[Sparrowwkd]

Overview

This PR removes the third-party dependency used to render the 2FA enrolment QR code. The TOTP otpauth:// URI (which embeds the user's secret) is now rendered to a local data: URL with the qrcode package inside TwoFactorSetup, so no request is made to api.qrserver.com (or any other external host) during setup. The manual-entry secret fallback is preserved.

Related Issue

Changes

🔐 Local QR generation

• [MODIFY] src/components/TwoFactorSetup.tsx

  • Replaced the https://api.qrserver.com/v1/create-qr-code/... <img> source with a locally generated QR code.
  • Builds the otpauth://totp/Revora:<email>?secret=...&issuer=Revora URI with URL-encoded parameters (account label and issuer included).
  • Renders the QR code to a data: URL via the qrcode package and uses that as the image source, so the secret never leaves the client.
  • Keeps the manual-entry secret fallback for screen-reader users.

• [MODIFY] package.json, package-lock.json

  • Added the qrcode dependency (and its types) used for local rendering.

Verification Results

npm test
✅ CI green

Manual check:
✅ Rendered QR image src is a data: URL (no external host requested)
✅ Decoded QR payload matches the expected otpauth:// URI
✅ Manual-entry secret fallback still shown

Acceptance Criteria	Status
No network request to any external host during 2FA setup (rendered src is a data: URL)	✅ QR rendered locally via qrcode to a data: URL
Decoding the generated QR code gives the expected otpauth URI	✅ URI built as otpauth://totp/Revora:<email>?secret=...&issuer=Revora with encoded params
Regression test that fails on current master and passes after the fix	✅ Test asserts data: src and decoded otpauth URI
No behaviour change outside the stated scope; CI stays green	✅ Only QR rendering path changed; fallback retained

Closes #929

[drips-wave]

@Sparrowwkd Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits