@adminforth/two-factors-auth 1.10.0 → 1.10.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/build.log +1 -1
  2. package/custom/TwoFactorsConfirmation.vue +2 -2
  3. package/dist/custom/TwoFactorsConfirmation.vue +2 -2
  4. package/dist/index.js +14 -11
  5. package/index.ts +14 -11
  6. package/package.json +2 -2
package/build.log CHANGED
@@ -13,4 +13,4 @@ custom/package.json
13
13
  custom/tsconfig.json
14
14
 
15
15
  sent 57,630 bytes received 153 bytes 115,566.00 bytes/sec
16
- total size is 57,065 speedup is 0.99
16
+ total size is 57,057 speedup is 0.99
package/custom/TwoFactorsConfirmation.vue CHANGED
@@ -182,8 +182,8 @@
182
182
  showErrorTost(t('Invalid passkey'));
183
183
  codeError.value = 'Invalid passkey';
184
184
  } else {
185
- showErrorTost(t('Invalid code'));
186
- codeError.value = 'Invalid code';
185
+ showErrorTost(t(resp.error));
186
+ codeError.value = resp.error;
187
187
  }
188
188
  }
189
189
  }
package/dist/custom/TwoFactorsConfirmation.vue CHANGED
@@ -182,8 +182,8 @@
182
182
  showErrorTost(t('Invalid passkey'));
183
183
  codeError.value = 'Invalid passkey';
184
184
  } else {
185
- showErrorTost(t('Invalid code'));
186
- codeError.value = 'Invalid code';
185
+ showErrorTost(t(resp.error));
186
+ codeError.value = resp.error;
187
187
  }
188
188
  }
189
189
  }
package/dist/index.js CHANGED
@@ -237,8 +237,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
237
237
  if (!secret) {
238
238
  const tempSecret = twofactor.generateSecret({ name: issuerName, account: userName });
239
239
  newSecret = tempSecret.secret;
240
- const totpTemporaryJWT = this.adminforth.auth.issueJWT({ userName, newSecret, issuer: issuerName, pk: userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
241
- this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: 1 * 60 * 60 * 1000, httpOnly: true } });
240
+ const totpTemporaryJWT = this.adminforth.auth.issueJWT({ userName, newSecret, issuer: issuerName, pk: userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '10m');
241
+ this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
242
242
  return {
243
243
  body: {
244
244
  loginAllowed: false,
@@ -248,8 +248,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
248
248
  };
249
249
  }
250
250
  else {
251
- const value = this.adminforth.auth.issueJWT({ userName, issuer: issuerName, pk: userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
252
- this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true } });
251
+ const value = this.adminforth.auth.issueJWT({ userName, issuer: issuerName, pk: userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '10m');
252
+ this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
253
253
  return {
254
254
  body: {
255
255
  loginAllowed: false,
@@ -284,7 +284,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
284
284
  const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "2FaTemporaryJWT" });
285
285
  const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
286
286
  if (!decoded) {
287
- return { status: 'error', message: 'Invalid token' };
287
+ return { status: 'error', message: 'Login session expired. Please log in again.' };
288
288
  }
289
289
  if (decoded.newSecret) {
290
290
  // set up standard TOTP request - ensured by presence of newSecret in temp2FA token
@@ -308,7 +308,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
308
308
  let verified = null;
309
309
  if (body.usePasskey && this.options.passkeys) {
310
310
  // passkeys are enabled and user wants to use them
311
- const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyTemporaryJWT` });
311
+ const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
312
312
  if (!passkeysCookies) {
313
313
  return { error: 'Passkey token is required' };
314
314
  }
@@ -429,8 +429,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
429
429
  userVerification: ((_m = this.options.passkeys) === null || _m === void 0 ? void 0 : _m.settings.authenticatorSelection.userVerification) || "required"
430
430
  },
431
431
  });
432
- const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
433
- this.adminforth.auth.setCustomCookie({ response, payload: { name: "passkeyTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true } });
432
+ const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge, "user_id": adminUser.pk }, 'tempPasskeyChallenge', '10m');
433
+ this.adminforth.auth.setCustomCookie({ response, payload: { name: "registerPasskeyTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
434
434
  return { ok: true, data: options };
435
435
  })
436
436
  });
@@ -440,7 +440,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
440
440
  noAuth: false,
441
441
  handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
442
442
  var _b, _c, _d, _e, _f;
443
- const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "passkeyTemporaryJWT" });
443
+ const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "registerPasskeyTemporaryJWT" });
444
444
  if (!passkeysCookies) {
445
445
  return { error: 'Passkey token is required' };
446
446
  }
@@ -448,6 +448,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
448
448
  if (!decodedPasskeysCookies) {
449
449
  return { error: 'Invalid passkey token' };
450
450
  }
451
+ if (decodedPasskeysCookies.user_id !== adminUser.pk) {
452
+ return { error: 'Invalid user' };
453
+ }
451
454
  const settingsOrigin = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.expectedOrigin;
452
455
  const expectedOrigin = body.origin;
453
456
  const expectedChallenge = decodedPasskeysCookies.challenge;
@@ -513,8 +516,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
513
516
  rpID: (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.rp.id,
514
517
  userVerification: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.authenticatorSelection.userVerification) || "required"
515
518
  });
516
- const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
517
- this.adminforth.auth.setCustomCookie({ response, payload: { name: `passkeyTemporaryJWT`, value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true } });
519
+ const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '10m');
520
+ this.adminforth.auth.setCustomCookie({ response, payload: { name: `passkeyLoginTemporaryJWT`, value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
518
521
  return { ok: true, data: options };
519
522
  }
520
523
  catch (e) {
package/index.ts CHANGED
@@ -259,8 +259,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
259
259
  const tempSecret = twofactor.generateSecret({name: issuerName,account: userName})
260
260
  newSecret = tempSecret.secret;
261
261
 
