Junie: security cleanups.

data/user.go

@@ -81,25 +81,11 @@ func (u *User) CheckPassword(login *Login) bool {
 	return subtle.ConstantTimeCompare(derived, u.Password) == validCompareResult
 }
 
+// Check is a legacy method that now only checks the password
+// It's kept for backward compatibility but is equivalent to CheckPassword
 func (u *User) Check(login *Login) bool {
-	// First check username and password
-	if !u.CheckPassword(login) {
-		return false
-	}
-
-	// If TOTP is enabled for the user, validate the TOTP code
-	if u.TOTPSecret != emptyString && login.TOTPCode != emptyString {
-		// Use the ValidateTOTPCode method to validate the TOTP code
-		valid, validErr := u.ValidateTOTPCode(login.TOTPCode)
-		if validErr != nil || !valid {
-			return false
-		}
-	} else if u.TOTPSecret != emptyString && login.TOTPCode == emptyString {
-		// TOTP is enabled but no code was provided
-		return false
-	}
-
-	return true
+	// Only check username and password, TOTP verification is now a separate flow
+	return u.CheckPassword(login)
 }
 
 func (u *User) Register(login *Login) error {