migrate connection-related logic to backend

justfile

@@ -1,4 +1,4 @@
-set shell := ["powershell.exe", "-c"]
+set windows-shell := ["powershell.exe", "-c"]
 
 dev:
     npx concurrently \

new-ui/src/pages/full/AddInstancePage/AddInstancePage.tsx

@@ -1,6 +1,7 @@
 import './style.scss';
 
 import { useLoaderData, useNavigate, useSearch } from '@tanstack/react-router';
+import { error } from '@tauri-apps/plugin-log';
 import { Fragment, useMemo } from 'react';
 import z from 'zod';
 import { Button } from '../../../shared/components/Button/Button';
@@ -68,16 +69,21 @@ export const AddInstancePage = () => {
           });
           return;
         }
+        void error(`Failed to add instance: ${result.error ?? 'unknown error'}`);
         Snackbar.error('Communication error, contact administrator.');
         return;
       }
-      if (result.cookie) {
-        await edgeApi.createDevice(value.url, result.cookie, value.name.trim());
+      if (result.session_id) {
+        await edgeApi.createDevice(result.session_id, value.name.trim());
       }
-      if (result.startResponse && !result.startResponse.user.enrolled && result.cookie) {
+      if (
+        result.startResponse &&
+        !result.startResponse.user.enrolled &&
+        result.session_id
+      ) {
         useEnrollmentStore
           .getState()
-          .start(result.startResponse, value.url, result.cookie, undefined);
+          .start(result.startResponse, result.session_id, undefined);
         navigate({
           to: '/full/enrollment',
           replace: true,

new-ui/src/pages/full/EnrollmentPage/hooks/activateUser.ts

@@ -1,20 +1,19 @@
-import { edgeApi } from '../../../../shared/edge-api/api';
+import { api } from '../../../../shared/rust-api/api';
 import { useEnrollmentStore } from './useEnrollmentStore';
 
 /**
- * Activate the enrolling user by calling the proxy activation API.
+ * Activate the enrolling user by calling the enrollment Tauri command.
  *
- * Reads proxy URL, cookie, skipPassword, and userPassword from the store via
+ * Reads sessionId, skipPassword, and userPassword from the store via
  * {@linkcode useEnrollmentStore.getState} so every invocation uses the latest
  * values (no stale-closure risk after in-flight {@linkcode setState} updates).
  *
  * When `skipPassword` is true the `password` key is omitted from the request
  * body instead of sending `null` or an empty string.
  */
 export const activateUser = async () => {
-  const { proxyUrl, sessionCookie, skipPassword, userPassword } =
-    useEnrollmentStore.getState();
-  const body = skipPassword ? {} : { password: userPassword ?? '' };
-  // biome-ignore lint/style/noNonNullAssertion: proxy and cookie are set in start()
-  return edgeApi.activateUser(proxyUrl!, sessionCookie!, body);
+  const { sessionId, skipPassword, userPassword } = useEnrollmentStore.getState();
+  const password = skipPassword ? null : (userPassword ?? '');
+  // biome-ignore lint/style/noNonNullAssertion: sessionId is set in start(), called before this
+  return api.enrollmentActivateUser(sessionId!, password, null);
 };

new-ui/src/pages/full/EnrollmentPage/hooks/useEnrollmentStore.tsx

@@ -1,14 +1,16 @@
 import dayjs from 'dayjs';
 import { create } from 'zustand';
 import { createJSONStorage, persist } from 'zustand/middleware';
-import type { EnrollmentStartResponse } from '../../../../shared/edge-api/types';
-import type { MfaMethodValue } from '../../../../shared/rust-api/types';
+import type {
+  EnrollmentStartResult,
+  MfaMethodValue,
+} from '../../../../shared/rust-api/types';
 import { EnrollmentStep, type EnrollmentStepValue } from '../types';
 
 type StoreValues = {
   activeStep: EnrollmentStepValue;
-  startResponse: EnrollmentStartResponse | null;
-  proxyUrl: string | null;
+  startResponse: EnrollmentStartResult | null;
+  sessionId: string | null;
   skipMfa: boolean;
   skipPassword: boolean;
   skipMfaChoice: boolean;
@@ -17,13 +19,11 @@ type StoreValues = {
   userTotpSecret: string | null;
   userRecoveryCodes: string[] | null;
   userMfaChoice: MfaMethodValue;
-  sessionCookie: string | null;
 };
 