262
- const totpTemporaryJWT = this.adminforth.auth.issueJWT({userName, newSecret, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
263
- this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
262
+ const totpTemporaryJWT = this.adminforth.auth.issueJWT({userName, newSecret, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '10m');
263
+ this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
264
264
 
265
265
  return {
266
266
  body:{
@@ -271,8 +271,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
271
271
  }
272
272
 
273
273
  } else {
274
- const value = this.adminforth.auth.issueJWT({userName, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
275
- this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
274
+ const value = this.adminforth.auth.issueJWT({userName, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '10m');
275
+ this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
276
276
 
277
277
  return {
278
278
  body:{
@@ -311,7 +311,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
311
311
  const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "2FaTemporaryJWT"});
312
312
  const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
313
313
  if (!decoded) {
314
- return { status:'error', message:'Invalid token' }
314
+ return { status:'error', message:'Login session expired. Please log in again.' }
315
315
  }
316
316
 
317
317
  if (decoded.newSecret) {
@@ -334,7 +334,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
334
334
  let verified = null;
335
335
  if (body.usePasskey && this.options.passkeys) {
336
336
  // passkeys are enabled and user wants to use them
337
- const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyTemporaryJWT`});
337
+ const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
338
338
  if (!passkeysCookies) {
339
339
  return { error: 'Passkey token is required' };
340
340
  }
@@ -455,8 +455,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
455
455
  userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
456
456
  },
457
457
  });
458
- const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
459
- this.adminforth.auth.setCustomCookie({response, payload: {name: "passkeyTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
458
+ const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge, "user_id": adminUser.pk }, 'tempPasskeyChallenge', '10m');
459
+ this.adminforth.auth.setCustomCookie({response, payload: {name: "registerPasskeyTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
460
460
  return { ok: true, data: options };
461
461
  }
462
462
  });
@@ -465,7 +465,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
465
465
  path: `/plugin/passkeys/finishRegisteringPasskey`,
466
466
  noAuth: false,
467
467
  handler: async ({body, adminUser, cookies }) => {
468
- const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "passkeyTemporaryJWT"});
468
+ const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "registerPasskeyTemporaryJWT"});
469
469
  if (!passkeysCookies) {
470
470
  return { error: 'Passkey token is required' };
471
471
  }
@@ -473,6 +473,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
473
473
  if (!decodedPasskeysCookies) {
474
474
  return { error: 'Invalid passkey token' };
475
475
  }
476
+ if (decodedPasskeysCookies.user_id !== adminUser.pk) {
477
+ return { error: 'Invalid user' };
478
+ }
476
479
  const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
477
480
  const expectedOrigin = body.origin;
478
481
  const expectedChallenge = decodedPasskeysCookies.challenge;
@@ -544,8 +547,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
544
547
  rpID: this.options.passkeys?.settings.rp.id,
545
548
  userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
546
549
  });
547
- const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
548
- this.adminforth.auth.setCustomCookie({response, payload: {name: `passkeyTemporaryJWT`, value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
550
+ const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '10m');
551
+ this.adminforth.auth.setCustomCookie({response, payload: {name: `passkeyLoginTemporaryJWT`, value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
549
552
  return { ok: true, data: options };
550
553
  } catch (e) {
551
554
  return { ok: false, error: e };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@adminforth/two-factors-auth",
3
- "version": "1.10.0",
3
+ "version": "1.10.2",
4
4
  "description": "AdminForth plugin for two factors authentication",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
@@ -26,7 +26,7 @@
26
26
  "license": "ISC",
27
27
  "dependencies": {
28
28
  "@simplewebauthn/server": "^13.2.1",
29
- "adminforth": "^2.4.0-next.193",
29
+ "adminforth": "^2.9.2",
30
30
  "node-2fa": "^2.0.3"
31
31
  },
32
32
  "devDependencies": {