updates

Backend/src/payments/routes/accountant_security_routes.py

@@ -26,6 +26,8 @@ async def verify_step_up(
 ):
     """Verify step-up authentication (MFA token or password re-entry)."""
     try:
+        from ..models.accountant_session import AccountantSession
+        
         mfa_token = step_up_data.get('mfa_token')
         password = step_up_data.get('password')
         session_token = step_up_data.get('session_token')
@@ -34,8 +36,18 @@ async def verify_step_up(
             # Try to get from header or cookie
             session_token = request.headers.get('X-Session-Token') or request.cookies.get('session_token')
         
+        # If still no session token, try to find the most recent active session for this user
         if not session_token:
-            raise HTTPException(status_code=400, detail='Session token is required')
+            active_session = db.query(AccountantSession).filter(
+                AccountantSession.user_id == current_user.id,
+                AccountantSession.is_active == True,
+                AccountantSession.expires_at > datetime.utcnow()
+            ).order_by(AccountantSession.last_activity.desc()).first()
+            
+            if active_session:
+                session_token = active_session.session_token
+            else:
+                raise HTTPException(status_code=400, detail='No active session found. Please log in again.')
         
         # Verify MFA if token provided
         if mfa_token: