOVARY_CLIENT_IDENTIFIER
+        },
+        body: JSON.stringify({
+            'email': document.getElementById('email').value,
+            'password': document.getElementById('password').value,
+            'rememberMe': document.getElementById('rememberMe').checked,
+            'totpCode': document.getElementById('totpCode').value
+        })
+    }).then((response) => {
+        return response;
+    });
+    
+    if(request.redirected === true) {
+        window.location.replace(request.url);
+    } else {
+        await request.json().then(error => {
+            if(error['error'] === 'NoVerificationCode') {
+               document.getElementById('LoginForm').classList.add('d-none');
+               document.getElementById('TotpForm').classList.remove('d-none');
+            } else if(error['error'] === 'InvalidTotpCode') {
+                addAlert('totpErrors', error['message'], 'danger', false);
+            } else {
+                addAlert('loginErrors', error['message'], 'danger', false);
+            }
+        }).catch(error => {
+            console.error(error);
+        });
+    }
+}
\ No newline at end of file
diff --git a/settings/routes.php b/settings/routes.php
index 7c49d23d..745d4ae9 100644
--- a/settings/routes.php
+++ b/settings/routes.php
@@ -203,6 +203,7 @@ function addApiRoutes(RouterService $routerService, FastRoute\RouteCollector $ro
     $routes = RouteList::create();
 
     $routes->add('GET', '/openapi', [Api\OpenApiController::class, 'getSchema']);
+    $routes->add('POST', '/authentication/request-token', [Api\AuthenticationController::class, 'requestToken']);
 
     $routeUserHistory = '/users/{username:[a-zA-Z0-9]+}/history/movies';
     $routes->add('GET', $routeUserHistory, [Api\HistoryController::class, 'getHistory'], [Api\Middleware\IsAuthorizedToReadUserData::class]);
diff --git a/src/Domain/User/Exception/InvalidTotpCode.php b/src/Domain/User/Exception/InvalidTotpCode.php
new file mode 100644
index 00000000..c355440b
--- /dev/null
+++ b/src/Domain/User/Exception/InvalidTotpCode.php
@@ -0,0 +1,11 @@
+<?php declare(strict_types=1);
+
+namespace Movary\Domain\User\Exception;
+
+class InvalidTotpCode extends InvalidCredentials
+{
+    public static function create() : self
+    {
+        return new self('Two-factor authentication code wrong.');
+    }
+}
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index 692d6392..f272f2bb 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -4,10 +4,12 @@
 
 use Movary\Domain\User\Exception\EmailNotFound;
 use Movary\Domain\User\Exception\InvalidPassword;
+use Movary\Domain\User\Exception\InvalidTotpCode;
 use Movary\Domain\User\Exception\NoVerificationCode;
 use Movary\Domain\User\UserApi;
 use Movary\Domain\User\UserEntity;
 use Movary\Domain\User\UserRepository;
+use Movary\Service\ServerSettings;
 use Movary\Util\SessionWrapper;
 use Movary\ValueObject\DateTime;
 use Movary\ValueObject\Http\Request;
@@ -22,6 +24,8 @@ public function __construct(
         private readonly UserRepository $repository,
         private readonly UserApi $userApi,
         private readonly SessionWrapper $sessionWrapper,
+        private readonly ServerSettings $serverSettings,
+        private readonly TwoFactorAuthenticationApi $twoFactorAuthenticationApi,
     ) {
     }
 
@@ -108,7 +112,7 @@ public function isUserPageVisibleForApiRequest(Request $request, UserEntity $tar
         return $targetUser->getId() === $userId;
     }
 
-    public function login(string $email, string $password, bool $rememberMe) : void
+    public function login(string $email, string $password, bool $rememberMe, ?int $userTotpInput = null) : void
     {
         if ($this->isUserAuthenticated() === true) {
             return;
@@ -127,9 +131,12 @@ public function login(string $email, string $password, bool $rememberMe) : void
         $totpUri = $this->userApi->findTotpUri($user->getId());
 
         if ($totpUri !== null) {
-            $this->sessionWrapper->set('totpUserId', $user->getId());
-            $this->sessionWrapper->set('rememberMe', $rememberMe);
-            throw NoVerificationCode::create();
+            if(empty($userTotpInput)) {
+                throw NoVerificationCode::create();
+            }
+            if($this->verifyTotp($user->getId(), $userTotpInput) === false) {
+                throw InvalidTotpCode::create();
+            }
         }
 
         $this->createAuthenticationCookie($user->getId(), $rememberMe);
@@ -148,7 +155,8 @@ public function createAuthenticationCookie(int $userId, bool $rememberMe) : void
         $token = $this->generateToken($userId, DateTime::createFromString((string)$authTokenExpirationDate));
 
         session_regenerate_id();
-        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration);
+        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/');
+        // setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/', $this->serverSettings->getApplicationUrl(), true, true);
 
         $this->sessionWrapper->set('userId', $userId);
     }
@@ -191,7 +199,7 @@ private function generateToken(int $userId, ?DateTime $expirationDate = null) :
         return $token;
     }
 
-    private function isValidToken(string $token) : bool
+    public function isValidToken(string $token) : bool
     {
         $tokenExpirationDate = $this->repository->findAuthTokenExpirationDate($token);
 
@@ -205,4 +213,18 @@ private function isValidToken(string $token) : bool
 
         return true;
     }
+
+    public function getToken() : ?string
+    {
+        return $_COOKIE[self::AUTHENTICATION_COOKIE_NAME];
+    }
+
+
+    private function verifyTotp($userId, $userTotpInput) : bool
+    {
+        if ($this->twoFactorAuthenticationApi->verifyTotpUri($userId, (int)$userTotpInput) === false) {
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
new file mode 100644
index 00000000..ae1b125c
--- /dev/null
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -0,0 +1,66 @@
+<?php declare(strict_types=1);
+
+namespace Movary\HttpController\Api;
+
+use Movary\Domain\User\Exception\InvalidCredentials;
+use Movary\Domain\User\Exception\InvalidTotpCode;
+use Movary\Domain\User\Exception\NoVerificationCode;
+use Movary\Domain\User\Service\Authentication;
+use Movary\Domain\User\Service\TwoFactorAuthenticationApi;
+use Movary\Util\Json;
+use Movary\Util\SessionWrapper;
+use Movary\ValueObject\Http\Request;
+use Movary\ValueObject\Http\Response;
+
+class AuthenticationController
+{
+    public function __construct(
+        private readonly Authentication $authenticationService,
+        private readonly TwoFactorAuthenticationApi $twoFactorAuthenticationApi,
+        private readonly SessionWrapper $sessionWrapper,
+    ) {
+    }
+
+    public function requestToken(Request $request) : Response
+    {
+        $postParameters = Json::decode($request->getBody());
+        $headers = $request->getHeaders();
+        if($postParameters['email'] === null || $postParameters['password'] === null) {
+            return Response::createBadRequest('Username or password has not been provided');
+        }
+        $totpCode = $postParameters['totpCode'] ?? 0;
+        
+        if(isset($headers['X-Movary-Client']) === false) {
+            return Response::createBadRequest();
+        }
+        
+        $client = $headers['X-Movary-Client'];
+
+        try {
+            $this->authenticationService->login($postParameters['email'], $postParameters['password'], false, (int)$totpCode);
+
+            if($client === 'Movary Web') {
+                $redirect = $postParameters['redirect'] ?? null;
+                $target = $redirect ?? $_SERVER['HTTP_REFERER'];
+        
+                $urlParts = parse_url($target);
+                if (is_array($urlParts) === false) {
+                    $urlParts = ['path' => '/'];
+                }
+                $query = $urlParts['query'] ?? '';
+
+                /* @phpstan-ignore-next-line */
+                $targetRelativeUrl = $urlParts['path'] . $query;
+        
+                return Response::createSeeOther($targetRelativeUrl);
+            }
+            
+            return Response::createJson(Json::encode(['token' => $this->authenticationService->getToken()]));
+        } catch (InvalidCredentials $e) {
+            return Response::createBadRequest(Json::encode([
+                'error' => basename(str_replace('\\', '/', get_class($e))),
+                'message' => $e->getMessage()
+            ]));
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/HttpController/Web/AuthenticationController.php b/src/HttpController/Web/AuthenticationController.php
index faa2dd71..86977af9 100644
--- a/src/HttpController/Web/AuthenticationController.php
+++ b/src/HttpController/Web/AuthenticationController.php
@@ -4,6 +4,7 @@
 
 use Movary\Domain\SessionService;
 use Movary\Domain\User\Exception\InvalidCredentials;
+use Movary\Domain\User\Exception\InvalidTotpCode;
 use Movary\Domain\User\Exception\NoVerificationCode;
 use Movary\Domain\User\Service;
 use Movary\Util\SessionWrapper;
diff --git a/src/HttpController/Web/LandingPageController.php b/src/HttpController/Web/LandingPageController.php
index 63fb1842..d5ef5c6e 100644
--- a/src/HttpController/Web/LandingPageController.php
+++ b/src/HttpController/Web/LandingPageController.php
@@ -22,30 +22,13 @@ public function __construct(
 
     public function render() : Response
     {
-        $failedLogin = $this->sessionWrapper->has('failedLogin');
         $deletedAccount = $this->sessionWrapper->has('deletedAccount');
-        $invalidTotpCode = $this->sessionWrapper->has('invalidTotpCode');
-        $useTwoFactorAuthentication = $this->sessionWrapper->has('useTwoFactorAuthentication');
-
-        $this->sessionWrapper->unset('failedLogin', 'deletedAccount', 'invalidTotpCode', 'useTwoFactorAuthentication');
-        if ($invalidTotpCode === true) {
-            $useTwoFactorAuthentication = true;
-        }
-
-        if ($useTwoFactorAuthentication === false) {
-            $this->sessionWrapper->unset('rememberMe');
-        }
 
         return Response::create(
             StatusCode::createOk(),
             $this->twig->render('page/login.html.twig', [
-                'failedLogin' => $failedLogin,
                 'deletedAccount' => $deletedAccount,
                 'registrationEnabled' => $this->registrationEnabled,
-                'defaultEmail' => $this->defaultEmail,
-                'defaultPassword' => $this->defaultPassword,
-                'useTwoFactorAuthentication' => $useTwoFactorAuthentication,
-                'invalidTotpCode' => $invalidTotpCode,
             ]),
         );
     }
diff --git a/src/ValueObject/Http/Request.php b/src/ValueObject/Http/Request.php
index b39ea9a8..75ec570d 100644
--- a/src/ValueObject/Http/Request.php
+++ b/src/ValueObject/Http/Request.php
@@ -15,6 +15,7 @@ private function __construct(
         private readonly string $body,
         private readonly array $filesParameters,
         private readonly array $headers,
+        private readonly string $userAgent
     ) {
     }
 
@@ -27,10 +28,11 @@ public static function createFromGlobals() : self
         $postParameters = self::extractPostParameter();
         $filesParameters = self::extractFilesParameter();
         $headers = self::extractHeaders();
+        $userAgent = self::extractUserAgent();
 
         $body = (string)file_get_contents('php://input');
 
-        return new self($path, $getParameters, $postParameters, $body, $filesParameters, $headers);
+        return new self($path, $getParameters, $postParameters, $body, $filesParameters, $headers, $userAgent);
     }
 
     private static function extractFilesParameter() : array
@@ -87,6 +89,11 @@ private static function extractRequestUri() : string
         return self::getServerSetting('REQUEST_URI') ?? '';
     }
 
+    private static function extractUserAgent() : string
+    {
+        return self::getServerSetting('HTTP_USER_AGENT') ?? '';
+    }
+
     private static function getServerSetting(string $key) : ?string
     {
         return empty($_SERVER[$key]) === false ? (string)$_SERVER[$key] : null;
@@ -131,4 +138,9 @@ public function getRouteParameters() : array
     {
         return $this->routeParameters;
     }
+
+    public function getUserAgent() : string
+    {
+        return $this->userAgent;
+    }
 }
diff --git a/templates/page/login.html.twig b/templates/page/login.html.twig
index 2b8ef1ab..ca86d15f 100644
--- a/templates/page/login.html.twig
+++ b/templates/page/login.html.twig
@@ -8,74 +8,66 @@
     <link rel="stylesheet" href="/css/login.css">
 {% endblock %}
 
+{% block scripts %}
+    <script src="/js/login.js"></script>
+{% endblock %}
+
 {% block body %}
     <script>
         if ("{{ theme }}" === 'dark') document.getElementsByTagName('body')[0].classList.add('bg-dark')
     </script>
-    <main role="main" class="form-signin w-100 m-auto text-center">
-        {% if useTwoFactorAuthentication == false %}
-            <form action="/login" method="post" enctype="multipart/form-data">
+        <main role="main" class="form-signin w-100 m-auto text-center">
+            <form id="LoginForm">
                 <h1 id="header" class="text-{{ theme == 'dark' ? 'light' : 'dark' }}" style="margin-bottom: 1rem">{{ applicationName ?? 'Movary' }}</h1>
                 <div class="form-floating">
-                    <input type="email" name="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="floatingInput"
-                           placeholder="name@example.com" required>
-                    <label for="floatingInput">Email address</label>
+                    <input type="email" name="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="email"
+                        placeholder="name@example.com" required>
+                    <label for="email">Email address</label>
                 </div>
                 <div class="form-floating">
-                    <input type="password" name="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="floatingPassword"
-                           placeholder="Password" required>
-                    <label for="floatingPassword">Password</label>
+                    <input type="password" name="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="password"
+                        placeholder="Password" required>
+                    <label for="password">Password</label>
                 </div>
 
                 <div class="checkbox mb-3" style="margin-bottom: 0.7rem!important;">
                     <label class="text-{{ theme == 'dark' ? 'light' : 'dark' }}">
-                        <input type="checkbox" name="rememberMe" value="true"> Remember me
+                        <input type="checkbox" name="rememberMe" id="rememberMe" value="true" {{ defaultRememberMe == 'true' ? 'checked' : '' }}> Remember me
                     </label>
                 </div>
 
+                <div id="loginErrors"></div>
+
                 {% if deletedAccount == true %}
                     <div class="alert alert-success" role="alert" style="margin-bottom: 0.7rem!important;">
                         Account deleted successfully.
                     </div>
                 {% endif %}
-                {% if failedLogin == true %}
-                    <div class="alert alert-danger" role="alert" style="margin-bottom: 0.7rem!important;">
-                        Invalid credentials
-                    </div>
-                {% else %}
                 {% if redirect != false %}
                     <div class="alert alert-danger" role="alert" style="margin-bottom: 0.7rem!important;">
                         Sign in to access page
                     </div>
                     <input type="hidden" value="{{ redirect }}" name="redirect" />
                 {% endif %}
-                {% endif %}
-                <button class="w-100 btn btn-lg btn-primary mb-3" type="submit">Sign in</button>
+                <button class="w-100 btn btn-lg btn-primary mb-3" type="button" onclick="submitCredentials()">Sign in</button>
                 {% if registrationEnabled == true %}
                     <a href="/create-user">Create new user</a>
                 {% endif %}
             </form>
-        {% elseif useTwoFactorAuthentication == true %}
-            <form action="/verify-totp" method="post">
+            <form id="TotpForm" class="d-none">
                 <p style="margin-bottom: 0">Enter the 6 digit verification code from your authenticator app.</p>
                 <input type="text"
-                       name="totpCode"
-                       class="form-control form-control-lg text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="floatingVerificationCode"
-                       placeholder="Verification code"
-                       maxlength="6"
-                       autocomplete="off"
-                       style="margin-bottom: .7rem;margin-top: .7rem"
-                       required>
-                {% if invalidTotpCode == true %}
-                    <div class="alert alert-danger alert-dismissible" role="alert" style="margin-bottom: 0.7rem!important;margin-top: .7rem">
-                        Invalid verification code
-                        <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
-                    </div>
-                {% endif %}
-                <button class="w-100 btn btn-lg btn-primary mb-3" type="submit" style="margin-bottom: .7rem!important;">Continue</button>
+                    name="totpCode"
+                    class="form-control form-control-lg text-{{ theme == 'dark' ? 'light' : 'dark' }}"
+                    placeholder="Verification code"
+                    maxlength="6"
+                    autocomplete="off"
+                    style="margin-bottom: .7rem;margin-top: .7rem"
+                    id="totpCode"
+                    required>
+                <div id="totpErrors"></div>
+                <button class="w-100 btn btn-lg btn-primary mb-3" type="button" style="margin-bottom: .7rem!important;" onclick="submitCredentials()">Continue</button>
+                <a href="/">Back</a>
             </form>
-            <a href="/">Back</a>
-        {% endif %}
-
-    </main>
+        </main>
 {% endblock %}

From d4ee3ce6bcb7735708b66947b4a0b6d4a11c5c7e Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 11:58:13 +0100
Subject: [PATCH 02/27] Clean up

---
 src/Domain/User/Service/Authentication.php    |  3 --
 .../Web/AuthenticationController.php          | 33 -------------------
 templates/page/login.html.twig                |  7 ++--
 3 files changed, 3 insertions(+), 40 deletions(-)

diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index f272f2bb..086fba52 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -9,7 +9,6 @@
 use Movary\Domain\User\UserApi;
 use Movary\Domain\User\UserEntity;
 use Movary\Domain\User\UserRepository;
-use Movary\Service\ServerSettings;
 use Movary\Util\SessionWrapper;
 use Movary\ValueObject\DateTime;
 use Movary\ValueObject\Http\Request;
@@ -24,7 +23,6 @@ public function __construct(
         private readonly UserRepository $repository,
         private readonly UserApi $userApi,
         private readonly SessionWrapper $sessionWrapper,
-        private readonly ServerSettings $serverSettings,
         private readonly TwoFactorAuthenticationApi $twoFactorAuthenticationApi,
     ) {
     }
@@ -156,7 +154,6 @@ public function createAuthenticationCookie(int $userId, bool $rememberMe) : void
 
         session_regenerate_id();
         setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/');
-        // setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/', $this->serverSettings->getApplicationUrl(), true, true);
 
         $this->sessionWrapper->set('userId', $userId);
     }
diff --git a/src/HttpController/Web/AuthenticationController.php b/src/HttpController/Web/AuthenticationController.php
index 86977af9..460fc2f4 100644
--- a/src/HttpController/Web/AuthenticationController.php
+++ b/src/HttpController/Web/AuthenticationController.php
@@ -23,39 +23,6 @@ public function __construct(
     ) {
     }
 
-    public function login(Request $request) : Response
-    {
-        $postParameters = $request->getPostParameters();
-
-        try {
-            $this->authenticationService->login(
-                $postParameters['email'],
-                $postParameters['password'],
-                isset($postParameters['rememberMe']) === true,
-            );
-        } catch (NoVerificationCode) {
-            $this->sessionWrapper->set('useTwoFactorAuthentication', true);
-        } catch (InvalidCredentials) {
-            $this->sessionWrapper->set('failedLogin', true);
-        }
-        $redirect = $postParameters['redirect'];
-        $target = $redirect ?? $_SERVER['HTTP_REFERER'];
-
-        $urlParts = parse_url($target);
-        if (is_array($urlParts) === false) {
-            $urlParts = ['path' => '/'];
-        }
-
-        /* @phpstan-ignore-next-line */
-        $targetRelativeUrl = $urlParts['path'] . $urlParts['query'] ?? '';
-
-        return Response::create(
-            StatusCode::createSeeOther(),
-            null,
-            [Header::createLocation($targetRelativeUrl)],
-        );
-    }
-
     public function logout() : Response
     {
         $this->authenticationService->logout();
diff --git a/templates/page/login.html.twig b/templates/page/login.html.twig
index ca86d15f..ba58081a 100644
--- a/templates/page/login.html.twig
+++ b/templates/page/login.html.twig
@@ -20,19 +20,19 @@
             <form id="LoginForm">
                 <h1 id="header" class="text-{{ theme == 'dark' ? 'light' : 'dark' }}" style="margin-bottom: 1rem">{{ applicationName ?? 'Movary' }}</h1>
                 <div class="form-floating">
-                    <input type="email" name="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="email"
+                    <input type="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="email"
                         placeholder="name@example.com" required>
                     <label for="email">Email address</label>
                 </div>
                 <div class="form-floating">
-                    <input type="password" name="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="password"
+                    <input type="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="password"
                         placeholder="Password" required>
                     <label for="password">Password</label>
                 </div>
 
                 <div class="checkbox mb-3" style="margin-bottom: 0.7rem!important;">
                     <label class="text-{{ theme == 'dark' ? 'light' : 'dark' }}">
-                        <input type="checkbox" name="rememberMe" id="rememberMe" value="true" {{ defaultRememberMe == 'true' ? 'checked' : '' }}> Remember me
+                        <input type="checkbox" id="rememberMe" value="true" {{ defaultRememberMe == 'true' ? 'checked' : '' }}> Remember me
                     </label>
                 </div>
 
@@ -57,7 +57,6 @@
             <form id="TotpForm" class="d-none">
                 <p style="margin-bottom: 0">Enter the 6 digit verification code from your authenticator app.</p>
                 <input type="text"
-                    name="totpCode"
                     class="form-control form-control-lg text-{{ theme == 'dark' ? 'light' : 'dark' }}"
                     placeholder="Verification code"
                     maxlength="6"

From c80cc60034f939166dfe7c03de6dfc5839f75970 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 12:21:12 +0100
Subject: [PATCH 03/27] Add user agent string and device name to auth token
 table

---
 ...11_add_device_name_to_auth_token_table.php | 28 +++++++++++
 ...33_add_device_name_to_auth_token_table.php | 48 +++++++++++++++++++
 src/Domain/User/Service/Authentication.php    | 12 ++---
 src/Domain/User/UserRepository.php            |  4 +-
 .../Api/AuthenticationController.php          |  4 +-
 5 files changed, 88 insertions(+), 8 deletions(-)
 create mode 100644 db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php
 create mode 100644 db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php

diff --git a/db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php b/db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php
new file mode 100644
index 00000000..fe237e99
--- /dev/null
+++ b/db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+use Phinx\Migration\AbstractMigration;
+
+final class AddDeviceNameToAuthTokenTable extends AbstractMigration
+{
+    public function down() : void
+    {
+        $this->execute(
+            <<<SQL
+            ALTER TABLE `user_auth_token` DROP COLUMN device_name;
+            ALTER TABLE `user_auth_token` DROP COLUMN user_agent_string;
+            SQL,
+        );
+    }
+
+    public function up() : void
+    {
+        $this->execute(
+            <<<SQL
+            ALTER TABLE `user_auth_token` ADD COLUMN device_name VARCHAR(256);
+            ALTER TABLE `user_auth_token` ADD COLUMN user_agent_string VARCHAR(256);
+            SQL,
+        );
+    }
+}
diff --git a/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php b/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
new file mode 100644
index 00000000..f2e35885
--- /dev/null
+++ b/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+use Phinx\Migration\AbstractMigration;
+
+final class AddDeviceNameToAuthTokenTable extends AbstractMigration
+{
+    public function down() : void
+    {
+        $this->execute(
+            <<<SQL
+            CREATE TABLE `user_api_token_old` (
+                `user_id` INT(10) NOT NULL,
+                `token` CHAR(36) NOT NULL,
+                `created_at` TEXT NOT NULL,
+                PRIMARY KEY (`token`),
+                UNIQUE (`user_id`),
+                FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON DELETE CASCADE
+            )
+            SQL,
+        );
+        $this->execute('INSERT INTO `user_api_token_old` (`user_id`, `token`, `created_at`) SELECT `user_id`, `token`, `created_at` FROM `user_api_token`');
+        $this->execute('DROP TABLE `user_api_token`');
+        $this->execute('ALTER TABLE `user_api_token_old` RENAME TO `user_api_token`');
+    }
+
+    public function up() : void
+    {
+        $this->execute(
+            <<<SQL
+            CREATE TABLE `user_api_token_new` (
+                `user_id` INT(10) NOT NULL,
+                `token` CHAR(36) NOT NULL,
+                `device_name` VARCHAR(256) NOT NULL,
+                `user_agent_string` VARCHAR(256) NOT NULL,
+                `created_at` TEXT NOT NULL,
+                PRIMARY KEY (`token`),
+                UNIQUE (`user_id`),
+                FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON DELETE CASCADE
+            )
+            SQL,
+        );
+        $this->execute('INSERT INTO `user_api_token_new` (`user_id`, `token`, `created_at`) SELECT * FROM `user_api_token`');
+        $this->execute('DELETE `user_api_token`');
+        $this->execute('ALTER TABLE `user_api_token_new` RENAME TO `user_api_token`');
+    }
+}
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index 086fba52..c5d09b68 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -110,7 +110,7 @@ public function isUserPageVisibleForApiRequest(Request $request, UserEntity $tar
         return $targetUser->getId() === $userId;
     }
 
-    public function login(string $email, string $password, bool $rememberMe, ?int $userTotpInput = null) : void
+    public function login(string $email, string $password, bool $rememberMe, string $deviceName, string $userAgent, ?int $userTotpInput = null) : void
     {
         if ($this->isUserAuthenticated() === true) {
             return;
@@ -137,10 +137,10 @@ public function login(string $email, string $password, bool $rememberMe, ?int $u
             }
         }
 
-        $this->createAuthenticationCookie($user->getId(), $rememberMe);
+        $this->createAuthenticationCookie($user->getId(), $rememberMe, $deviceName, $userAgent);
     }
 
-    public function createAuthenticationCookie(int $userId, bool $rememberMe) : void
+    public function createAuthenticationCookie(int $userId, bool $rememberMe, string $deviceName, string $userAgent) : void
     {
         $authTokenExpirationDate = $this->createExpirationDate();
         $cookieExpiration = 0;
@@ -150,7 +150,7 @@ public function createAuthenticationCookie(int $userId, bool $rememberMe) : void
             $cookieExpiration = (int)$authTokenExpirationDate->format('U');
         }
 
-        $token = $this->generateToken($userId, DateTime::createFromString((string)$authTokenExpirationDate));
+        $token = $this->generateToken($userId, $deviceName, $userAgent, DateTime::createFromString((string)$authTokenExpirationDate));
 
         session_regenerate_id();
         setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/');
@@ -183,7 +183,7 @@ public function createExpirationDate(int $days = 1) : DateTime
         return DateTime::createFromString(date('Y-m-d H:i:s', $timestamp));
     }
 
-    private function generateToken(int $userId, ?DateTime $expirationDate = null) : string
+    private function generateToken(int $userId, string $deviceName, string $userAgent, ?DateTime $expirationDate = null) : string
     {
         if ($expirationDate === null) {
             $expirationDate = $this->createExpirationDate();
@@ -191,7 +191,7 @@ private function generateToken(int $userId, ?DateTime $expirationDate = null) :
 
         $token = bin2hex(random_bytes(16));
 
-        $this->repository->createAuthToken($userId, $token, $expirationDate);
+        $this->repository->createAuthToken($userId, $token, $deviceName, $userAgent, $expirationDate);
 
         return $token;
     }
diff --git a/src/Domain/User/UserRepository.php b/src/Domain/User/UserRepository.php
index 47ecc287..91217cbc 100644
--- a/src/Domain/User/UserRepository.php
+++ b/src/Domain/User/UserRepository.php
@@ -26,7 +26,7 @@ public function createApiToken(int $userId, string $token) : void
         );
     }
 
-    public function createAuthToken(int $userId, string $token, DateTime $expirationDate) : void
+    public function createAuthToken(int $userId, string $token, string $deviceName, string $userAgent, DateTime $expirationDate) : void
     {
         $this->dbConnection->insert(
             'user_auth_token',
@@ -34,6 +34,8 @@ public function createAuthToken(int $userId, string $token, DateTime $expiration
                 'user_id' => $userId,
                 'token' => $token,
                 'expiration_date' => (string)$expirationDate,
+                'device_name' => $deviceName,
+                'user_agent_string' => $userAgent,
                 'created_at' => (string)DateTime::create(),
             ],
         );
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index ae1b125c..5dae67e0 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -29,6 +29,8 @@ public function requestToken(Request $request) : Response
             return Response::createBadRequest('Username or password has not been provided');
         }
         $totpCode = $postParameters['totpCode'] ?? 0;
+        $rememberMe = (bool)$postParameters['rememberMe'] ?? false;
+        $userAgent = $request->getUserAgent();
         
         if(isset($headers['X-Movary-Client']) === false) {
             return Response::createBadRequest();
@@ -37,7 +39,7 @@ public function requestToken(Request $request) : Response
         $client = $headers['X-Movary-Client'];
 
         try {
-            $this->authenticationService->login($postParameters['email'], $postParameters['password'], false, (int)$totpCode);
+            $this->authenticationService->login($postParameters['email'], $postParameters['password'], $rememberMe, $client, $userAgent, (int)$totpCode);
 
             if($client === 'Movary Web') {
                 $redirect = $postParameters['redirect'] ?? null;

