NK admin TOTP 2FA + step-up re-verification for sensitive ops. All paid plans.
Normal 2FA (login)
el_user_profile.login_totp_secret per-user. After password verifies, PageVerify2fa pops for 6-digit code → session passed_2fa=true.
Step-up 2FA (sensitive ops)
Normal 2FA covers login once; step-up requires re-entering 6-digit code within 5 min. Required for:
- Reset others' 2FA
- Any AI agent call
- Uninstall license / delete node
- Delete DB instance / website
- Enable firewall bypass
Frontend useStepUpGuard
App.vue mounts StepUpGuardModal globally. Caller invokes gate.intercept(msg) to pop automatically. v50h hooks AiChat so retry happens automatically after verification.