MFA

backend/server.js

@@ -31,6 +31,7 @@ const conditionCheckRoutes = require("./routes/conditionChecks");
 const feedbackRoutes = require("./routes/feedback");
 const uploadRoutes = require("./routes/upload");
 const healthRoutes = require("./routes/health");
+const twoFactorRoutes = require("./routes/twoFactor");
 
 const emailServices = require("./services/email");
 const s3Service = require("./services/s3Service");
@@ -152,6 +153,7 @@ app.get("/", (req, res) => {
 // Public routes (no alpha access required)
 app.use("/api/alpha", alphaRoutes);
 app.use("/api/auth", authRoutes); // Auth has its own alpha checks in registration
+app.use("/api/2fa", twoFactorRoutes); // 2FA routes require authentication (handled in router)
 
 // Protected routes (require alpha access)
 app.use("/api/users", requireAlphaAccess, userRoutes);