From 7d3301a26b7235220a251443a64c3a5a4ab6630f Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 12:31:01 +0100
Subject: [PATCH 04/27] Fix migration for sqlite

---
 ...33_add_device_name_to_auth_token_table.php | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php b/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
index f2e35885..167ce526 100644
--- a/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
+++ b/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
@@ -10,39 +10,41 @@ public function down() : void
     {
         $this->execute(
             <<<SQL
-            CREATE TABLE `user_api_token_old` (
-                `user_id` INT(10) NOT NULL,
-                `token` CHAR(36) NOT NULL,
+            CREATE TABLE `user_auth_token` (
+                `id` INTEGER NOT NULL,
+                `user_id` INTEGER NOT NULL,
+                `token` TEXT NOT NULL,
+                `expiration_date` TEXT NOT NULL,
                 `created_at` TEXT NOT NULL,
-                PRIMARY KEY (`token`),
-                UNIQUE (`user_id`),
-                FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON DELETE CASCADE
+                PRIMARY KEY (`id`),
+                FOREIGN KEY (`user_id`) REFERENCES user (`id`) ON DELETE CASCADE
             )
             SQL,
         );
-        $this->execute('INSERT INTO `user_api_token_old` (`user_id`, `token`, `created_at`) SELECT `user_id`, `token`, `created_at` FROM `user_api_token`');
-        $this->execute('DROP TABLE `user_api_token`');
-        $this->execute('ALTER TABLE `user_api_token_old` RENAME TO `user_api_token`');
+        $this->execute('INSERT INTO `user_auth_token_old` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT `id`, `user_id`, `token`, `expiration_date`, `created_at` FROM `user_auth_token`');
+        $this->execute('DROP TABLE `user_auth_token`');
+        $this->execute('ALTER TABLE `user_auth_token_old` RENAME TO `user_auth_token`');
     }
 
     public function up() : void
     {
         $this->execute(
             <<<SQL
-            CREATE TABLE `user_api_token_new` (
+            CREATE TABLE `user_auth_token_new` (
+                `id` INTEGER NOT NULL,
                 `user_id` INT(10) NOT NULL,
                 `token` CHAR(36) NOT NULL,
                 `device_name` VARCHAR(256) NOT NULL,
                 `user_agent_string` VARCHAR(256) NOT NULL,
+                `expiration_date` TEXT NOT NULL,
                 `created_at` TEXT NOT NULL,
-                PRIMARY KEY (`token`),
-                UNIQUE (`user_id`),
-                FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON DELETE CASCADE
+                PRIMARY KEY (`id`),
+                FOREIGN KEY (`user_id`) REFERENCES user (`id`) ON DELETE CASCADE
             )
             SQL,
         );
-        $this->execute('INSERT INTO `user_api_token_new` (`user_id`, `token`, `created_at`) SELECT * FROM `user_api_token`');
-        $this->execute('DELETE `user_api_token`');
-        $this->execute('ALTER TABLE `user_api_token_new` RENAME TO `user_api_token`');
+        $this->execute('INSERT INTO `user_auth_token_new` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT * FROM `user_auth_token`');
+        $this->execute('DROP TABLE `user_auth_token`');
+        $this->execute('ALTER TABLE `user_auth_token_new` RENAME TO `user_auth_token`');
     }
 }

From ac93a309bf956e0c07fca30760c95a2ce4f8fc28 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 12:46:39 +0100
Subject: [PATCH 05/27] Fix tests

---
 settings/routes.php                           |  1 -
 src/Domain/User/Service/Authentication.php    |  4 +--
 .../Api/AuthenticationController.php          |  8 +-----
 .../Web/CreateUserController.php              |  5 +++-
 .../Web/LandingPageController.php             |  2 ++
 .../Web/TwoFactorAuthenticationController.php | 25 -------------------
 6 files changed, 9 insertions(+), 36 deletions(-)

diff --git a/settings/routes.php b/settings/routes.php
index 745d4ae9..f2424f85 100644
--- a/settings/routes.php
+++ b/settings/routes.php
@@ -20,7 +20,6 @@ function addWebRoutes(RouterService $routerService, FastRoute\RouteCollector $ro
     $routes->add('GET', '/', [Web\LandingPageController::class, 'render'], [Web\Middleware\UserIsUnauthenticated::class, Web\Middleware\ServerHasNoUsers::class]);
     $routes->add('GET', '/login', [Web\AuthenticationController::class, 'renderLoginPage'], [Web\Middleware\UserIsUnauthenticated::class]);
     $routes->add('POST', '/login', [Web\AuthenticationController::class, 'login']);
-    $routes->add('POST', '/verify-totp', [Web\TwoFactorAuthenticationController::class, 'verifyTotp'], [Web\Middleware\UserIsUnauthenticated::class]);
     $routes->add('GET', '/logout', [Web\AuthenticationController::class, 'logout']);
     $routes->add('POST', '/create-user', [Web\CreateUserController::class, 'createUser'], [
         Web\Middleware\UserIsUnauthenticated::class,
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index c5d09b68..f01371cd 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -217,9 +217,9 @@ public function getToken() : ?string
     }
 
 
-    private function verifyTotp($userId, $userTotpInput) : bool
+    private function verifyTotp(int $userId, int $userTotpInput) : bool
     {
-        if ($this->twoFactorAuthenticationApi->verifyTotpUri($userId, (int)$userTotpInput) === false) {
+        if ($this->twoFactorAuthenticationApi->verifyTotpUri($userId, $userTotpInput) === false) {
             return false;
         }
         return true;
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 5dae67e0..3724e1e6 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -3,12 +3,8 @@
 namespace Movary\HttpController\Api;
 
 use Movary\Domain\User\Exception\InvalidCredentials;
-use Movary\Domain\User\Exception\InvalidTotpCode;
-use Movary\Domain\User\Exception\NoVerificationCode;
 use Movary\Domain\User\Service\Authentication;
-use Movary\Domain\User\Service\TwoFactorAuthenticationApi;
 use Movary\Util\Json;
-use Movary\Util\SessionWrapper;
 use Movary\ValueObject\Http\Request;
 use Movary\ValueObject\Http\Response;
 
@@ -16,8 +12,6 @@ class AuthenticationController
 {
     public function __construct(
         private readonly Authentication $authenticationService,
-        private readonly TwoFactorAuthenticationApi $twoFactorAuthenticationApi,
-        private readonly SessionWrapper $sessionWrapper,
     ) {
     }
 
@@ -29,7 +23,7 @@ public function requestToken(Request $request) : Response
             return Response::createBadRequest('Username or password has not been provided');
         }
         $totpCode = $postParameters['totpCode'] ?? 0;
-        $rememberMe = (bool)$postParameters['rememberMe'] ?? false;
+        $rememberMe = (bool)$postParameters['rememberMe'];
         $userAgent = $request->getUserAgent();
         
         if(isset($headers['X-Movary-Client']) === false) {
diff --git a/src/HttpController/Web/CreateUserController.php b/src/HttpController/Web/CreateUserController.php
index 307afe59..df7f24cd 100644
--- a/src/HttpController/Web/CreateUserController.php
+++ b/src/HttpController/Web/CreateUserController.php
@@ -18,6 +18,8 @@
 
 class CreateUserController
 {
+    private const MOVARY_WEB_CLIENT = 'Movary Web';
+    
     public function __construct(
         private readonly Environment $twig,
         private readonly Authentication $authenticationService,
@@ -32,6 +34,7 @@ public function createUser(Request $request) : Response
         $hasUsers = $this->userApi->hasUsers();
         $postParameters = $request->getPostParameters();
 
+        $userAgent = $request->getUserAgent();
         $email = empty($postParameters['email']) === true ? null : (string)$postParameters['email'];
         $name = empty($postParameters['name']) === true ? null : (string)$postParameters['name'];
         $password = empty($postParameters['password']) === true ? null : (string)$postParameters['password'];
@@ -60,7 +63,7 @@ public function createUser(Request $request) : Response
         try {
             $this->userApi->createUser($email, $password, $name, $hasUsers === false);
 
-            $this->authenticationService->login($email, $password, false);
+            $this->authenticationService->login($email, $password, false, self::MOVARY_WEB_CLIENT, $userAgent);
         } catch (PasswordTooShort) {
             $this->sessionWrapper->set('errorPasswordTooShort', true);
         } catch (UsernameInvalidFormat) {
diff --git a/src/HttpController/Web/LandingPageController.php b/src/HttpController/Web/LandingPageController.php
index d5ef5c6e..f64ab0ef 100644
--- a/src/HttpController/Web/LandingPageController.php
+++ b/src/HttpController/Web/LandingPageController.php
@@ -29,6 +29,8 @@ public function render() : Response
             $this->twig->render('page/login.html.twig', [
                 'deletedAccount' => $deletedAccount,
                 'registrationEnabled' => $this->registrationEnabled,
+                'defaultEmail' => $this->defaultEmail,
+                'defaultPassword' => $this->defaultPassword
             ]),
         );
     }
diff --git a/src/HttpController/Web/TwoFactorAuthenticationController.php b/src/HttpController/Web/TwoFactorAuthenticationController.php
index 0fa6a0ad..a563e5b5 100644
--- a/src/HttpController/Web/TwoFactorAuthenticationController.php
+++ b/src/HttpController/Web/TwoFactorAuthenticationController.php
@@ -61,29 +61,4 @@ public function enableTOTP(Request $request) : Response
 
         return Response::createOk();
     }
-
-    public function verifyTotp(Request $request) : Response
-    {
-        $userTotpInput = $request->getPostParameters()['totpCode'];
-        $rememberMe = $this->sessionWrapper->find('rememberMe') ?? false;
-        $userId = (int)$this->sessionWrapper->find('totpUserId');
-
-        if ($this->twoFactorAuthenticationApi->verifyTotpUri($userId, (int)$userTotpInput) === false) {
-            $this->sessionWrapper->set('invalidTotpCode', true);
-
-            return Response::create(
-                StatusCode::createSeeOther(),
-                null,
-                [Header::createLocation($_SERVER['HTTP_REFERER'])],
-            );
-        }
-
-        $this->authenticationService->createAuthenticationCookie($userId, $rememberMe);
-
-        return Response::create(
-            StatusCode::createSeeOther(),
-            null,
-            [Header::createLocation($_SERVER['HTTP_REFERER'])],
-        );
-    }
 }

From d87f8ca1b262d65c6b88417b76f0bc3e08f65176 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 12:54:13 +0100
Subject: [PATCH 06/27] Fix openapi spec

---
 docs/openapi.json                            | 3 +++
 src/HttpController/Web/OpenApiController.php | 6 +++---
 templates/page/api.html.twig                 | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 9a277de7..5242d27a 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1068,6 +1068,9 @@
     },
     "/authentication/request-token": {
       "post": {
+        "tags": [
+          "Authentication"
+        ],
         "description": "Get an authentication token by submitting an email, password and optionally a time-based 6-digit code. This token can be stored and used for future requests to protected endpoints.",
         "parameters": [{
           "in": "header",
diff --git a/src/HttpController/Web/OpenApiController.php b/src/HttpController/Web/OpenApiController.php
index 0507f799..0aa7be99 100644
--- a/src/HttpController/Web/OpenApiController.php
+++ b/src/HttpController/Web/OpenApiController.php
@@ -17,17 +17,17 @@ public function __construct(
 
     public function renderPage() : Response
     {
-        $openAiJsonUrl = '/api/openapi';
+        $openApiJsonUrl = '/api/openapi';
 
         $applicationUrl = $this->serverSettings->getApplicationUrl();
         if ($applicationUrl !== null) {
-            $openAiJsonUrl = trim($applicationUrl, '/') . $openAiJsonUrl;
+            $openApiJsonUrl = trim($applicationUrl, '/') . $openApiJsonUrl;
         }
 
         return Response::create(
             StatusCode::createOk(),
             $this->twig->render('page/api.html.twig', [
-                'openAiJsonUrl' => $openAiJsonUrl
+                'openApiJsonUrl' => $openApiJsonUrl
             ]),
         );
     }
diff --git a/templates/page/api.html.twig b/templates/page/api.html.twig
index 93384f59..05835e0b 100644
--- a/templates/page/api.html.twig
+++ b/templates/page/api.html.twig
@@ -12,7 +12,7 @@
 <script>
     window.onload = () => {
         window.ui = SwaggerUIBundle({
-            url: "{{ openAiJsonUrl }}",
+            url: "{{ openApiJsonUrl }}",
             dom_id: '#swagger-ui',
         });
     };

From 2dc466a09de2bb683ea129939448b587c422d755 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 13:31:53 +0100
Subject: [PATCH 07/27] Fix bug

---
 docs/openapi.json                                   | 2 +-
 src/HttpController/Api/AuthenticationController.php | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 5242d27a..43d4b319 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1085,7 +1085,7 @@
           "description": "The credentials and optionally a two-factor Authentication code",
           "required": true,
           "content": {
-            "application/x-www-form-urlencoded": {
+            "application/json": {
               "schema": {
                 "type": "object",
                 "required": ["email", "password"],
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 3724e1e6..776670c0 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -23,7 +23,7 @@ public function requestToken(Request $request) : Response
             return Response::createBadRequest('Username or password has not been provided');
         }
         $totpCode = $postParameters['totpCode'] ?? 0;
-        $rememberMe = (bool)$postParameters['rememberMe'];
+        $rememberMe = $postParameters['rememberMe'] ?? false;
         $userAgent = $request->getUserAgent();
         
         if(isset($headers['X-Movary-Client']) === false) {
@@ -33,7 +33,7 @@ public function requestToken(Request $request) : Response
         $client = $headers['X-Movary-Client'];
 
         try {
-            $this->authenticationService->login($postParameters['email'], $postParameters['password'], $rememberMe, $client, $userAgent, (int)$totpCode);
+            $this->authenticationService->login($postParameters['email'], $postParameters['password'], (bool)$rememberMe, $client, $userAgent, (int)$totpCode);
 
             if($client === 'Movary Web') {
                 $redirect = $postParameters['redirect'] ?? null;

From 088e977986283500100ff71c010bb37bb0f0503e Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Fri, 26 Jan 2024 17:21:37 +0100
Subject: [PATCH 08/27] Set auth cookie to httpOnly (not sure if it works now)

---
 src/Domain/User/Service/Authentication.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index f01371cd..04896e56 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -153,7 +153,14 @@ public function createAuthenticationCookie(int $userId, bool $rememberMe, string
         $token = $this->generateToken($userId, $deviceName, $userAgent, DateTime::createFromString((string)$authTokenExpirationDate));
 
         session_regenerate_id();
-        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, $cookieExpiration, '/');
+        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
+            'expires' => $cookieExpiration,
+            'path' => '/',
+            'domain' => '',
+            'secure' => false,
+            'httponly' => true,
+            'samesite' => 'strict'
+        ]);
 
         $this->sessionWrapper->set('userId', $userId);
     }

From f1773e792cec9ae8e2835b56f347008bd3c1611a Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 12:59:15 +0100
Subject: [PATCH 09/27] Improve migrations and database structure

---
 ...0011_AddDeviceNameAndUserAgentToAuthTokenTable.php} | 10 ++++------
 ...0433_AddDeviceNameAndUserAgentToAuthTokenTable.php} |  8 +++-----
 src/Domain/User/UserRepository.php                     |  2 +-
 3 files changed, 8 insertions(+), 12 deletions(-)
 rename db/migrations/mysql/{20240126110011_add_device_name_to_auth_token_table.php => 20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php} (71%)
 rename db/migrations/sqlite/{20240126110433_add_device_name_to_auth_token_table.php => 20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php} (91%)

diff --git a/db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
similarity index 71%
rename from db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php
rename to db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
index fe237e99..2d217035 100644
--- a/db/migrations/mysql/20240126110011_add_device_name_to_auth_token_table.php
+++ b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -1,17 +1,15 @@
-<?php
-
-declare(strict_types=1);
+<?php declare(strict_types=1);
 
 use Phinx\Migration\AbstractMigration;
 
-final class AddDeviceNameToAuthTokenTable extends AbstractMigration
+final class AddDeviceNameAndUserAgentToAuthTokenTable extends AbstractMigration
 {
     public function down() : void
     {
         $this->execute(
             <<<SQL
             ALTER TABLE `user_auth_token` DROP COLUMN device_name;
-            ALTER TABLE `user_auth_token` DROP COLUMN user_agent_string;
+            ALTER TABLE `user_auth_token` DROP COLUMN user_agent;
             SQL,
         );
     }
@@ -21,7 +19,7 @@ public function up() : void
         $this->execute(
             <<<SQL
             ALTER TABLE `user_auth_token` ADD COLUMN device_name VARCHAR(256);
-            ALTER TABLE `user_auth_token` ADD COLUMN user_agent_string VARCHAR(256);
+            ALTER TABLE `user_auth_token` ADD COLUMN user_agent VARCHAR(256);
             SQL,
         );
     }
diff --git a/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
similarity index 91%
rename from db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
rename to db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
index 167ce526..86066295 100644
--- a/db/migrations/sqlite/20240126110433_add_device_name_to_auth_token_table.php
+++ b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -1,10 +1,8 @@
-<?php
-
-declare(strict_types=1);
+<?php declare(strict_types=1);
 
 use Phinx\Migration\AbstractMigration;
 
-final class AddDeviceNameToAuthTokenTable extends AbstractMigration
+final class AddDeviceNameAndUserAgentToAuthTokenTable extends AbstractMigration
 {
     public function down() : void
     {
@@ -35,7 +33,7 @@ public function up() : void
                 `user_id` INT(10) NOT NULL,
                 `token` CHAR(36) NOT NULL,
                 `device_name` VARCHAR(256) NOT NULL,
-                `user_agent_string` VARCHAR(256) NOT NULL,
+                `user_agent` VARCHAR(256) NOT NULL,
                 `expiration_date` TEXT NOT NULL,
                 `created_at` TEXT NOT NULL,
                 PRIMARY KEY (`id`),
diff --git a/src/Domain/User/UserRepository.php b/src/Domain/User/UserRepository.php
index 91217cbc..b105f379 100644
--- a/src/Domain/User/UserRepository.php
+++ b/src/Domain/User/UserRepository.php
@@ -35,7 +35,7 @@ public function createAuthToken(int $userId, string $token, string $deviceName,
                 'token' => $token,
                 'expiration_date' => (string)$expirationDate,
                 'device_name' => $deviceName,
-                'user_agent_string' => $userAgent,
+                'user_agent' => $userAgent,
                 'created_at' => (string)DateTime::create(),
             ],
         );

From 7f9fb2c68fa430de79974156ad37fd8cde8e81e8 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 13:01:52 +0100
Subject: [PATCH 10/27] Remove duplicate definition of movary device name

---
 src/HttpController/Api/AuthenticationController.php | 5 +++--
 src/HttpController/Web/CreateUserController.php     | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 776670c0..6d3a3729 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -4,6 +4,7 @@
 
 use Movary\Domain\User\Exception\InvalidCredentials;
 use Movary\Domain\User\Service\Authentication;
+use Movary\HttpController\Web\CreateUserController;
 use Movary\Util\Json;
 use Movary\ValueObject\Http\Request;
 use Movary\ValueObject\Http\Response;
@@ -35,7 +36,7 @@ public function requestToken(Request $request) : Response
         try {
             $this->authenticationService->login($postParameters['email'], $postParameters['password'], (bool)$rememberMe, $client, $userAgent, (int)$totpCode);
 
-            if($client === 'Movary Web') {
+            if($client === CreateUserController::MOVARY_WEB_CLIENT) {
                 $redirect = $postParameters['redirect'] ?? null;
                 $target = $redirect ?? $_SERVER['HTTP_REFERER'];
         
@@ -59,4 +60,4 @@ public function requestToken(Request $request) : Response
             ]));
         }
     }
-}
\ No newline at end of file
+}
diff --git a/src/HttpController/Web/CreateUserController.php b/src/HttpController/Web/CreateUserController.php
index df7f24cd..1af6d6dd 100644
--- a/src/HttpController/Web/CreateUserController.php
+++ b/src/HttpController/Web/CreateUserController.php
@@ -18,7 +18,7 @@
 
 class CreateUserController
 {
-    private const MOVARY_WEB_CLIENT = 'Movary Web';
+    public const MOVARY_WEB_CLIENT = 'Movary Web';
     
     public function __construct(
         private readonly Environment $twig,

From 5fb8ae78554da4ca321dad6aa4ad63c3e2245e42 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 13:15:08 +0100
Subject: [PATCH 11/27] Some minor refactoring for namings and structure

---
 ...rificationCode.php => MissingTotpCode.php} |   4 +-
 src/Domain/User/Service/Authentication.php    | 159 +++++++++---------
 .../Api/AuthenticationController.php          |  72 ++++----
 .../Web/AuthenticationController.php          |   2 +-
 4 files changed, 120 insertions(+), 117 deletions(-)
 rename src/Domain/User/Exception/{NoVerificationCode.php => MissingTotpCode.php} (53%)

diff --git a/src/Domain/User/Exception/NoVerificationCode.php b/src/Domain/User/Exception/MissingTotpCode.php
similarity index 53%
rename from src/Domain/User/Exception/NoVerificationCode.php
rename to src/Domain/User/Exception/MissingTotpCode.php
index 6a28e84c..771da4f5 100644
--- a/src/Domain/User/Exception/NoVerificationCode.php
+++ b/src/Domain/User/Exception/MissingTotpCode.php
@@ -2,10 +2,10 @@
 
 namespace Movary\Domain\User\Exception;
 
-class NoVerificationCode extends InvalidCredentials
+class MissingTotpCode extends InvalidCredentials
 {
     public static function create() : self
     {
-        return new self('Verification code is not present.');
+        return new self('Two-factor authentication code missing.');
     }
 }
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index 04896e56..560470eb 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -5,7 +5,7 @@
 use Movary\Domain\User\Exception\EmailNotFound;
 use Movary\Domain\User\Exception\InvalidPassword;
 use Movary\Domain\User\Exception\InvalidTotpCode;
-use Movary\Domain\User\Exception\NoVerificationCode;
+use Movary\Domain\User\Exception\MissingTotpCode;
 use Movary\Domain\User\UserApi;
 use Movary\Domain\User\UserEntity;
 use Movary\Domain\User\UserRepository;
@@ -17,6 +17,7 @@
 class Authentication
 {
     private const AUTHENTICATION_COOKIE_NAME = 'id';
+
     private const MAX_EXPIRATION_AGE_IN_DAYS = 30;
 
     public function __construct(
@@ -27,6 +28,42 @@ public function __construct(
     ) {
     }
 
+    public function createAuthenticationCookie(int $userId, bool $rememberMe, string $deviceName, string $userAgent) : void
+    {
+        $authTokenExpirationDate = $this->createExpirationDate();
+        $cookieExpiration = 0;
+
+        if ($rememberMe === true) {
+            $authTokenExpirationDate = $this->createExpirationDate(self::MAX_EXPIRATION_AGE_IN_DAYS);
+            $cookieExpiration = (int)$authTokenExpirationDate->format('U');
+        }
+
+        $token = $this->generateToken($userId, $deviceName, $userAgent, DateTime::createFromString((string)$authTokenExpirationDate));
+
+        session_regenerate_id();
+        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
+            'expires' => $cookieExpiration,
+            'path' => '/',
+            'domain' => '',
+            'secure' => false,
+            'httponly' => true,
+            'samesite' => 'strict'
+        ]);
+
+        $this->sessionWrapper->set('userId', $userId);
+    }
+
+    public function createExpirationDate(int $days = 1) : DateTime
+    {
+        $timestamp = strtotime('+' . $days . ' day');
+
+        if ($timestamp === false) {
+            throw new RuntimeException('Could not generate timestamp for auth token expiration date.');
+        }
+
+        return DateTime::createFromString(date('Y-m-d H:i:s', $timestamp));
+    }
+
     public function deleteToken(string $token) : void
     {
         $this->repository->deleteAuthToken($token);
@@ -54,6 +91,11 @@ public function getCurrentUserId() : int
         return $userId;
     }
 
+    public function getToken() : ?string
+    {
+        return $_COOKIE[self::AUTHENTICATION_COOKIE_NAME];
+    }
+
     public function getUserIdByApiToken(Request $request) : ?int
     {
         $apiToken = $request->getHeaders()['X-Auth-Token'] ?? null;
@@ -80,38 +122,59 @@ public function isUserAuthenticated() : bool
         return false;
     }
 
-    public function isUserPageVisibleForCurrentUser(int $privacyLevel, int $userId) : bool
+    public function isUserPageVisibleForApiRequest(Request $request, UserEntity $targetUser) : bool
     {
+        $userId = $this->getUserIdByApiToken($request);
+
+        $privacyLevel = $targetUser->getPrivacyLevel();
+
         if ($privacyLevel === 2) {
             return true;
         }
 
-        if ($privacyLevel === 1 && $this->isUserAuthenticated() === true) {
+        if ($privacyLevel === 1 && $userId !== null) {
             return true;
         }
 
-        return $this->isUserAuthenticated() === true && $this->getCurrentUserId() === $userId;
+        return $targetUser->getId() === $userId;
     }
 
-    public function isUserPageVisibleForApiRequest(Request $request, UserEntity $targetUser) : bool
+    public function isUserPageVisibleForCurrentUser(int $privacyLevel, int $userId) : bool
     {
-        $userId = $this->getUserIdByApiToken($request);
-
-        $privacyLevel = $targetUser->getPrivacyLevel();
-
         if ($privacyLevel === 2) {
             return true;
         }
 
-        if ($privacyLevel === 1 && $userId !== null) {
+        if ($privacyLevel === 1 && $this->isUserAuthenticated() === true) {
             return true;
         }
 
-        return $targetUser->getId() === $userId;
+        return $this->isUserAuthenticated() === true && $this->getCurrentUserId() === $userId;
     }
 
-    public function login(string $email, string $password, bool $rememberMe, string $deviceName, string $userAgent, ?int $userTotpInput = null) : void
+    public function isValidToken(string $token) : bool
     {
+        $tokenExpirationDate = $this->repository->findAuthTokenExpirationDate($token);
+
+        if ($tokenExpirationDate === null || $tokenExpirationDate->isAfter(DateTime::create()) === false) {
+            if ($tokenExpirationDate !== null) {
+                $this->repository->deleteAuthToken($token);
+            }
+
+            return false;
+        }
+
+        return true;
+    }
+
+    public function login(
+        string $email,
+        string $password,
+        bool $rememberMe,
+        string $deviceName,
+        string $userAgent,
+        ?int $userTotpInput = null,
+    ) : void {
         if ($this->isUserAuthenticated() === true) {
             return;
         }
@@ -129,10 +192,11 @@ public function login(string $email, string $password, bool $rememberMe, string
         $totpUri = $this->userApi->findTotpUri($user->getId());
 
         if ($totpUri !== null) {
-            if(empty($userTotpInput)) {
-                throw NoVerificationCode::create();
+            if (empty($userTotpInput) === true) {
+                throw MissingTotpCode::create();
             }
-            if($this->verifyTotp($user->getId(), $userTotpInput) === false) {
+
+            if ($this->twoFactorAuthenticationApi->verifyTotpUri($user->getId(), $userTotpInput) === false) {
                 throw InvalidTotpCode::create();
             }
         }
@@ -140,31 +204,6 @@ public function login(string $email, string $password, bool $rememberMe, string
         $this->createAuthenticationCookie($user->getId(), $rememberMe, $deviceName, $userAgent);
     }
 
-    public function createAuthenticationCookie(int $userId, bool $rememberMe, string $deviceName, string $userAgent) : void
-    {
-        $authTokenExpirationDate = $this->createExpirationDate();
-        $cookieExpiration = 0;
-
-        if ($rememberMe === true) {
-            $authTokenExpirationDate = $this->createExpirationDate(self::MAX_EXPIRATION_AGE_IN_DAYS);
-            $cookieExpiration = (int)$authTokenExpirationDate->format('U');
-        }
-
-        $token = $this->generateToken($userId, $deviceName, $userAgent, DateTime::createFromString((string)$authTokenExpirationDate));
-
-        session_regenerate_id();
-        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
-            'expires' => $cookieExpiration,
-            'path' => '/',
-            'domain' => '',
-            'secure' => false,
-            'httponly' => true,
-            'samesite' => 'strict'
-        ]);
-
-        $this->sessionWrapper->set('userId', $userId);
-    }
-
     public function logout() : void
     {
         $token = filter_input(INPUT_COOKIE, 'id');
@@ -179,17 +218,6 @@ public function logout() : void
         $this->sessionWrapper->start();
     }
 
-    public function createExpirationDate(int $days = 1) : DateTime
-    {
-        $timestamp = strtotime('+' . $days . ' day');
-
-        if ($timestamp === false) {
-            throw new RuntimeException('Could not generate timestamp for auth token expiration date.');
-        }
-
-        return DateTime::createFromString(date('Y-m-d H:i:s', $timestamp));
-    }
-
     private function generateToken(int $userId, string $deviceName, string $userAgent, ?DateTime $expirationDate = null) : string
     {
         if ($expirationDate === null) {
@@ -202,33 +230,4 @@ private function generateToken(int $userId, string $deviceName, string $userAgen
 
         return $token;
     }
-
-    public function isValidToken(string $token) : bool
-    {
-        $tokenExpirationDate = $this->repository->findAuthTokenExpirationDate($token);
-
-        if ($tokenExpirationDate === null || $tokenExpirationDate->isAfter(DateTime::create()) === false) {
-            if ($tokenExpirationDate !== null) {
-                $this->repository->deleteAuthToken($token);
-            }
-
-            return false;
-        }
-
-        return true;
-    }
-
-    public function getToken() : ?string
-    {
-        return $_COOKIE[self::AUTHENTICATION_COOKIE_NAME];
-    }
-
-
-    private function verifyTotp(int $userId, int $userTotpInput) : bool
-    {
-        if ($this->twoFactorAuthenticationApi->verifyTotpUri($userId, $userTotpInput) === false) {
-            return false;
-        }
-        return true;
-    }
 }
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 6d3a3729..1b28588d 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -18,46 +18,50 @@ public function __construct(
 
     public function requestToken(Request $request) : Response
     {
-        $postParameters = Json::decode($request->getBody());
-        $headers = $request->getHeaders();
-        if($postParameters['email'] === null || $postParameters['password'] === null) {
+        $tokenRequestBody = Json::decode($request->getBody());
+
+        if ($tokenRequestBody['email'] === null || $tokenRequestBody['password'] === null) {
             return Response::createBadRequest('Username or password has not been provided');
         }
-        $totpCode = $postParameters['totpCode'] ?? 0;
-        $rememberMe = $postParameters['rememberMe'] ?? false;
-        $userAgent = $request->getUserAgent();
-        
-        if(isset($headers['X-Movary-Client']) === false) {
-            return Response::createBadRequest();
+
+        $headers = $request->getHeaders();
+        if (isset($headers['X-Movary-Client']) === false) {
+            return Response::createBadRequest('Missing request header X-Movary-Client');
         }
-        
-        $client = $headers['X-Movary-Client'];
+
+        $requestClient = $headers['X-Movary-Client'];
+        $totpCode = $tokenRequestBody['totpCode'] ?? 0;
+        $rememberMe = $tokenRequestBody['rememberMe'] ?? false;
 
         try {
-            $this->authenticationService->login($postParameters['email'], $postParameters['password'], (bool)$rememberMe, $client, $userAgent, (int)$totpCode);
-
-            if($client === CreateUserController::MOVARY_WEB_CLIENT) {
-                $redirect = $postParameters['redirect'] ?? null;
-                $target = $redirect ?? $_SERVER['HTTP_REFERER'];
-        
-                $urlParts = parse_url($target);
-                if (is_array($urlParts) === false) {
-                    $urlParts = ['path' => '/'];
-                }
-                $query = $urlParts['query'] ?? '';
-
-                /* @phpstan-ignore-next-line */
-                $targetRelativeUrl = $urlParts['path'] . $query;
-        
-                return Response::createSeeOther($targetRelativeUrl);
-            }
-            
+            $this->authenticationService->login(
+                $tokenRequestBody['email'],
+                $tokenRequestBody['password'],
+                (bool)$rememberMe,
+                $requestClient,
+                $request->getUserAgent(),
+                (int)$totpCode,
+            );
+        } catch (InvalidCredentials) {
+            return Response::createBadRequest('Invalid login credentials');
+        }
+
+        if ($requestClient !== CreateUserController::MOVARY_WEB_CLIENT) {
             return Response::createJson(Json::encode(['token' => $this->authenticationService->getToken()]));
-        } catch (InvalidCredentials $e) {
-            return Response::createBadRequest(Json::encode([
-                'error' => basename(str_replace('\\', '/', get_class($e))),
-                'message' => $e->getMessage()
-            ]));
         }
+
+        $redirect = $tokenRequestBody['redirect'] ?? null;
+        $target = $redirect ?? $_SERVER['HTTP_REFERER'];
+
+        $urlParts = parse_url($target);
+        if (is_array($urlParts) === false) {
+            $urlParts = ['path' => '/'];
+        }
+        $query = $urlParts['query'] ?? '';
+
+        /* @phpstan-ignore-next-line */
+        $targetRelativeUrl = $urlParts['path'] . $query;
+
+        return Response::createSeeOther($targetRelativeUrl);
     }
 }
diff --git a/src/HttpController/Web/AuthenticationController.php b/src/HttpController/Web/AuthenticationController.php
index 460fc2f4..e0848759 100644
--- a/src/HttpController/Web/AuthenticationController.php
+++ b/src/HttpController/Web/AuthenticationController.php
@@ -5,7 +5,7 @@
 use Movary\Domain\SessionService;
 use Movary\Domain\User\Exception\InvalidCredentials;
 use Movary\Domain\User\Exception\InvalidTotpCode;
-use Movary\Domain\User\Exception\NoVerificationCode;
+use Movary\Domain\User\Exception\MissingTotpCode;
 use Movary\Domain\User\Service;
 use Movary\Util\SessionWrapper;
 use Movary\ValueObject\Http\Header;

From 15104129303175d5095169def916eb510adb4559 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 19:45:19 +0100
Subject: [PATCH 12/27] Adjust and streamline login process differences between
 web and rest api

---
 docs/openapi.json                             |   6 +-
 public/js/login.js                            |   4 +-
 settings/routes.php                           |   2 +-
 src/Domain/User/Service/Authentication.php    | 111 ++++++++++--------
 src/Domain/User/UserApi.php                   |   4 +-
 src/Domain/User/UserRepository.php            |   9 +-
 .../Api/AuthenticationController.php          |  17 ++-
 tests/rest/api/authentication.http            |   9 ++
 8 files changed, 94 insertions(+), 68 deletions(-)
 create mode 100644 tests/rest/api/authentication.http

diff --git a/docs/openapi.json b/docs/openapi.json
index 43d4b319..714af9b2 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1066,12 +1066,12 @@
         }
       }
     },
-    "/authentication/request-token": {
+    "/authentication/create-token": {
       "post": {
         "tags": [
           "Authentication"
         ],
-        "description": "Get an authentication token by submitting an email, password and optionally a time-based 6-digit code. This token can be stored and used for future requests to protected endpoints.",
+        "description": "Create an authentication token by submitting an email, password and optionally a time-based 6-digit code. Add the token as X-Auth-Token header to further requests.",
         "parameters": [{
           "in": "header",
           "name": "X-Movary-Client",
@@ -1082,7 +1082,7 @@
           "example": "Client Name"
         }],
         "requestBody": {
-          "description": "The credentials and optionally a two-factor Authentication code",
+          "description": "The credentials and optionally a two-factor authentication code",
           "required": true,
           "content": {
             "application/json": {
diff --git a/public/js/login.js b/public/js/login.js
index 1ce090e5..21d4482d 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -1,7 +1,7 @@
 const MOVARY_CLIENT_IDENTIFIER = 'Movary Web';
 
 async function submitCredentials() {
-    const request = await fetch('/api/authentication/request-token', {
+    const request = await fetch('/api/authentication/create-token', {
         method: 'POST',
         headers: {
             'Content-type': 'application/json',
@@ -33,4 +33,4 @@ async function submitCredentials() {
             console.error(error);
         });
     }
-}
\ No newline at end of file
+}
diff --git a/settings/routes.php b/settings/routes.php
index f2424f85..a39d9801 100644
--- a/settings/routes.php
+++ b/settings/routes.php
@@ -202,7 +202,7 @@ function addApiRoutes(RouterService $routerService, FastRoute\RouteCollector $ro
     $routes = RouteList::create();
 
     $routes->add('GET', '/openapi', [Api\OpenApiController::class, 'getSchema']);
-    $routes->add('POST', '/authentication/request-token', [Api\AuthenticationController::class, 'requestToken']);
+    $routes->add('POST', '/authentication/create-token', [Api\AuthenticationController::class, 'createToken']);
 
     $routeUserHistory = '/users/{username:[a-zA-Z0-9]+}/history/movies';
     $routes->add('GET', $routeUserHistory, [Api\HistoryController::class, 'getHistory'], [Api\Middleware\IsAuthorizedToReadUserData::class]);
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index 560470eb..d1901c6f 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -9,6 +9,7 @@
 use Movary\Domain\User\UserApi;
 use Movary\Domain\User\UserEntity;
 use Movary\Domain\User\UserRepository;
+use Movary\HttpController\Web\CreateUserController;
 use Movary\Util\SessionWrapper;
 use Movary\ValueObject\DateTime;
 use Movary\ValueObject\Http\Request;
@@ -28,31 +29,6 @@ public function __construct(
     ) {
     }
 
-    public function createAuthenticationCookie(int $userId, bool $rememberMe, string $deviceName, string $userAgent) : void
-    {
-        $authTokenExpirationDate = $this->createExpirationDate();
-        $cookieExpiration = 0;
-
-        if ($rememberMe === true) {
-            $authTokenExpirationDate = $this->createExpirationDate(self::MAX_EXPIRATION_AGE_IN_DAYS);
-            $cookieExpiration = (int)$authTokenExpirationDate->format('U');
-        }
-
-        $token = $this->generateToken($userId, $deviceName, $userAgent, DateTime::createFromString((string)$authTokenExpirationDate));
-
-        session_regenerate_id();
-        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
-            'expires' => $cookieExpiration,
-            'path' => '/',
-            'domain' => '',
-            'secure' => false,
-            'httponly' => true,
-            'samesite' => 'strict'
-        ]);
-
-        $this->sessionWrapper->set('userId', $userId);
-    }
-
     public function createExpirationDate(int $days = 1) : DateTime
     {
         $timestamp = strtotime('+' . $days . ' day');
@@ -69,6 +45,37 @@ public function deleteToken(string $token) : void
         $this->repository->deleteAuthToken($token);
     }
 
+    public function findUserAndVerifyAuthentication(
+        string $email,
+        string $password,
+        ?int $userTotpCode = null,
+    ) : UserEntity {
+        $user = $this->repository->findUserByEmail($email);
+
+        if ($user === null) {
+            throw EmailNotFound::create();
+        }
+
+        if ($this->userApi->isValidPassword($user->getId(), $password) === false) {
+            throw InvalidPassword::create();
+        }
+
+        $totpUri = $this->userApi->findTotpUri($user->getId());
+        if ($totpUri === null) {
+            return $user;
+        }
+
+        if (empty($userTotpCode) === true) {
+            throw MissingTotpCode::create();
+        }
+
+        if ($this->twoFactorAuthenticationApi->verifyTotpUri($user->getId(), $userTotpCode) === false) {
+            throw InvalidTotpCode::create();
+        }
+
+        return $user;
+    }
+
     public function getCurrentUser() : UserEntity
     {
         return $this->userApi->fetchUser($this->getCurrentUserId());
@@ -103,7 +110,7 @@ public function getUserIdByApiToken(Request $request) : ?int
             return null;
         }
 
-        return $this->userApi->findByApiToken($apiToken)?->getId();
+        return $this->userApi->findByToken($apiToken)?->getId();
     }
 
     public function isUserAuthenticated() : bool
@@ -174,34 +181,23 @@ public function login(
         string $deviceName,
         string $userAgent,
         ?int $userTotpInput = null,
-    ) : void {
-        if ($this->isUserAuthenticated() === true) {
-            return;
-        }
-
-        $user = $this->repository->findUserByEmail($email);
-
-        if ($user === null) {
-            throw EmailNotFound::create();
-        }
+    ) : string {
+        $user = $this->findUserAndVerifyAuthentication($email, $password, $userTotpInput);
 
-        if ($this->userApi->isValidPassword($user->getId(), $password) === false) {
-            throw InvalidPassword::create();
+        $authTokenExpirationDate = $this->createExpirationDate();
+        if ($rememberMe === true) {
+            $authTokenExpirationDate = $this->createExpirationDate(self::MAX_EXPIRATION_AGE_IN_DAYS);
         }
 
-        $totpUri = $this->userApi->findTotpUri($user->getId());
-
-        if ($totpUri !== null) {
-            if (empty($userTotpInput) === true) {
-                throw MissingTotpCode::create();
-            }
+        $token = $this->setAuthenticationToken($user->getId(), $deviceName, $userAgent, $authTokenExpirationDate);
 
-            if ($this->twoFactorAuthenticationApi->verifyTotpUri($user->getId(), $userTotpInput) === false) {
-                throw InvalidTotpCode::create();
-            }
+        if ($deviceName == !CreateUserController::MOVARY_WEB_CLIENT) {
+            return $token;
         }
 
-        $this->createAuthenticationCookie($user->getId(), $rememberMe, $deviceName, $userAgent);
+        $this->setAuthenticationCookieAndNewSession($user->getId(), $token, $authTokenExpirationDate);
+
+        return $token;
     }
 
     public function logout() : void
@@ -218,12 +214,23 @@ public function logout() : void
         $this->sessionWrapper->start();
     }
 
-    private function generateToken(int $userId, string $deviceName, string $userAgent, ?DateTime $expirationDate = null) : string
+    public function setAuthenticationCookieAndNewSession(int $userId, string $token, ?DateTime $expirationDate = null) : void
     {
-        if ($expirationDate === null) {
-            $expirationDate = $this->createExpirationDate();
-        }
+        session_regenerate_id();
+        setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
+            'expires' => (int)$expirationDate->format('U'),
+            'path' => '/',
+            'domain' => '',
+            'secure' => false,
+            'httponly' => true,
+            'samesite' => 'strict'
+        ]);
 
+        $this->sessionWrapper->set('userId', $userId);
+    }
+
+    private function setAuthenticationToken(int $userId, string $deviceName, string $userAgent, DateTime $expirationDate) : string
+    {
         $token = bin2hex(random_bytes(16));
 
         $this->repository->createAuthToken($userId, $token, $deviceName, $userAgent, $expirationDate);
diff --git a/src/Domain/User/UserApi.php b/src/Domain/User/UserApi.php
index d0212b19..a104666a 100644
--- a/src/Domain/User/UserApi.php
+++ b/src/Domain/User/UserApi.php
@@ -131,9 +131,9 @@ public function findApiTokenByUserId(int $userId) : ?string
         return $this->repository->findApiToken($userId);
     }
 
-    public function findByApiToken(string $apiToken) : ?UserEntity
+    public function findByToken(string $token) : ?UserEntity
     {
-        return $this->repository->findUserByApiToken($apiToken);
+        return $this->repository->findUserByToken($token);
     }
 
     public function findJellyfinAuthentication(int $userId) : ?JellyfinAuthenticationData
diff --git a/src/Domain/User/UserRepository.php b/src/Domain/User/UserRepository.php
index b105f379..1dc06016 100644
--- a/src/Domain/User/UserRepository.php
+++ b/src/Domain/User/UserRepository.php
@@ -317,14 +317,15 @@ public function findTraktUserName(int $userId) : ?string
         return $plexWebhookId;
     }
 
-    public function findUserByApiToken(string $apiToken) : ?UserEntity
+    public function findUserByToken(string $apiToken) : ?UserEntity
     {
         $data = $this->dbConnection->fetchAssociative(
             'SELECT user.*
             FROM user
-            JOIN user_api_token ON user.id = user_api_token.user_id
-            WHERE user_api_token.token = ?',
-            [$apiToken],
+            LEFT JOIN user_api_token ON user.id = user_api_token.user_id
+            LEFT JOIN user_auth_token ON user.id = user_auth_token.user_id
+            WHERE user_api_token.token = ? OR user_auth_token.token = ?',
+            [$apiToken, $apiToken],
         );
 
         if (empty($data) === true) {
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 1b28588d..55917a89 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -4,6 +4,7 @@
 
 use Movary\Domain\User\Exception\InvalidCredentials;
 use Movary\Domain\User\Service\Authentication;
+use Movary\Domain\User\UserApi;
 use Movary\HttpController\Web\CreateUserController;
 use Movary\Util\Json;
 use Movary\ValueObject\Http\Request;
@@ -13,15 +14,16 @@ class AuthenticationController
 {
     public function __construct(
         private readonly Authentication $authenticationService,
+        private readonly UserApi $userApi,
     ) {
     }
 
-    public function requestToken(Request $request) : Response
+    public function createToken(Request $request) : Response
     {
         $tokenRequestBody = Json::decode($request->getBody());
 
         if ($tokenRequestBody['email'] === null || $tokenRequestBody['password'] === null) {
-            return Response::createBadRequest('Username or password has not been provided');
+            return Response::createBadRequest('Email or password is missing');
         }
 
         $headers = $request->getHeaders();
@@ -34,7 +36,7 @@ public function requestToken(Request $request) : Response
         $rememberMe = $tokenRequestBody['rememberMe'] ?? false;
 
         try {
-            $this->authenticationService->login(
+            $authToken = $this->authenticationService->login(
                 $tokenRequestBody['email'],
                 $tokenRequestBody['password'],
                 (bool)$rememberMe,
@@ -47,7 +49,14 @@ public function requestToken(Request $request) : Response
         }
 
         if ($requestClient !== CreateUserController::MOVARY_WEB_CLIENT) {
-            return Response::createJson(Json::encode(['token' => $this->authenticationService->getToken()]));
+            $user = $this->userApi->findByToken($authToken);
+
+            return Response::createJson(
+                Json::encode([
+                    'userId' => $user->getId(),
+                    'authToken' => $authToken
+                ]),
+            );
         }
 
         $redirect = $tokenRequestBody['redirect'] ?? null;
diff --git a/tests/rest/api/authentication.http b/tests/rest/api/authentication.http
new file mode 100644
index 00000000..e7cc6cc4
--- /dev/null
+++ b/tests/rest/api/authentication.http
@@ -0,0 +1,9 @@
+POST http://127.0.0.1/api/authentication/create-token
+Accept: */*
+Cache-Control: no-cache
+Content-Type: application/json
+X-Movary-Client: RestAPI Test
+
+{"email" : "{{email}}", "password" : "{{password}}", "rememberMe" : 1, "totpCode" : 123456}
+
+###

From 5689e0f0cc79848af1185b466736ca98cc359f7d Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 20:07:52 +0100
Subject: [PATCH 13/27] Fix docs

---
 docs/openapi.json                             | 36 +++++++++++--------
 .../Api/AuthenticationController.php          |  2 +-
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 714af9b2..1f66a7c2 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1071,7 +1071,7 @@
         "tags": [
           "Authentication"
         ],
-        "description": "Create an authentication token by submitting an email, password and optionally a time-based 6-digit code. Add the token as X-Auth-Token header to further requests.",
+        "description": "Create an authentication token via email, password and optionally totp code. Add the token as X-Auth-Token header to further requests. Token lifetime 1d default, 30d with rememberMe.",
         "parameters": [{
           "in": "header",
           "name": "X-Movary-Client",
@@ -1106,6 +1106,12 @@
                     "example": "123456",
                     "description": "A 6-digit two-factor authentication code",
                     "nullable": true
+                  },
+                  "rememberMe": {
+                    "type": "bool",
+                    "example": true,
+                    "description": "Extend auth token lifetime",
+                    "nullable": true
                   }
                 }
               }
@@ -1129,22 +1135,24 @@
               }
             }
           },
+          "400": {
+            "description": "An request payload error. Either missing credentials or the credentials were invalid.",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string",
+                  "description": "Error message"
+                }
+              }
+            }
+          },
           "401": {
-            "description": "An authentication error. Either missing credentials or the credentials were invalid.",
+            "description": "Authentication error. Credentials or totp code are not valid.",
             "content": {
-              "application/json": {
+              "text/plain": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "error": {
-                      "type": "string",
-                      "description": "The name of the error"
-                    },
-                    "message": {
-                      "type": "string",
-                      "description": "The message of the error"
-                    }
-                  }
+                  "type": "string",
+                  "description": "Error message"
                 }
               }
             }
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 55917a89..ee2b2715 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -45,7 +45,7 @@ public function createToken(Request $request) : Response
                 (int)$totpCode,
             );
         } catch (InvalidCredentials) {
-            return Response::createBadRequest('Invalid login credentials');
+            return Response::createUnauthorized();
         }
 
         if ($requestClient !== CreateUserController::MOVARY_WEB_CLIENT) {

From a0fca2a5b69a74985c5ca1373959b3c2c49aea63 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 21:00:04 +0100
Subject: [PATCH 14/27] Fix tests

---
 src/Domain/User/Service/Authentication.php          | 4 ++--
 src/HttpController/Api/AuthenticationController.php | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index d1901c6f..42bae5e2 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -191,7 +191,7 @@ public function login(
 
         $token = $this->setAuthenticationToken($user->getId(), $deviceName, $userAgent, $authTokenExpirationDate);
 
-        if ($deviceName == !CreateUserController::MOVARY_WEB_CLIENT) {
+        if ($deviceName !== CreateUserController::MOVARY_WEB_CLIENT) {
             return $token;
         }
 
@@ -214,7 +214,7 @@ public function logout() : void
         $this->sessionWrapper->start();
     }
 
-    public function setAuthenticationCookieAndNewSession(int $userId, string $token, ?DateTime $expirationDate = null) : void
+    public function setAuthenticationCookieAndNewSession(int $userId, string $token, DateTime $expirationDate) : void
     {
         session_regenerate_id();
         setcookie(self::AUTHENTICATION_COOKIE_NAME, $token, [
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index ee2b2715..3d016f5c 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -18,6 +18,7 @@ public function __construct(
     ) {
     }
 
+    // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh
     public function createToken(Request $request) : Response
     {
         $tokenRequestBody = Json::decode($request->getBody());
@@ -53,7 +54,7 @@ public function createToken(Request $request) : Response
 
             return Response::createJson(
                 Json::encode([
-                    'userId' => $user->getId(),
+                    'userId' => $user?->getId(),
                     'authToken' => $authToken
                 ]),
             );

From 3216932ae07eb73480bc79760952f66b39ce6433 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sun, 28 Jan 2024 21:08:55 +0100
Subject: [PATCH 15/27] Submit credentials on enter key press

---
 public/js/login.js             | 6 ++++++
 templates/page/login.html.twig | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/public/js/login.js b/public/js/login.js
index 21d4482d..5490b444 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -34,3 +34,9 @@ async function submitCredentials() {
         });
     }
 }
+
+function submitCredentialsOnEnter(event) {
+    if (event.keyCode == 13) {
+        submitCredentials()
+    }
+}
diff --git a/templates/page/login.html.twig b/templates/page/login.html.twig
index ba58081a..0b3a43c8 100644
--- a/templates/page/login.html.twig
+++ b/templates/page/login.html.twig
@@ -21,12 +21,12 @@
                 <h1 id="header" class="text-{{ theme == 'dark' ? 'light' : 'dark' }}" style="margin-bottom: 1rem">{{ applicationName ?? 'Movary' }}</h1>
                 <div class="form-floating">
                     <input type="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="email"
-                        placeholder="name@example.com" required>
+                        placeholder="name@example.com" onkeypress="submitCredentialsOnEnter(event)" required>
                     <label for="email">Email address</label>
                 </div>
                 <div class="form-floating">
                     <input type="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="password"
-                        placeholder="Password" required>
+                        placeholder="Password" onkeypress="submitCredentialsOnEnter(event)" required>
                     <label for="password">Password</label>
                 </div>
 

From bf871c96f6f969a074b96a05db4d7ec5936eb8cc Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 3 Feb 2024 13:15:23 +0100
Subject: [PATCH 16/27] Fix issue with sqlite migration rollback and adjust
 user agent datatype

---
 ...1_AddDeviceNameAndUserAgentToAuthTokenTable.php |  2 +-
 ...3_AddDeviceNameAndUserAgentToAuthTokenTable.php | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
index 2d217035..4a28f7df 100644
--- a/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
+++ b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -19,7 +19,7 @@ public function up() : void
         $this->execute(
             <<<SQL
             ALTER TABLE `user_auth_token` ADD COLUMN device_name VARCHAR(256);
-            ALTER TABLE `user_auth_token` ADD COLUMN user_agent VARCHAR(256);
+            ALTER TABLE `user_auth_token` ADD COLUMN user_agent TEXT;
             SQL,
         );
     }
diff --git a/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
index 86066295..543aa127 100644
--- a/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
+++ b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -8,7 +8,7 @@ public function down() : void
     {
         $this->execute(
             <<<SQL
-            CREATE TABLE `user_auth_token` (
+            CREATE TABLE `user_auth_token_tmp` (
                 `id` INTEGER NOT NULL,
                 `user_id` INTEGER NOT NULL,
                 `token` TEXT NOT NULL,
@@ -19,21 +19,21 @@ public function down() : void
             )
             SQL,
         );
-        $this->execute('INSERT INTO `user_auth_token_old` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT `id`, `user_id`, `token`, `expiration_date`, `created_at` FROM `user_auth_token`');
+        $this->execute('INSERT INTO `user_auth_token_tmp` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT `id`, `user_id`, `token`, `expiration_date`, `created_at` FROM `user_auth_token`');
         $this->execute('DROP TABLE `user_auth_token`');
-        $this->execute('ALTER TABLE `user_auth_token_old` RENAME TO `user_auth_token`');
+        $this->execute('ALTER TABLE `user_auth_token_tmp` RENAME TO `user_auth_token`');
     }
 
     public function up() : void
     {
         $this->execute(
             <<<SQL
-            CREATE TABLE `user_auth_token_new` (
+            CREATE TABLE `user_auth_token_tmp` (
                 `id` INTEGER NOT NULL,
                 `user_id` INT(10) NOT NULL,
                 `token` CHAR(36) NOT NULL,
                 `device_name` VARCHAR(256) NOT NULL,
-                `user_agent` VARCHAR(256) NOT NULL,
+                `user_agent` TEXT NOT NULL,
                 `expiration_date` TEXT NOT NULL,
                 `created_at` TEXT NOT NULL,
                 PRIMARY KEY (`id`),
@@ -41,8 +41,8 @@ public function up() : void
             )
             SQL,
         );
-        $this->execute('INSERT INTO `user_auth_token_new` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT * FROM `user_auth_token`');
+        $this->execute('INSERT INTO `user_auth_token_tmp` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT * FROM `user_auth_token`');
         $this->execute('DROP TABLE `user_auth_token`');
-        $this->execute('ALTER TABLE `user_auth_token_new` RENAME TO `user_auth_token`');
+        $this->execute('ALTER TABLE `user_auth_token_tmp` RENAME TO `user_auth_token`');
     }
 }

From d7fa84b428398f8cca5d0ba8094389153fa94699 Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Mon, 12 Feb 2024 12:22:45 +0100
Subject: [PATCH 17/27] Fix redirecting

---
 public/js/login.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/js/login.js b/public/js/login.js
index 5490b444..3daca61e 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -1,7 +1,8 @@
 const MOVARY_CLIENT_IDENTIFIER = 'Movary Web';
 
 async function submitCredentials() {
-    const request = await fetch('/api/authentication/create-token', {
+        const urlParams = new URLSearchParams(window.location.search);
+        const request = await fetch('/api/authentication/create-token', {
         method: 'POST',
         headers: {
             'Content-type': 'application/json',
@@ -11,7 +12,8 @@ async function submitCredentials() {
             'email': document.getElementById('email').value,
             'password': document.getElementById('password').value,
             'rememberMe': document.getElementById('rememberMe').checked,
-            'totpCode': document.getElementById('totpCode').value
+            'totpCode': document.getElementById('totpCode').value,
+            'redirect': urlParams.get('redirect') ?? ''
         })
     }).then((response) => {
         return response;

From d753c2082f274760d4a00718ea5d1a3da0c038fc Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Mon, 12 Feb 2024 12:27:43 +0100
Subject: [PATCH 18/27] Fix redirect second time

---
 src/HttpController/Api/AuthenticationController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 3d016f5c..acf8c285 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -60,7 +60,7 @@ public function createToken(Request $request) : Response
             );
         }
 
