add optional prefix to url

internal/handlers/handlers.go

@@ -344,7 +344,7 @@ func (h *Handlers) ProfilePage(c *gin.Context) {
     // Must be authenticated; middleware ensures user_id is set
     uidPtr := getUserIDPtr(c)
     if uidPtr == nil {
-        c.Redirect(http.StatusFound, "/editor/login")
+        c.Redirect(http.StatusFound, h.config.URLPrefix+"/editor/login")
         return
     }
 
@@ -477,7 +477,7 @@ func (h *Handlers) PostProfileEnableMFA(c *gin.Context) {
         c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
         return
     }
-    c.JSON(http.StatusOK, gin.H{"success": true, "setup": true, "redirect": "/editor/profile/mfa/setup"})
+    c.JSON(http.StatusOK, gin.H{"success": true, "setup": true, "redirect": h.config.URLPrefix+"/editor/profile/mfa/setup"})
 }
 
 // PostProfileDisableMFA clears the user's MFA secret
@@ -611,16 +611,18 @@ func (h *Handlers) AdminEnableUserMFA(c *gin.Context) {
         c.JSON(http.StatusBadRequest, gin.H{"error": "invalid user id"})
         return
     }
-    // Create or replace an enrollment so user is prompted on next login
+    // Admin enable: set a new secret directly so MFA is immediately enabled
     secret, err := generateBase32Secret()
     if err != nil {
         c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate secret"})
         return
     }
-    if _, err := h.authSvc.DB.Exec(`INSERT OR REPLACE INTO mfa_enrollments (user_id, secret) VALUES (?, ?)`, id, secret); err != nil {
+    if _, err := h.authSvc.DB.Exec(`UPDATE users SET mfa_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`, secret, id); err != nil {
         c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
         return
     }
+    // Remove any pending enrollment rows
+    _, _ = h.authSvc.DB.Exec(`DELETE FROM mfa_enrollments WHERE user_id = ?`, id)
     c.JSON(http.StatusOK, gin.H{"success": true})
 }
 
@@ -890,7 +892,7 @@ func (h *Handlers) PostEditTextHandler(c *gin.Context) {
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"success": true, "redirect": "/view_text/" + filePath})
+	c.JSON(http.StatusOK, gin.H{"success": true, "redirect": h.config.URLPrefix + "/view_text/" + filePath})
 }
 
 func New(cfg *config.Config, store *sessions.CookieStore, authSvc *auth.Service) *Handlers {