Summary

Implements the requirement: before letting a user in, perform a full challenge-response round-trip to confirm the credentials actually work. If verification fails, show a clear error and block access.

Changes

server/routes/auth.ts — bug fix

• Ordering bug fixed: the challenge row was being deleted from the DB before the expiry was checked. If a challenge was expired it was already gone when the expiry branch tried to report it.
• Now: check expiry first, then delete.
• Returns a distinct challenge_expired error code so the client can distinguish "wrong credentials" from "took too long".

src/services/api.js — hardened fetch layer

• All requests now go through a single apiFetch() wrapper that:
  • catches network-level failures (fetch() throwing) and surfaces them as "Cannot reach server. Check that it is running."
  • always parses non-2xx bodies and throws their error field.
• New verifyConnection(number, privateSigningKeyJwk) helper — performs the complete challenge → sign → verify sequence in one call. Used by all three entry-point screens.

src/pages/Setup.jsx — verification after activation

• After the server accepts the activation code and registers the public keys, verifyConnection() is immediately called to confirm the keys work.
• Only if verification succeeds is the vault written to local storage and the user admitted.
• If verification fails the user sees a human-readable error (not a raw HTTP status).
• Step-by-step status labels: Generating keys… → Activating number… → Verifying connection… → Saving vault…
• Same verification step added to the import-from-file flow.

src/pages/Unlock.jsx — verification on password unlock

• Uses verifyConnection() after the vault is decrypted.
• Distinct error messages for: wrong password / server rejected credentials / server unreachable.
• Granular status labels while each step runs.

src/pages/Entry.jsx — verification on silent auto-unlock

• Silent mode now calls verifyConnection() before navigating to /.
• Loading screen shows the current step name.
• Error screen distinguishes connection errors (server down) from vault errors (corrupted keys) and includes a working Retry button that re-runs the whole check cycle.