-        $redirect = $tokenRequestBody['redirect'] ?? null;
+        $redirect = empty($tokenRequestBody['redirect']) === true ? null : $tokenRequestBody['redirect'];
         $target = $redirect ?? $_SERVER['HTTP_REFERER'];
 
         $urlParts = parse_url($target);

From 93972674e640098eae4f499175e96bd8d1721a8a Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Sun, 18 Feb 2024 13:38:30 +0100
Subject: [PATCH 19/27] Fix error response in authentication API

---
 src/HttpController/Api/AuthenticationController.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index acf8c285..028117b9 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -45,8 +45,11 @@ public function createToken(Request $request) : Response
                 $request->getUserAgent(),
                 (int)$totpCode,
             );
-        } catch (InvalidCredentials) {
-            return Response::createUnauthorized();
+        } catch (InvalidCredentials $e) {
+            return Response::createBadRequest(Json::encode([
+                'error' => basename(str_replace('\\', '/', get_class($e))),
+                'message' => $e->getMessage()
+            ]));
         }
 
         if ($requestClient !== CreateUserController::MOVARY_WEB_CLIENT) {

From 92f7a29056709d231b1c9f6e3f63d938177c252b Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Mon, 19 Feb 2024 19:20:58 +0100
Subject: [PATCH 20/27] Fix openapi

---
 docs/openapi.json | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 1f66a7c2..4e195b93 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1108,7 +1108,7 @@
                     "nullable": true
                   },
                   "rememberMe": {
-                    "type": "bool",
+                    "type": "boolean",
                     "example": true,
                     "description": "Extend auth token lifetime",
                     "nullable": true
@@ -1133,6 +1133,14 @@
                   }
                 }
               }
+            },
+            "headers": {
+                "Set-Cookie": {
+                    "schema": {
+                        "type": "string",
+                        "example": ""
+                    }
+                }
             }
           },
           "400": {
@@ -1337,6 +1345,11 @@
         "type": "apiKey",
         "name": "X-Auth-Token",
         "in": "header"
+      },
+      "cookieauth": {
+        "type": "apiKey",
+        "name": "id",
+        "in": "cookie"
       }
     }
   }

From ad48ead9524159ff7696ec35897e80e0e2cea0ae Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Mon, 19 Feb 2024 19:27:47 +0100
Subject: [PATCH 21/27] Ensure that the token in a cookie is checked for token
 verification middleware

---
 src/Domain/User/Service/Authentication.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index 42bae5e2..a25409f2 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -105,7 +105,7 @@ public function getToken() : ?string
 
     public function getUserIdByApiToken(Request $request) : ?int
     {
-        $apiToken = $request->getHeaders()['X-Auth-Token'] ?? null;
+        $apiToken = $request->getHeaders()['X-Auth-Token'] ?? filter_input(INPUT_COOKIE, self::AUTHENTICATION_COOKIE_NAME) ?? null;
         if ($apiToken === null) {
             return null;
         }

From 4578a960b5019d98b000f69b4d2d88addf08a43c Mon Sep 17 00:00:00 2001
From: JVT038 <47184046+JVT038@users.noreply.github.com>
Date: Mon, 19 Feb 2024 20:38:26 +0100
Subject: [PATCH 22/27] Fix TOTP login

---
 public/js/login.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/js/login.js b/public/js/login.js
index 3daca61e..3f166c29 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -23,7 +23,7 @@ async function submitCredentials() {
         window.location.replace(request.url);
     } else {
         await request.json().then(error => {
-            if(error['error'] === 'NoVerificationCode') {
+            if(error['error'] === 'MissingTotpCode') {
                document.getElementById('LoginForm').classList.add('d-none');
                document.getElementById('TotpForm').classList.remove('d-none');
             } else if(error['error'] === 'InvalidTotpCode') {

From dcf71cc85eee6d10f96447f8a31de3cc6b4d280b Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 24 Feb 2024 13:24:40 +0100
Subject: [PATCH 23/27] Purge existing auth tokens during migration

---
 ...40126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php | 5 +++--
 ...40126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php | 1 -
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
index 4a28f7df..ed5e4352 100644
--- a/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
+++ b/db/migrations/mysql/20240126110011_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -18,8 +18,9 @@ public function up() : void
     {
         $this->execute(
             <<<SQL
-            ALTER TABLE `user_auth_token` ADD COLUMN device_name VARCHAR(256);
-            ALTER TABLE `user_auth_token` ADD COLUMN user_agent TEXT;
+            DELETE FROM `user_auth_token`;
+            ALTER TABLE `user_auth_token` ADD COLUMN device_name VARCHAR(256) NOT NULL;
+            ALTER TABLE `user_auth_token` ADD COLUMN user_agent TEXT NOT NULL;
             SQL,
         );
     }
diff --git a/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
index 543aa127..bd29cd25 100644
--- a/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
+++ b/db/migrations/sqlite/20240126110433_AddDeviceNameAndUserAgentToAuthTokenTable.php
@@ -41,7 +41,6 @@ public function up() : void
             )
             SQL,
         );
-        $this->execute('INSERT INTO `user_auth_token_tmp` (`id`, `user_id`, `token`, `expiration_date`, `created_at`) SELECT * FROM `user_auth_token`');
         $this->execute('DROP TABLE `user_auth_token`');
         $this->execute('ALTER TABLE `user_auth_token_tmp` RENAME TO `user_auth_token`');
     }

From db5e1d0ffe6007dfab338da5597270e896e3e810 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 24 Feb 2024 15:20:27 +0100
Subject: [PATCH 24/27] Always return 200 when authentication was successfull,
 adjust authenication error responsens and api docs

---
 docs/openapi.json                             | 107 +++++++++++-------
 public/js/login.js                            |  66 +++++++----
 src/Domain/User/Service/Authentication.php    |  13 ++-
 .../Service/TwoFactorAuthenticationApi.php    |  21 ----
 .../TwoFactorAuthenticationFactory.php        |   2 +-
 .../Api/AuthenticationController.php          |  82 ++++++++------
 src/ValueObject/Http/Response.php             |  12 +-
 templates/page/login.html.twig                |  13 ++-
 8 files changed, 181 insertions(+), 135 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 4e195b93..2002a9cd 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1071,16 +1071,18 @@
         "tags": [
           "Authentication"
         ],
-        "description": "Create an authentication token via email, password and optionally totp code. Add the token as X-Auth-Token header to further requests. Token lifetime 1d default, 30d with rememberMe.",
-        "parameters": [{
-          "in": "header",
-          "name": "X-Movary-Client",
-          "schema": {
-            "type": "string"
-          },
-          "required": true,
-          "example": "Client Name"
-        }],
+        "description": "Create an authentication token via email, password and optionally TOTP code. Add the token as X-Auth-Token header to further requests. Token lifetime 1d default, 30d with rememberMe.",
+        "parameters": [
+          {
+            "in": "header",
+            "name": "X-Movary-Client",
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "example": "Client Name"
+          }
+        ],
         "requestBody": {
           "description": "The credentials and optionally a two-factor authentication code",
           "required": true,
@@ -1088,7 +1090,10 @@
             "application/json": {
               "schema": {
                 "type": "object",
-                "required": ["email", "password"],
+                "required": [
+                  "email",
+                  "password"
+                ],
                 "properties": {
                   "email": {
                     "type": "string",
@@ -1104,7 +1109,7 @@
                     "type": "integer",
                     "pattern": "/^[0-9]{6}$/gm",
                     "example": "123456",
-                    "description": "A 6-digit two-factor authentication code",
+                    "description": "A 6-digit two-factor TOTP code",
                     "nullable": true
                   },
                   "rememberMe": {
@@ -1120,12 +1125,16 @@
         },
         "responses": {
           "200": {
-            "description": "OK",
+            "description": "Returned if authentication was successfully",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "properties": {
+                    "userId": {
+                      "type": "integer",
+                      "description": "The id of the authenticated user."
+                    },
                     "token": {
                       "type": "string",
                       "description": "The authentication token to be used in future requests."
@@ -1133,37 +1142,13 @@
                   }
                 }
               }
-            },
-            "headers": {
-                "Set-Cookie": {
-                    "schema": {
-                        "type": "string",
-                        "example": ""
-                    }
-                }
             }
           },
           "400": {
-            "description": "An request payload error. Either missing credentials or the credentials were invalid.",
-            "content": {
-              "text/plain": {
-                "schema": {
-                  "type": "string",
-                  "description": "Error message"
-                }
-              }
-            }
+            "$ref": "#/components/responses/400"
           },
           "401": {
-            "description": "Authentication error. Credentials or totp code are not valid.",
-            "content": {
-              "text/plain": {
-                "schema": {
-                  "type": "string",
-                  "description": "Error message"
-                }
-              }
-            }
+            "$ref": "#/components/responses/401"
           }
         }
       }
@@ -1333,6 +1318,50 @@
       "204": {
         "description": "Successful operation, response has no content"
       },
+      "400": {
+        "description": "The request payload or header are not correct",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "properties": {
+                "error": {
+                  "type": "string",
+                  "description": "The error type",
+                  "example": "ErrorType"
+                },
+                "message": {
+                  "type": "string",
+                  "description": "The error message",
+                  "example": "This is the error message"
+                }
+              }
+            }
+          }
+        }
+      },
+      "401": {
+        "description": "The provided credentials or TOTP code are not valid",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "properties": {
+                "error": {
+                  "type": "string",
+                  "description": "The error type",
+                  "example": "ErrorType"
+                },
+                "message": {
+                  "type": "string",
+                  "description": "The error message",
+                  "example": "This is the error message"
+                }
+              }
+            }
+          }
+        }
+      },
       "403": {
         "description": "Not authorized to access resource"
       },
diff --git a/public/js/login.js b/public/js/login.js
index 3f166c29..03f24a8b 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -1,8 +1,48 @@
 const MOVARY_CLIENT_IDENTIFIER = 'Movary Web';
 
 async function submitCredentials() {
-        const urlParams = new URLSearchParams(window.location.search);
-        const request = await fetch('/api/authentication/create-token', {
+    const urlParams = new URLSearchParams(window.location.search);
+    const redirect = urlParams.get('redirect') ?? '/';
+
+    const response = await loginRequest();
+
+    if (response.status === 200) {
+        window.location.href = redirect
+        return;
+    }
+
+    if (response.status === 400) {
+        const error = await response.json();
+
+        if (error['error'] === 'MissingTotpCode') {
+            document.getElementById('loginForm').classList.add('d-none');
+            document.getElementById('totpForm').classList.remove('d-none');
+            return
+        }
+
+        addAlert('loginErrors', error['message'], 'danger', false);
+        return;
+    }
+
+    if (response.status === 401) {
+        const error = await response.json();
+
+        if (error['error'] === 'InvalidTotpCode') {
+            addAlert('totpErrors', error['message'], 'danger', false);
+            return
+        }
+
+        if (error['error'] === 'InvalidCredentials') {
+            addAlert('loginErrors', error['message'], 'danger', false);
+            return
+        }
+    }
+
+    addAlert('loginErrors', 'Unexpected server error', 'danger', false);
+}
+
+function loginRequest() {
+    return fetch('/api/authentication/create-token', {
         method: 'POST',
         headers: {
             'Content-type': 'application/json',
@@ -13,32 +53,12 @@ async function submitCredentials() {
             'password': document.getElementById('password').value,
             'rememberMe': document.getElementById('rememberMe').checked,
             'totpCode': document.getElementById('totpCode').value,
-            'redirect': urlParams.get('redirect') ?? ''
         })
-    }).then((response) => {
-        return response;
     });
-    
-    if(request.redirected === true) {
-        window.location.replace(request.url);
-    } else {
-        await request.json().then(error => {
-            if(error['error'] === 'MissingTotpCode') {
-               document.getElementById('LoginForm').classList.add('d-none');
-               document.getElementById('TotpForm').classList.remove('d-none');
-            } else if(error['error'] === 'InvalidTotpCode') {
-                addAlert('totpErrors', error['message'], 'danger', false);
-            } else {
-                addAlert('loginErrors', error['message'], 'danger', false);
-            }
-        }).catch(error => {
-            console.error(error);
-        });
-    }
 }
 
 function submitCredentialsOnEnter(event) {
-    if (event.keyCode == 13) {
+    if (event.keyCode === 13) {
         submitCredentials()
     }
 }
diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php
index a25409f2..c19639a0 100644
--- a/src/Domain/User/Service/Authentication.php
+++ b/src/Domain/User/Service/Authentication.php
@@ -65,7 +65,7 @@ public function findUserAndVerifyAuthentication(
             return $user;
         }
 
-        if (empty($userTotpCode) === true) {
+        if ($userTotpCode === null) {
             throw MissingTotpCode::create();
         }
 
@@ -174,6 +174,9 @@ public function isValidToken(string $token) : bool
         return true;
     }
 
+    /**
+     * @return array{user: UserEntity, token: string}
+     */
     public function login(
         string $email,
         string $password,
@@ -181,7 +184,7 @@ public function login(
         string $deviceName,
         string $userAgent,
         ?int $userTotpInput = null,
-    ) : string {
+    ) : array {
         $user = $this->findUserAndVerifyAuthentication($email, $password, $userTotpInput);
 
         $authTokenExpirationDate = $this->createExpirationDate();
@@ -191,13 +194,15 @@ public function login(
 
         $token = $this->setAuthenticationToken($user->getId(), $deviceName, $userAgent, $authTokenExpirationDate);
 
+        $userAndToken = ['user' => $user, 'token' => $token];
+
         if ($deviceName !== CreateUserController::MOVARY_WEB_CLIENT) {
-            return $token;
+            return $userAndToken;
         }
 
         $this->setAuthenticationCookieAndNewSession($user->getId(), $token, $authTokenExpirationDate);
 
-        return $token;
+        return $userAndToken;
     }
 
     public function logout() : void
diff --git a/src/Domain/User/Service/TwoFactorAuthenticationApi.php b/src/Domain/User/Service/TwoFactorAuthenticationApi.php
index 021380a2..675f70d3 100644
--- a/src/Domain/User/Service/TwoFactorAuthenticationApi.php
+++ b/src/Domain/User/Service/TwoFactorAuthenticationApi.php
@@ -17,32 +17,11 @@ public function deleteTotp(int $userId) : void
         $this->userApi->deleteTotpUri($userId);
     }
 
