@adminforth/two-factors-auth 2.10.11 → 3.0.0

package/build.log

@@ -15,5 +15,5 @@ custom/package.json
 custom/tsconfig.json
 custom/utils.js
 
-sent 273,574 bytes  received 210 bytes  547,568.00 bytes/sec
-total size is 272,747  speedup is 1.00
+sent 273,600 bytes  received 210 bytes  547,620.00 bytes/sec
+total size is 272,773  speedup is 1.00

package/custom/TwoFactorsConfirmation.vue

@@ -200,6 +200,7 @@
     if ( newRoute.hash === '#passkey' ) {
       cancelPendingWebAuthn('switch-to-passkey');
       confirmationMode.value = 'passkey';
+      usePasskeyButton();
     } else if ( newRoute.hash === '#code' ) {
       cancelPendingWebAuthn('switch-to-code');
       confirmationMode.value = 'code';

package/dist/custom/TwoFactorsConfirmation.vue

@@ -200,6 +200,7 @@
     if ( newRoute.hash === '#passkey' ) {
       cancelPendingWebAuthn('switch-to-passkey');
       confirmationMode.value = 'passkey';
+      usePasskeyButton();
     } else if ( newRoute.hash === '#code' ) {
       cancelPendingWebAuthn('switch-to-code');
       confirmationMode.value = 'code';

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthPlugin, Filters, suggestIfTypo } from "adminforth";
+import { AdminForthPlugin, Filters, suggestIfTypo, convertPeriodToSeconds } from "adminforth";
 import twofactor from 'node-2fa';
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
 import { isoUint8Array, isoBase64URL } from '@simplewebauthn/server/helpers';
@@ -22,6 +22,37 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `single`;
     }
+    useChellenge(challenge, expiresIn) {
+        const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
+        this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
+    }
+    checkIfChellengeNotUsed(challenge) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = yield this.options.passkeys.keyValueAdapter.get(challenge);
+            if (!res) {
+                return true;
+            }
+            return false;
+        });
+    }
+    validateCookiesForPasskeyLogin(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
+            if (!passkeysCookies) {
+                return { ok: false, error: 'Passkey token is required' };
+            }
+            const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+            const isChallangeValid = yield this.checkIfChellengeNotUsed(decodedPasskeysCookies.challenge);
+            if (isChallangeValid) {
+                this.useChellenge(decodedPasskeysCookies.challenge, ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '2m');
+            }
+            if (!decodedPasskeysCookies || !isChallangeValid) {
+                return { ok: false, error: 'Invalid passkey' };
+            }
+            return { ok: true, decodedPasskeysCookies };
+        });
+    }
     checkIfSkipSetupAllowSkipVerify(adminUser) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.options.usersFilterToAllowSkipSetup) {
@@ -164,17 +195,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 ;
             }
             else if (confirmationResult.mode === "passkey") {
-                //TODO: fix ts-ignore after releasing new version of adminforth with updated types
-                //@ts-ignore
-                const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
-                if (!passkeysCookies) {
-                    return { error: 'Passkey token is required' };
-                }
-                const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-                if (!decodedPasskeysCookies) {
-                    return { error: 'Invalid passkey' };
+                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                if (!cookiesValidationResult.ok) {
+                    return { error: cookiesValidationResult.error };
                 }
-                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies);
+                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies);
                 if (verificationResult.ok && verificationResult.passkeyConfirmed) {
                     //* SET GRACE COOKIE *//
                     if (this.options.stepUpMfaGracePeriodSeconds) {
@@ -325,6 +350,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             if (!this.options.passkeys.credentialIdFieldName) {
                 throw new Error('Passkeys credentialIdFieldName is required');
             }
+            if (!this.options.passkeys.keyValueAdapter) {
+                throw new Error('Passkeys keyValueAdapter is required');
+            }
             const credentialResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
             const credentialIDField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialIdFieldName);
             if (!credentialIDField) {
@@ -490,15 +518,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                     let verified = null;
                     if (body.usePasskey && this.options.passkeys) {
                         // passkeys are enabled and user wants to use them
-                        const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
-                        if (!passkeysCookies) {
-                            return { error: 'Passkey token is required' };
-                        }
-                        const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-                        if (!decodedPasskeysCookies) {
-                            return { error: 'Invalid passkey' };
+                        const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                        if (!cookiesValidationResult.ok) {
+                            return { error: cookiesValidationResult.error };
                         }
-                        const res = yield this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, decodedPasskeysCookies);
+                        const res = yield this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
                         if (res.ok && res.passkeyConfirmed) {
                             verified = true;
                         }
@@ -533,13 +557,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 if (!passkeyResponse) {
                     return { error: 'Passkey response is required' };
                 }
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "passkeyLoginTemporaryJWT" });
-                if (!totpTemporaryJWT) {
-                    return { error: 'Authentication session is expired. Please, try again' };
-                }
-                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
-                if (!decoded) {
-                    return { error: 'Authentication session is expired. Please, try again' };
+                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                if (!cookiesValidationResult.ok) {
+                    return { error: cookiesValidationResult.error };
                 }
                 let parsedPasskeyResponse;
                 try {
@@ -568,7 +588,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 if (!user) {
                     return { error: 'User not found' };
                 }
-                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
                 if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
                     return { error: 'Passkey verification failed' };
                 }

package/index.ts

@@ -1,4 +1,4 @@
-import {  AdminForthPlugin, Filters, suggestIfTypo, HttpExtra } from "adminforth";
+import {  AdminForthPlugin, Filters, suggestIfTypo, HttpExtra, convertPeriodToSeconds } from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth, BeforeLoginConfirmationFunction, IAdminForthHttpResponse } from "adminforth";
 import twofactor from 'node-2fa';
 import  { PluginOptions } from "./types.js"
@@ -29,6 +29,36 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     return `single`;
   }
 
+  private useChellenge(challenge: string, expiresIn?: string): void {
+    const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
+    this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
+  }
+
+  private async checkIfChellengeNotUsed(challenge: string): Promise<boolean> {
+    const res = await this.options.passkeys.keyValueAdapter.get(challenge);
+    if (!res) {
+      return true;
+    }
+    return false;
+  }
+
+  private async validateCookiesForPasskeyLogin(cookies: any): Promise<{ok: boolean, decodedPasskeysCookies?: any, error?: string}> {
+    const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
+    if (!passkeysCookies) {
+      return { ok: false, error: 'Passkey token is required' };
+    }
+
+    const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+    const isChallangeValid = await this.checkIfChellengeNotUsed(decodedPasskeysCookies.challenge);
+    if (isChallangeValid) {
+      this.useChellenge(decodedPasskeysCookies.challenge, this.options.passkeys?.challengeValidityPeriod || '2m');
+    }
+
+    if (!decodedPasskeysCookies || !isChallangeValid) {
+      return { ok: false, error: 'Invalid passkey' };
+    }
+    return { ok: true, decodedPasskeysCookies };
+  }
 
   public async checkIfSkipSetupAllowSkipVerify(adminUser: AdminUser): Promise<{ skipAllowed: boolean }> {
     if (this.options.usersFilterToAllowSkipSetup) {
@@ -171,18 +201,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         return { error: "Wrong or expired OTP code" } 
       };
     } else if (confirmationResult.mode === "passkey") {
-      //TODO: fix ts-ignore after releasing new version of adminforth with updated types
-      //@ts-ignore
-      const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
-      if (!passkeysCookies) {
-        return { error: 'Passkey token is required' };
-      }
-
-      const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-      if (!decodedPasskeysCookies) {
-        return { error: 'Invalid passkey' };
+      const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+      if (!cookiesValidationResult.ok) {
+        return { error: cookiesValidationResult.error };
       }
-      const verificationResult = await this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies );
+      const verificationResult = await this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies );
 
       if (verificationResult.ok && verificationResult.passkeyConfirmed) {
 
@@ -340,6 +363,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         throw new Error('Passkeys credentialIdFieldName is required');
       }
 
+      if (!this.options.passkeys.keyValueAdapter) {
+        throw new Error('Passkeys keyValueAdapter is required');
+      }
+
       const credentialResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID); 
       const credentialIDField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialIdFieldName);
       if ( !credentialIDField ) {
@@ -529,15 +556,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           let verified = null;
           if (body.usePasskey && this.options.passkeys) {
             // passkeys are enabled and user wants to use them
-            const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
-            if (!passkeysCookies) {
-              return { error: 'Passkey token is required' };
+            const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+            if (!cookiesValidationResult.ok) {
+              return { error: cookiesValidationResult.error };
             }
-            const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-            if (!decodedPasskeysCookies) {
-              return { error: 'Invalid passkey' };
-            }
-            const res = await this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, decodedPasskeysCookies);
+            const res = await this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
             if (res.ok && res.passkeyConfirmed) {
               verified = true;
             }
@@ -572,14 +595,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           return { error: 'Passkey response is required' };
         }
 
-        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "passkeyLoginTemporaryJWT"});
-        if (!totpTemporaryJWT) {
-          return { error: 'Authentication session is expired. Please, try again' }
-        }
-
-        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
-        if (!decoded) {
-          return { error: 'Authentication session is expired. Please, try again' }
+        const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+        if (!cookiesValidationResult.ok) {
+          return { error: cookiesValidationResult.error };
         }
 
         let parsedPasskeyResponse;
@@ -612,7 +630,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           return { error: 'User not found' };
         }
 
-        const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+        const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
         if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
           return { error: 'Passkey verification failed' };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "2.10.11",
+  "version": "3.0.0",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/types.ts

@@ -1,4 +1,4 @@
-import { AdminUser } from "adminforth";
+import { AdminUser, KeyValueAdapter } from "adminforth";
 
 export type PluginOptions = {
 
@@ -33,6 +33,13 @@ export type PluginOptions = {
         credentialMetaFieldName: string,
         credentialUserIdFieldName: string,
 
+        
+        /**
+         * KeyValueAdapter is required to make sure that generated challenge can't be reused more than once
+         */
+        keyValueAdapter: KeyValueAdapter,
+
+
         /** 
          * Allow login with Passkeys even if 2FA is not set up. Default is true.
          */