Function submitLogin

public/js/auth.js:654–807

(data)

}

async function submitLogin(data) {
  if (__loginInFlight) return;
  __loginInFlight = true;

  const payload = {
    username: String(data.username || '').trim(),
    password: String(data.password || '').trim(),
    remember_me: data.remember_me ? 1 : 0
  };

  setLastLoginData(payload);
  window.__lastLoginData = payload;

  try {
    await primeCsrfStrict();

    // Attempt #1 — JSON
    let res = await fetchWithCsrf('/api/auth/auth.php', {
      method: 'POST',
      credentials: 'include',
      headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
      body: JSON.stringify(payload)
    });
    let body = await safeJson(res);

    // TOTP requested?
    if (await sniffTOTP(res, body)) {
      if (typeof window.__frResetLoginFailure === 'function') {
        window.__frResetLoginFailure();
      }
      try { await primeCsrfStrict(); } catch (e) { }
      window.pendingTOTP = true;
      try {
        const auth = await import(withBase('/js/auth.js?v={{APP_QVER}}'));
        if (typeof auth.openTOTPLoginModal === 'function') auth.openTOTPLoginModal();
      } catch (e) { }
      return;
    }

    // Full success (no TOTP)
    if (body && (body.success || body.status === 'ok' || body.authenticated)) {
      if (typeof window.__frResetLoginFailure === 'function') {
        window.__frResetLoginFailure();
      }

      await syncPermissionsToLocalStorage();
      return afterLogin();
    }

    // Cookie set but non-JSON body — double check session
    if (!body && await isAuthedNow()) {
      if (typeof window.__frResetLoginFailure === 'function') {
        window.__frResetLoginFailure();
      }

      await syncPermissionsToLocalStorage();

      return afterLogin();