-    public function fetchTotpUriSecretByTotpUri(string $totpUri) : string
-    {
-        return $this->twoFactorAuthenticationFactory->createOtpFromProvisioningUri($totpUri)->getSecret();
-    }
-
-    public function fetchTotpUriSecretByUserId(int $userId) : string
-    {
-        $totpUri = $this->findTotpUri($userId);
-
-        if (empty($totpUri) === true) {
-            throw new \RuntimeException('Could not find totp uri for user with id: ' . $userId);
-        }
-
-        return $this->twoFactorAuthenticationFactory->createOtpFromProvisioningUri($totpUri)->getSecret();
-    }
-
     public function findTotpUri(int $userId) : ?string
     {
         return $this->userApi->findTotpUri($userId);
     }
 
-    public function isValidTOTPCookie(string $totpUri, string $TOTPCookieValue) : bool
-    {
-        return $this->fetchTotpUriSecretByTotpUri($totpUri) === $TOTPCookieValue;
-    }
-
     public function updateTotpUri(int $userId, string $uri) : void
     {
         $this->userApi->updateTotpUri($userId, $uri);
diff --git a/src/Domain/User/Service/TwoFactorAuthenticationFactory.php b/src/Domain/User/Service/TwoFactorAuthenticationFactory.php
index 84846a17..20a1262c 100644
--- a/src/Domain/User/Service/TwoFactorAuthenticationFactory.php
+++ b/src/Domain/User/Service/TwoFactorAuthenticationFactory.php
@@ -56,7 +56,7 @@ private function generateSecret() : string
     public function createOtpFromProvisioningUri(string $totpUri) : OTPInterface
     {
         if ($totpUri === '') {
-            throw new \RuntimeException('Totp uri not valid because it is empty');
+            throw new \RuntimeException('TOTP uri not valid because it is empty');
         }
 
         return Factory::loadFromProvisioningUri($totpUri);
diff --git a/src/HttpController/Api/AuthenticationController.php b/src/HttpController/Api/AuthenticationController.php
index 028117b9..7a4b8a7c 100644
--- a/src/HttpController/Api/AuthenticationController.php
+++ b/src/HttpController/Api/AuthenticationController.php
@@ -3,10 +3,11 @@
 namespace Movary\HttpController\Api;
 
 use Movary\Domain\User\Exception\InvalidCredentials;
+use Movary\Domain\User\Exception\InvalidTotpCode;
+use Movary\Domain\User\Exception\MissingTotpCode;
 use Movary\Domain\User\Service\Authentication;
-use Movary\Domain\User\UserApi;
-use Movary\HttpController\Web\CreateUserController;
 use Movary\Util\Json;
+use Movary\ValueObject\Http\Header;
 use Movary\ValueObject\Http\Request;
 use Movary\ValueObject\Http\Response;
 
@@ -14,67 +15,78 @@ class AuthenticationController
 {
     public function __construct(
         private readonly Authentication $authenticationService,
-        private readonly UserApi $userApi,
     ) {
     }
 
-    // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh
     public function createToken(Request $request) : Response
     {
         $tokenRequestBody = Json::decode($request->getBody());
 
         if ($tokenRequestBody['email'] === null || $tokenRequestBody['password'] === null) {
-            return Response::createBadRequest('Email or password is missing');
+            return Response::createBadRequest(
+                Json::encode([
+                    'error' => 'MissingCredentials',
+                    'message' => 'Email or password is missing'
+                ]),
+                [Header::createContentTypeJson()],
+            );
         }
 
         $headers = $request->getHeaders();
         if (isset($headers['X-Movary-Client']) === false) {
-            return Response::createBadRequest('Missing request header X-Movary-Client');
+            return Response::createBadRequest(
+                Json::encode([
+                    'error' => 'MissingRequestHeader',
+                    'message' => 'Missing request header X-Movary-Client'
+                ]),
+                [Header::createContentTypeJson()],
+            );
         }
 
         $requestClient = $headers['X-Movary-Client'];
-        $totpCode = $tokenRequestBody['totpCode'] ?? 0;
+        $totpCode = empty($tokenRequestBody['totpCode']) === true ? null : (int)$tokenRequestBody['totpCode'];
         $rememberMe = $tokenRequestBody['rememberMe'] ?? false;
 
         try {
-            $authToken = $this->authenticationService->login(
+            $userAndAuthToken = $this->authenticationService->login(
                 $tokenRequestBody['email'],
                 $tokenRequestBody['password'],
                 (bool)$rememberMe,
                 $requestClient,
                 $request->getUserAgent(),
-                (int)$totpCode,
+                $totpCode,
             );
-        } catch (InvalidCredentials $e) {
-            return Response::createBadRequest(Json::encode([
-                'error' => basename(str_replace('\\', '/', get_class($e))),
-                'message' => $e->getMessage()
-            ]));
-        }
-
-        if ($requestClient !== CreateUserController::MOVARY_WEB_CLIENT) {
-            $user = $this->userApi->findByToken($authToken);
-
-            return Response::createJson(
+        } catch (MissingTotpCode) {
+            return Response::createBadRequest(
                 Json::encode([
-                    'userId' => $user?->getId(),
-                    'authToken' => $authToken
+                    'error' => 'MissingTotpCode',
+                    'message' => 'Two-factor authentication code missing'
                 ]),
+                [Header::createContentTypeJson()],
+            );
+        } catch (InvalidTotpCode) {
+            return Response::createUnauthorized(
+                Json::encode([
+                    'error' => 'InvalidTotpCode',
+                    'message' => 'Two-factor authentication code wrong'
+                ]),
+                [Header::createContentTypeJson()],
+            );
+        } catch (InvalidCredentials) {
+            return Response::createUnauthorized(
+                Json::encode([
+                    'error' => 'InvalidCredentials',
+                    'message' => 'Invalid credentials'
+                ]),
+                [Header::createContentTypeJson()],
             );
         }
 
-        $redirect = empty($tokenRequestBody['redirect']) === true ? null : $tokenRequestBody['redirect'];
-        $target = $redirect ?? $_SERVER['HTTP_REFERER'];
-
-        $urlParts = parse_url($target);
-        if (is_array($urlParts) === false) {
-            $urlParts = ['path' => '/'];
-        }
-        $query = $urlParts['query'] ?? '';
-
-        /* @phpstan-ignore-next-line */
-        $targetRelativeUrl = $urlParts['path'] . $query;
-
-        return Response::createSeeOther($targetRelativeUrl);
+        return Response::createJson(
+            Json::encode([
+                'userId' => $userAndAuthToken['user']->getId(),
+                'authToken' => $userAndAuthToken['token']
+            ]),
+        );
     }
 }
diff --git a/src/ValueObject/Http/Response.php b/src/ValueObject/Http/Response.php
index 89dbb0ef..86e83803 100644
--- a/src/ValueObject/Http/Response.php
+++ b/src/ValueObject/Http/Response.php
@@ -19,9 +19,9 @@ public static function create(StatusCode $statusCode, ?string $body = null, arra
         return new self($statusCode, $body, $headers);
     }
 
-    public static function createBadRequest(?string $body = null) : self
+    public static function createBadRequest(?string $body = null, array $headers = []) : self
     {
-        return new self(StatusCode::createBadRequest(), $body);
+        return new self(StatusCode::createBadRequest(), $body, $headers);
     }
 
     public static function createCsv(string $body) : self
@@ -40,9 +40,9 @@ public static function createForbiddenRedirect(string $redirectTarget) : self
         return new self(StatusCode::createForbidden(), null, [Header::createLocation('/login?redirect='.$query)]);
     }
 
-    public static function createJson(string $body) : self
+    public static function createJson(string $body, StatusCode $statusCode = null) : self
     {
-        return new self(StatusCode::createOk(), $body, [Header::createContentTypeJson()]);
+        return new self($statusCode ?? StatusCode::createOk(), $body, [Header::createContentTypeJson()]);
     }
 
     public static function createMethodNotAllowed() : self
@@ -70,9 +70,9 @@ public static function createSeeOther(string $targetUrl) : self
         return new self(StatusCode::createSeeOther(), null, [Header::createLocation($targetUrl)]);
     }
 
-    public static function createUnauthorized() : self
+    public static function createUnauthorized(string $message = null, array $headers = []) : self
     {
-        return new self(StatusCode::createUnauthorized());
+        return new self(StatusCode::createUnauthorized(), $message, $headers);
     }
 
     public static function createUnsupportedMediaType() : self
diff --git a/templates/page/login.html.twig b/templates/page/login.html.twig
index 0b3a43c8..0d05b7c2 100644
--- a/templates/page/login.html.twig
+++ b/templates/page/login.html.twig
@@ -17,16 +17,16 @@
         if ("{{ theme }}" === 'dark') document.getElementsByTagName('body')[0].classList.add('bg-dark')
     </script>
         <main role="main" class="form-signin w-100 m-auto text-center">
-            <form id="LoginForm">
+            <div id="loginForm">
                 <h1 id="header" class="text-{{ theme == 'dark' ? 'light' : 'dark' }}" style="margin-bottom: 1rem">{{ applicationName ?? 'Movary' }}</h1>
                 <div class="form-floating">
                     <input type="email" value="{{ defaultEmail }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="email"
-                        placeholder="name@example.com" onkeypress="submitCredentialsOnEnter(event)" required>
+                        placeholder="name@example.com" onkeydown="submitCredentialsOnEnter(event)" required>
                     <label for="email">Email address</label>
                 </div>
                 <div class="form-floating">
                     <input type="password" value="{{ defaultPassword }}" class="form-control text-{{ theme == 'dark' ? 'light' : 'dark' }}" id="password"
-                        placeholder="Password" onkeypress="submitCredentialsOnEnter(event)" required>
+                        placeholder="Password" onkeydown="submitCredentialsOnEnter(event)" required>
                     <label for="password">Password</label>
                 </div>
 
@@ -53,8 +53,8 @@
                 {% if registrationEnabled == true %}
                     <a href="/create-user">Create new user</a>
                 {% endif %}
-            </form>
-            <form id="TotpForm" class="d-none">
+            </div>
+            <div id="totpForm" class="d-none">
                 <p style="margin-bottom: 0">Enter the 6 digit verification code from your authenticator app.</p>
                 <input type="text"
                     class="form-control form-control-lg text-{{ theme == 'dark' ? 'light' : 'dark' }}"
@@ -63,10 +63,11 @@
                     autocomplete="off"
                     style="margin-bottom: .7rem;margin-top: .7rem"
                     id="totpCode"
+                    onkeydown="submitCredentialsOnEnter(event)"
                     required>
                 <div id="totpErrors"></div>
                 <button class="w-100 btn btn-lg btn-primary mb-3" type="button" style="margin-bottom: .7rem!important;" onclick="submitCredentials()">Continue</button>
                 <a href="/">Back</a>
-            </form>
+            </div>
         </main>
 {% endblock %}

From 33cc5b1f1f2ce085c2b25990f2923da30f5ffb1c Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 24 Feb 2024 15:22:19 +0100
Subject: [PATCH 25/27] Rename 'create-token' endpoint to only 'token'

---
 docs/openapi.json                  | 2 +-
 public/js/login.js                 | 2 +-
 settings/routes.php                | 2 +-
 tests/rest/api/authentication.http | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 2002a9cd..3ddd4746 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1066,7 +1066,7 @@
         }
       }
     },
-    "/authentication/create-token": {
+    "/authentication/token": {
       "post": {
         "tags": [
           "Authentication"
diff --git a/public/js/login.js b/public/js/login.js
index 03f24a8b..8a2e8a94 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -42,7 +42,7 @@ async function submitCredentials() {
 }
 
 function loginRequest() {
-    return fetch('/api/authentication/create-token', {
+    return fetch('/api/authentication/token', {
         method: 'POST',
         headers: {
             'Content-type': 'application/json',
diff --git a/settings/routes.php b/settings/routes.php
index a39d9801..6fcac1c1 100644
--- a/settings/routes.php
+++ b/settings/routes.php
@@ -202,7 +202,7 @@ function addApiRoutes(RouterService $routerService, FastRoute\RouteCollector $ro
     $routes = RouteList::create();
 
     $routes->add('GET', '/openapi', [Api\OpenApiController::class, 'getSchema']);
-    $routes->add('POST', '/authentication/create-token', [Api\AuthenticationController::class, 'createToken']);
+    $routes->add('POST', '/authentication/token', [Api\AuthenticationController::class, 'createToken']);
 
     $routeUserHistory = '/users/{username:[a-zA-Z0-9]+}/history/movies';
     $routes->add('GET', $routeUserHistory, [Api\HistoryController::class, 'getHistory'], [Api\Middleware\IsAuthorizedToReadUserData::class]);
diff --git a/tests/rest/api/authentication.http b/tests/rest/api/authentication.http
index e7cc6cc4..4431792f 100644
--- a/tests/rest/api/authentication.http
+++ b/tests/rest/api/authentication.http
@@ -1,4 +1,4 @@
-POST http://127.0.0.1/api/authentication/create-token
+POST http://127.0.0.1/api/authentication/token
 Accept: */*
 Cache-Control: no-cache
 Content-Type: application/json

From 5752eb55e3278b4cd6706df00e012dc0f6584f0f Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 24 Feb 2024 15:26:09 +0100
Subject: [PATCH 26/27] Adjust securitySchemes names

---
 docs/openapi.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 3ddd4746..587233b1 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1370,12 +1370,12 @@
       }
     },
     "securitySchemes": {
-      "authToken": {
+      "token": {
         "type": "apiKey",
         "name": "X-Auth-Token",
         "in": "header"
       },
-      "cookieauth": {
+      "cookie": {
         "type": "apiKey",
         "name": "id",
         "in": "cookie"

From 325a6442dabe33ea8b385a97ad8d633fb800f6c5 Mon Sep 17 00:00:00 2001
From: Lee Peuker <lee.peuker@protonmail.com>
Date: Sat, 24 Feb 2024 15:28:16 +0100
Subject: [PATCH 27/27] Fix openapi naming

---
 docs/openapi.json | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/docs/openapi.json b/docs/openapi.json
index 587233b1..964a35b6 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -111,7 +111,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -174,7 +174,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -237,7 +237,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -291,7 +291,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       }
@@ -427,7 +427,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -477,7 +477,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -527,7 +527,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       }
@@ -677,7 +677,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -745,7 +745,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -813,7 +813,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       },
@@ -871,7 +871,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       }
@@ -980,7 +980,7 @@
         },
         "security": [
           {
-            "authToken": []
+            "token": []
           }
         ]
       }