Qr

[YasharF]

Checklist

• I acknowledge that submissions that include copy-paste of AI-generated content taken at face value (PR text, code, commit message, documentation, etc.) most likely have errors and hence will be rejected entirely and marked as spam or invalid
• I manually tested the change with a running instance, DB, and valid API keys where applicable
• Added/updated tests if the existing tests do not cover this change
• README or other relevant docs are updated
• --no-verify was not used for the commit(s)
• npm run lint passed locally without any errors
• npm test passed locally without any errors
• npm run test:e2e:replay passed locally without any errors
• npm run test:e2e:custom -- --project=chromium-nokey-live passed locally without any errors
• PR diff does not include unrelated changes
• PR title follows Conventional Commits — https://www.conventionalcommits.org/en

Description

Screenshots of UI changes (browser) and logs/test results (console, terminal, shell, cmd)

[Copilot]

Pull request overview

This PR updates the TOTP setup page to render a QR code from the server without relying on an external QR-image service, and updates various npm dependencies/lockfile entries.

Changes:

• Generate a QR code SVG data URI server-side (via the new qr dependency) and pass it to the TOTP setup view.
• Update the Pug template to use the provided qrImage instead of building an external QR service URL.
• Bump multiple dependencies and regenerate package-lock.json.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 6 comments.

File	Description
controllers/user.js	Generates an SVG QR code (data URI) for the TOTP setup page and passes it to the view.
views/account/totp-setup.pug	Switches QR rendering from an external URL to qrImage provided by the controller.
package.json	Adds qr dependency and bumps multiple dependencies (including Mocha to next).
package-lock.json	Lockfile updated to reflect dependency changes/additions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

data:image/svg+xml;utf8, uses a non-standard parameter (utf8). For better browser compatibility and standards compliance, prefer data:image/svg+xml;charset=utf-8, (or base64-encode the SVG) when constructing the data URI.

Suggested change

	const qrImage = `data:image/svg+xml;utf8,${encodeURIComponent(svgWithSize)}`;
	const qrImage = `data:image/svg+xml;charset=utf-8,${encodeURIComponent(svgWithSize)}`;

[Copilot]

The SVG sizing is applied via a plain string replacement on '<svg ', which is brittle (it won’t match <svg> with no space, newline after <svg, or other variations, and may duplicate width/height if they already exist). Consider using a more robust approach (e.g., a regex that handles <svg plus optional whitespace/attrs, or QR library options for setting size) so the output is consistently sized.

Suggested change

	const svgWithSize = svg.replace('<svg ', `<svg width="${size}" height="${size}" `);
	const sizeAttr = `width="${size}" height="${size}"`;
	let svgWithSize = svg;
	const svgTagMatch = svg.match(/<svg\b([^>]*)>/i);
	if (svgTagMatch) {
	const attrs = svgTagMatch[1] || '';
	const hasWidth = /\bwidth\s*=\s*["'][^"']*["']/i.test(attrs);
	const hasHeight = /\bheight\s*=\s*["'][^"']*["']/i.test(attrs);
	if (!hasWidth && !hasHeight) {
	const newSvgTag = `<svg${attrs} ${sizeAttr}>`;
	svgWithSize = svg.replace(/<svg\b[^>]*>/i, newSvgTag);
	}
	}

[Copilot]

await import('qr') is executed inside the request handler. Even though Node caches modules, doing this per request adds async overhead and can surface runtime import failures only when this route is hit. Prefer importing once at module scope (or memoizing the import) so failures happen at startup and the handler stays synchronous aside from DB work.

[Copilot]

This adds a new QR generation code path for the TOTP setup page, but there doesn’t appear to be test coverage asserting the page renders a QR image (e.g., an authenticated request expecting qrImage/data:image/svg+xml in the response). Adding an integration test for the authenticated /account/2fa/totp/setup route would help catch runtime issues with the qr dependency and SVG/data-URI generation.