 const defaults: StoreValues = {
   activeStep: EnrollmentStep.Welcome,
-  sessionCookie: null,
-  proxyUrl: null,
+  sessionId: null,
   userRecoveryCodes: null,
   startResponse: null,
   skipMfa: false,
@@ -37,9 +37,8 @@ const defaults: StoreValues = {
 
 interface Store extends StoreValues {
   start: (
-    response: EnrollmentStartResponse,
-    url: string,
-    cookie: string,
+    response: EnrollmentStartResult,
+    sessionId: string,
     totpSecret?: string,
   ) => void;
   next: () => void;
@@ -50,13 +49,12 @@ export const useEnrollmentStore = create<Store>()(
   persist(
     (set, get) => ({
       ...defaults,
-      start: (response, url, cookie, secret) => {
+      start: (response, sessionId, secret) => {
         set({
           ...defaults,
-          proxyUrl: url,
+          sessionId,
           activeStep: EnrollmentStep.Welcome,
           startResponse: response,
-          sessionCookie: cookie,
           // if smtp is not present then it's not possible to choose.
           skipMfaChoice:
             !response.settings.smtp_configured || !response.settings.mfa_required,

new-ui/src/pages/full/EnrollmentPage/steps/FinishStep/FinishStep.tsx

@@ -4,13 +4,15 @@ import { Button } from '../../../../../shared/components/Button/Button';
 import { ButtonVariant } from '../../../../../shared/components/Button/types';
 import { Controls } from '../../../../../shared/components/Controls/Controls';
 import { RenderMarkdown } from '../../../../../shared/components/RenderMarkdown/RenderMarkdown';
+import { api } from '../../../../../shared/rust-api/api';
 import { isPresent } from '../../../../../shared/utils/isPresent';
 import { useEnrollmentStore } from '../../hooks/useEnrollmentStore';
 import bannerSrc from './assets/banner.png';
 
 export const FinishStep = () => {
   const navigate = useNavigate();
   const response = useEnrollmentStore((s) => s.startResponse);
+  const sessionId = useEnrollmentStore((s) => s.sessionId);
   const markdownContent = response?.final_page_content;
   const showMarkdown = isPresent(markdownContent) && markdownContent.length > 0;
 
@@ -32,6 +34,12 @@ export const FinishStep = () => {
             variant={ButtonVariant.Primary}
             text="Got it"
             onClick={() => {
+              // Release the enrollment session now that the wizard is done.
+              // Best-effort: enrollment_finish errors if the session is already
+              // gone, so swallow failures and leave the wizard regardless.
+              if (isPresent(sessionId)) {
+                void api.enrollmentFinish(sessionId).catch(() => {});
+              }
               navigate({ to: '/full/overview', replace: true });
             }}
           />

new-ui/src/pages/full/EnrollmentPage/steps/MfaChoiceStep/MfaChoiceStep.tsx

@@ -1,37 +1,34 @@
-/** biome-ignore-all lint/style/noNonNullAssertion: this cannot be shown without those store values */
+/** biome-ignore-all lint/style/noNonNullAssertion: sessionId is set in start(), called before */
 import { useMutation } from '@tanstack/react-query';
+import './style.scss';
 import clsx from 'clsx';
 import { useState } from 'react';
-import { useShallow } from 'zustand/shallow';
 import {
   Icon,
   IconKind,
   type IconKindValue,
 } from '../../../../../shared/components/Icon';
 import { RadioIndicator } from '../../../../../shared/components/RadioIndicator/RadioIndicator';
 import { SizedBox } from '../../../../../shared/components/SizedBox/SizedBox';
-import { edgeApi } from '../../../../../shared/edge-api/api';
+import { api } from '../../../../../shared/rust-api/api';
 import { MfaMethod, type MfaMethodValue } from '../../../../../shared/rust-api/types';
 import { ThemeSpacing } from '../../../../../shared/types';
 import { EnrollmentControls } from '../../components/EnrollmentControls/EnrollmentControls';
 import { useEnrollmentStore } from '../../hooks/useEnrollmentStore';
 
 export const MfaChoiceStep = () => {
-  const [proxyUrl, cookie] = useEnrollmentStore(
-    useShallow((s) => [s.proxyUrl!, s.sessionCookie!]),
-  );
+  const sessionId = useEnrollmentStore((s) => s.sessionId);
   const [mfa, setMfa] = useState<MfaMethodValue>(
     useEnrollmentStore.getState().userMfaChoice,
   );
 
   const { mutate, isPending } = useMutation({
-    mutationFn: () => edgeApi.startMfaSetup(proxyUrl, cookie, mfa),
+    mutationFn: () => api.enrollmentRegisterMfaStart(sessionId!, mfa),
     onSuccess: (resp) => {
       if (mfa === MfaMethod.Totp) {
-        const secret = resp.result?.totp_secret;
         useEnrollmentStore.setState({
           userMfaChoice: mfa,
-          userTotpSecret: secret,
+          userTotpSecret: resp.totp_secret,
         });
       } else {
         useEnrollmentStore.setState({ userMfaChoice: mfa });

new-ui/src/pages/full/EnrollmentPage/steps/MfaConfigurationStep/MfaConfigurationStep.tsx

@@ -1,57 +1,71 @@
 import { Fragment, useCallback, useEffect, useMemo, useState } from 'react';
 import './style.scss';
 import { useMutation } from '@tanstack/react-query';
-import { useShallow } from 'zustand/shallow';
+import { error as logError } from '@tauri-apps/plugin-log';
 import { CodeInput } from '../../../../../shared/components/CodeInput/CodeInput';
 import { CopyField } from '../../../../../shared/components/CopyField/CopyField';
 import { Divider } from '../../../../../shared/components/Divider/Divider';
 import { QrCard } from '../../../../../shared/components/QrCard/QrCard';
 import { SizedBox } from '../../../../../shared/components/SizedBox/SizedBox';
-import { edgeApi } from '../../../../../shared/edge-api/api';
+import { api } from '../../../../../shared/rust-api/api';
 import { MfaMethod } from '../../../../../shared/rust-api/types';
 import { ThemeSpacing } from '../../../../../shared/types';
 import { isPresent } from '../../../../../shared/utils/isPresent';
 import { EnrollmentControls } from '../../components/EnrollmentControls/EnrollmentControls';
 import { activateUser } from '../../hooks/activateUser';
 import { useEnrollmentStore } from '../../hooks/useEnrollmentStore';
 
+/**
+ * Map a register-mfa-finish error to a user-facing message. The proxy rejects
+ * a wrong code with a `proxy_error` (HTTP 400) whose message contains "invalid"
+ * (core returns "Code invalid" / "Email code invalid"); anything else is
+ * unexpected and gets a generic message.
+ */
+const mfaFinishErrorMessage = (err: unknown): string => {
+  try {
+    const parsed = JSON.parse(String(err)) as { type?: string; message?: string };
+    if (
+      parsed.type === 'proxy_error' &&
+      parsed.message?.toLowerCase().includes('invalid')
+    ) {
+      return 'Invalid code';
+    }
+  } catch {
+    // Non-JSON error: fall through to the generic message.
+  }
+  return 'MFA setup failed. Please try again.';
+};
+
 export const MfaConfigurationStep = () => {
+  const sessionId = useEnrollmentStore((s) => s.sessionId);
   const method = useEnrollmentStore((s) => s.userMfaChoice);
   const [code, setCode] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
-  const [proxyUrl, cookie] = useEnrollmentStore(
-    // biome-ignore lint/style/noNonNullAssertion: safe
-    useShallow((s) => [s.proxyUrl!, s.sessionCookie!]),
-  );
 
