@adminforth/two-factors-auth 2.10.12 → 3.0.1

package/.woodpecker/release.yml

@@ -17,18 +17,18 @@ steps:
       - infisical export --domain https://vault.devforth.io/api --format=dotenv-export --env="prod" > /woodpecker/deploy.vault.env
 
   build:
-    image: node:20
+    image: devforth/node20-pnpm:latest
     when:
       - event: push
     commands:
       - apt update && apt install -y rsync
       - . /woodpecker/deploy.vault.env   
-      - npm clean-install
+      - pnpm install
       - /bin/bash ./.woodpecker/buildRelease.sh
       - npm audit signatures
 
   release:
-    image: node:20
+    image: devforth/node20-pnpm:latest
     when:
       - event:
           - push
@@ -36,7 +36,7 @@ steps:
           - main
     commands:
       - . /woodpecker/deploy.vault.env
-      - npx semantic-release
+      - pnpm exec semantic-release
 
   slack-on-failure:
     image: curlimages/curl

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthPlugin, Filters, suggestIfTypo } from "adminforth";
+import { AdminForthPlugin, Filters, suggestIfTypo, convertPeriodToSeconds } from "adminforth";
 import twofactor from 'node-2fa';
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
 import { isoUint8Array, isoBase64URL } from '@simplewebauthn/server/helpers';
@@ -22,6 +22,37 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `single`;
     }
+    useChellenge(challenge, expiresIn) {
+        const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
+        this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
+    }
+    checkIfChellengeNotUsed(challenge) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = yield this.options.passkeys.keyValueAdapter.get(challenge);
+            if (!res) {
+                return true;
+            }
+            return false;
+        });
+    }
+    validateCookiesForPasskeyLogin(cookies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
+            if (!passkeysCookies) {
+                return { ok: false, error: 'Passkey token is required' };
+            }
+            const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+            const isChallangeValid = yield this.checkIfChellengeNotUsed(decodedPasskeysCookies.challenge);
+            if (isChallangeValid) {
+                this.useChellenge(decodedPasskeysCookies.challenge, ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '2m');
+            }
+            if (!decodedPasskeysCookies || !isChallangeValid) {
+                return { ok: false, error: 'Invalid passkey' };
+            }
+            return { ok: true, decodedPasskeysCookies };
+        });
+    }
     checkIfSkipSetupAllowSkipVerify(adminUser) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.options.usersFilterToAllowSkipSetup) {
@@ -164,17 +195,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 ;
             }
             else if (confirmationResult.mode === "passkey") {
-                //TODO: fix ts-ignore after releasing new version of adminforth with updated types
-                //@ts-ignore
-                const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
-                if (!passkeysCookies) {
-                    return { error: 'Passkey token is required' };
-                }
-                const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-                if (!decodedPasskeysCookies) {
-                    return { error: 'Invalid passkey' };
+                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                if (!cookiesValidationResult.ok) {
+                    return { error: cookiesValidationResult.error };
                 }
-                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies);
+                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies);
                 if (verificationResult.ok && verificationResult.passkeyConfirmed) {
                     //* SET GRACE COOKIE *//
                     if (this.options.stepUpMfaGracePeriodSeconds) {
@@ -325,6 +350,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             if (!this.options.passkeys.credentialIdFieldName) {
                 throw new Error('Passkeys credentialIdFieldName is required');
             }
+            if (!this.options.passkeys.keyValueAdapter) {
+                throw new Error('Passkeys keyValueAdapter is required');
+            }
             const credentialResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
             const credentialIDField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialIdFieldName);
             if (!credentialIDField) {
@@ -490,15 +518,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                     let verified = null;
                     if (body.usePasskey && this.options.passkeys) {
                         // passkeys are enabled and user wants to use them
-                        const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
-                        if (!passkeysCookies) {
-                            return { error: 'Passkey token is required' };
-                        }
-                        const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-                        if (!decodedPasskeysCookies) {
-                            return { error: 'Invalid passkey' };
+                        const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                        if (!cookiesValidationResult.ok) {
+                            return { error: cookiesValidationResult.error };
                         }
-                        const res = yield this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, decodedPasskeysCookies);
+                        const res = yield this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
                         if (res.ok && res.passkeyConfirmed) {
                             verified = true;
                         }
@@ -533,13 +557,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 if (!passkeyResponse) {
                     return { error: 'Passkey response is required' };
                 }
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "passkeyLoginTemporaryJWT" });
-                if (!totpTemporaryJWT) {
-                    return { error: 'Authentication session is expired. Please, try again' };
-                }
-                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
-                if (!decoded) {
-                    return { error: 'Authentication session is expired. Please, try again' };
+                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
+                if (!cookiesValidationResult.ok) {
+                    return { error: cookiesValidationResult.error };
                 }
                 let parsedPasskeyResponse;
                 try {
@@ -568,7 +588,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 if (!user) {
                     return { error: 'User not found' };
                 }
-                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
                 if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
                     return { error: 'Passkey verification failed' };
                 }

package/index.ts

@@ -1,4 +1,4 @@
-import {  AdminForthPlugin, Filters, suggestIfTypo, HttpExtra } from "adminforth";
+import {  AdminForthPlugin, Filters, suggestIfTypo, HttpExtra, convertPeriodToSeconds } from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth, BeforeLoginConfirmationFunction, IAdminForthHttpResponse } from "adminforth";
 import twofactor from 'node-2fa';
 import  { PluginOptions } from "./types.js"
@@ -29,6 +29,36 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     return `single`;
   }
 
+  private useChellenge(challenge: string, expiresIn?: string): void {
+    const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
+    this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
+  }
+
+  private async checkIfChellengeNotUsed(challenge: string): Promise<boolean> {
+    const res = await this.options.passkeys.keyValueAdapter.get(challenge);
+    if (!res) {
+      return true;
+    }
+    return false;
+  }
+
+  private async validateCookiesForPasskeyLogin(cookies: any): Promise<{ok: boolean, decodedPasskeysCookies?: any, error?: string}> {
+    const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
+    if (!passkeysCookies) {
+      return { ok: false, error: 'Passkey token is required' };
+    }
+
+    const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+    const isChallangeValid = await this.checkIfChellengeNotUsed(decodedPasskeysCookies.challenge);
+    if (isChallangeValid) {
+      this.useChellenge(decodedPasskeysCookies.challenge, this.options.passkeys?.challengeValidityPeriod || '2m');
+    }
+
+    if (!decodedPasskeysCookies || !isChallangeValid) {
+      return { ok: false, error: 'Invalid passkey' };
+    }
+    return { ok: true, decodedPasskeysCookies };
+  }
 
   public async checkIfSkipSetupAllowSkipVerify(adminUser: AdminUser): Promise<{ skipAllowed: boolean }> {
     if (this.options.usersFilterToAllowSkipSetup) {
@@ -171,18 +201,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         return { error: "Wrong or expired OTP code" } 
       };
     } else if (confirmationResult.mode === "passkey") {
-      //TODO: fix ts-ignore after releasing new version of adminforth with updated types
-      //@ts-ignore
-      const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
-      if (!passkeysCookies) {
-        return { error: 'Passkey token is required' };
-      }
-
-      const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-      if (!decodedPasskeysCookies) {
-        return { error: 'Invalid passkey' };
+      const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+      if (!cookiesValidationResult.ok) {
+        return { error: cookiesValidationResult.error };
       }
-      const verificationResult = await this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies );
+      const verificationResult = await this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies );
 
       if (verificationResult.ok && verificationResult.passkeyConfirmed) {
 
@@ -340,6 +363,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         throw new Error('Passkeys credentialIdFieldName is required');
       }
 
+      if (!this.options.passkeys.keyValueAdapter) {
+        throw new Error('Passkeys keyValueAdapter is required');
+      }
+
       const credentialResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID); 
       const credentialIDField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialIdFieldName);
       if ( !credentialIDField ) {
@@ -529,15 +556,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           let verified = null;
           if (body.usePasskey && this.options.passkeys) {
             // passkeys are enabled and user wants to use them
-            const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyLoginTemporaryJWT`});
-            if (!passkeysCookies) {
-              return { error: 'Passkey token is required' };
+            const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+            if (!cookiesValidationResult.ok) {
+              return { error: cookiesValidationResult.error };
             }
-            const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-            if (!decodedPasskeysCookies) {
-              return { error: 'Invalid passkey' };
-            }
-            const res = await this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, decodedPasskeysCookies);
+            const res = await this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
             if (res.ok && res.passkeyConfirmed) {
               verified = true;
             }
@@ -572,14 +595,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           return { error: 'Passkey response is required' };
         }
 
-        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "passkeyLoginTemporaryJWT"});
-        if (!totpTemporaryJWT) {
-          return { error: 'Authentication session is expired. Please, try again' }
-        }
-
-        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
-        if (!decoded) {
-          return { error: 'Authentication session is expired. Please, try again' }
+        const cookiesValidationResult = await this.validateCookiesForPasskeyLogin(cookies);
+        if (!cookiesValidationResult.ok) {
+          return { error: cookiesValidationResult.error };
         }
 
         let parsedPasskeyResponse;
@@ -612,7 +630,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           return { error: 'User not found' };
         }
 
-        const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+        const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
         if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
           return { error: 'Passkey verification failed' };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "2.10.12",
+  "version": "3.0.1",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,6 @@
   },
   "type": "module",
   "scripts": {
-    "prepare": "npm link adminforth",
     "build": "tsc && rsync -av --exclude 'node_modules' custom dist/"
   },
   "keywords": [
@@ -29,7 +28,7 @@
     "node-2fa": "^2.0.3"
   },
   "peerDependencies": {
-    "adminforth": "next"
+    "adminforth": "^2.24.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.7",
@@ -46,6 +45,7 @@
       [
         "semantic-release-slack-bot",
         {
+          "packageName": "@adminforth/two-factors-auth",
           "notifyOnSuccess": true,
           "notifyOnFail": true,
           "slackIcon": ":package:",

package/types.ts

@@ -1,4 +1,4 @@
-import { AdminUser } from "adminforth";
+import { AdminUser, KeyValueAdapter } from "adminforth";
 
 export type PluginOptions = {
 
@@ -33,6 +33,13 @@ export type PluginOptions = {
         credentialMetaFieldName: string,
         credentialUserIdFieldName: string,
 
+        
+        /**
+         * KeyValueAdapter is required to make sure that generated challenge can't be reused more than once
+         */
+        keyValueAdapter: KeyValueAdapter,
+
+
         /** 
          * Allow login with Passkeys even if 2FA is not set up. Default is true.
          */