   const { mutate, isPending } = useMutation({
     mutationFn: async () => {
-      const resp = await edgeApi.finishMfaSetup(proxyUrl, cookie, {
-        // biome-ignore lint/style/noNonNullAssertion: checked in handleSubmit
-        code: code!,
-        method,
-      });
+      // biome-ignore lint/style/noNonNullAssertion: checked in handleSubmit
+      const resp = await api.enrollmentRegisterMfaFinish(sessionId!, code!, method);
       await activateUser();
       return resp;
     },
-    onError: () => {},
+    onError: (err) => {
+      void logError(`MFA configuration failed: ${err}`);
+      setError(mfaFinishErrorMessage(err));
+    },
     onSuccess: (resp) => {
-      if (resp.result) {
-        useEnrollmentStore.setState({
-          userRecoveryCodes: resp.result.recovery_codes,
-          deadline: null,
-        });
-        useEnrollmentStore.getState().next();
-      }
-      if (resp.error) {
-        setError('Enter a valid code');
-      }
+      useEnrollmentStore.setState({
+        userRecoveryCodes: resp.recovery_codes,
+        deadline: null,
+      });
+      useEnrollmentStore.getState().next();
     },
   });
 
   const handleSubmit = useCallback(() => {
     if (code?.trim().length !== 6) {
-      setError('');
+      setError('Enter a valid code');
+      return;
     }
     mutate();
   }, [code, mutate]);

new-ui/src/pages/full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx

@@ -1,16 +1,16 @@
 /** biome-ignore-all lint/style/noNonNullAssertion: ensured by wizard page */
+import { error } from '@tauri-apps/plugin-log';
 import './style.scss';
 import { useStore } from '@tanstack/react-form';
 import { useMutation } from '@tanstack/react-query';
 import clsx from 'clsx';
 import { useCallback } from 'react';
 import z from 'zod';
-import { useShallow } from 'zustand/shallow';
 import { Icon, type IconKindValue } from '../../../../../shared/components/Icon';
 import { SizedBox } from '../../../../../shared/components/SizedBox/SizedBox';
-import { edgeApi } from '../../../../../shared/edge-api/api';
 import { useAppForm, withForm } from '../../../../../shared/form';
 import { formChangeLogic } from '../../../../../shared/formLogic';
+import { api } from '../../../../../shared/rust-api/api';
 import { MfaMethod } from '../../../../../shared/rust-api/types';
 import { ThemeSpacing } from '../../../../../shared/types';
 import { EnrollmentControls } from '../../components/EnrollmentControls/EnrollmentControls';
@@ -59,11 +59,9 @@ const defaultValues: FormFields = {
 };
 
 export const PasswordStep = () => {
-  const [proxyUrl, cookie] = useEnrollmentStore(
-    useShallow((s) => [s.proxyUrl!, s.sessionCookie!]),
-  );
+  const sessionId = useEnrollmentStore((s) => s.sessionId);
   const { mutateAsync: startMfa } = useMutation({
-    mutationFn: () => edgeApi.startMfaSetup(proxyUrl, cookie, MfaMethod.Totp),
+    mutationFn: () => api.enrollmentRegisterMfaStart(sessionId!, MfaMethod.Totp),
   });
 
   const form = useAppForm({
@@ -74,25 +72,24 @@ export const PasswordStep = () => {
       onChange: formSchema,
     },
     onSubmit: async ({ value }) => {
-      const { skipMfaChoice, skipMfa } = useEnrollmentStore.getState();
-      if (skipMfaChoice) {
-        const mfaResponse = await startMfa();
-        if (mfaResponse.result) {
+      try {
+        const { skipMfaChoice, skipMfa } = useEnrollmentStore.getState();
+        if (skipMfaChoice) {
+          const mfaResponse = await startMfa();
           useEnrollmentStore.setState({
-            userTotpSecret: mfaResponse.result.totp_secret ?? null,
+            userTotpSecret: mfaResponse.totp_secret,
           });
-        } else {
-          console.error(mfaResponse);
-          return;
         }
+        useEnrollmentStore.setState({
+          userPassword: value.password.trim(),
+        });
+        if (skipMfa) {
+          await activateUser();
+        }
+        useEnrollmentStore.getState().next();
+      } catch (err) {
+        void error(`Password step failed: ${err}`);
       }
-      useEnrollmentStore.setState({
-        userPassword: value.password.trim(),
-      });
-      if (skipMfa) {
-        await activateUser();
-      }
-      useEnrollmentStore.getState().next();
     },
   });