@adminforth/two-factors-auth 2.2.2 → 2.3.0

package/build.log

@@ -4,6 +4,7 @@
 
 sending incremental file list
 custom/
+custom/LoginWithPasskeyButton.vue
 custom/TwoFAModal.vue
 custom/TwoFactorsConfirmation.vue
 custom/TwoFactorsPasskeysSettings.vue
@@ -14,5 +15,5 @@ custom/package.json
 custom/tsconfig.json
 custom/utils.js
 
-sent 269,512 bytes  received 191 bytes  539,406.00 bytes/sec
-total size is 268,776  speedup is 1.00
+sent 271,266 bytes  received 210 bytes  542,952.00 bytes/sec
+total size is 270,439  speedup is 1.00

package/custom/LoginWithPasskeyButton.vue

@@ -0,0 +1,55 @@
+<template>
+
+    <Button
+        class="w-full !py-1"
+        @click="handleLoginWithPasskey"
+    >
+        <IconShieldOutline class="w-7 h-8" />
+        <span class="ml-2">Continue with Passkey</span>
+    </Button>
+
+</template>
+
+
+
+<script setup lang="ts">
+    import { IconShieldOutline } from '@iconify-prerendered/vue-flowbite';
+    import { getPasskey } from "./utils.js";
+    import { callAdminForthApi } from '@/utils';
+    import { useUserStore } from '@/stores/user';
+    import { Button } from '@/afcl';
+    import adminforth from '@/adminforth';
+    import { useRouter, useRoute } from 'vue-router';
+
+    const userStore = useUserStore();
+    const router = useRouter();
+
+    async function handleLoginWithPasskey() {
+      const passkeyOptions = await getPasskey();
+      try {
+        const resp = await callAdminForthApi({
+        method: 'POST',
+        path: '/plugin/twofa/confirmLoginWithPasskey',
+        body: {
+            passkeyResponse: passkeyOptions
+        }
+        });
+        if ( resp.error ) {
+            console.error("Login failed:", resp.error);
+            adminforth.alert({message: 'Error: ' + resp.error, variant: 'warning'});
+          return;
+        }
+
+        if ( resp.allowedLogin === true ) { 
+            await userStore.finishLogin();
+        } else if (resp.redirectTo) {
+          router.push(resp.redirectTo);
+        } else {
+          console.error("Login not allowed:", resp.error);
+          adminforth.alert({message: 'Error: ' + (resp.error || 'Login not allowed'), variant: 'warning'});
+        }
+      } catch (error) {
+        console.error("Error during passkey login:", error);
+      } 
+    }
+</script>

package/dist/custom/LoginWithPasskeyButton.vue

@@ -0,0 +1,55 @@
+<template>
+
+    <Button
+        class="w-full !py-1"
+        @click="handleLoginWithPasskey"
+    >
+        <IconShieldOutline class="w-7 h-8" />
+        <span class="ml-2">Continue with Passkey</span>
+    </Button>
+
+</template>
+
+
+
+<script setup lang="ts">
+    import { IconShieldOutline } from '@iconify-prerendered/vue-flowbite';
+    import { getPasskey } from "./utils.js";
+    import { callAdminForthApi } from '@/utils';
+    import { useUserStore } from '@/stores/user';
+    import { Button } from '@/afcl';
+    import adminforth from '@/adminforth';
+    import { useRouter, useRoute } from 'vue-router';
+
+    const userStore = useUserStore();
+    const router = useRouter();
+
+    async function handleLoginWithPasskey() {
+      const passkeyOptions = await getPasskey();
+      try {
+        const resp = await callAdminForthApi({
+        method: 'POST',
+        path: '/plugin/twofa/confirmLoginWithPasskey',
+        body: {
+            passkeyResponse: passkeyOptions
+        }
+        });
+        if ( resp.error ) {
+            console.error("Login failed:", resp.error);
+            adminforth.alert({message: 'Error: ' + resp.error, variant: 'warning'});
+          return;
+        }
+
+        if ( resp.allowedLogin === true ) { 
+            await userStore.finishLogin();
+        } else if (resp.redirectTo) {
+          router.push(resp.redirectTo);
+        } else {
+          console.error("Login not allowed:", resp.error);
+          adminforth.alert({message: 'Error: ' + (resp.error || 'Login not allowed'), variant: 'warning'});
+        }
+      } catch (error) {
+        console.error("Error during passkey login:", error);
+      } 
+    }
+</script>

package/dist/index.js

@@ -163,6 +163,13 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 slug: 'passkeys',
                 component: this.componentPath('TwoFactorsPasskeysSettings.vue'),
             });
+            if (this.options.passkeys.allowLoginWithPasskeys !== false) {
+                this.options.passkeys.allowLoginWithPasskeys = true;
+                if (!this.adminforth.config.customization.loginPageInjections) {
+                    this.adminforth.config.customization.loginPageInjections = { underInputs: [], panelHeader: [] };
+                }
+                this.adminforth.config.customization.loginPageInjections.underInputs.push({ file: this.componentPath('LoginWithPasskeyButton.vue'), meta: {} });
+            }
         }
     }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
@@ -248,7 +255,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         const beforeLoginConfirmation = this.adminforth.config.auth.beforeLoginConfirmation;
         const beforeLoginConfirmationArray = Array.isArray(beforeLoginConfirmation) ? beforeLoginConfirmation : [beforeLoginConfirmation];
         beforeLoginConfirmationArray.push((_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, response, extra }) {
-            var _b;
+            var _b, _c;
+            if (((_b = extra === null || extra === void 0 ? void 0 : extra.body) === null || _b === void 0 ? void 0 : _b.loginAllowedByPasskeyDirectSignIn) === true) {
+                return { body: { loginAllowed: true }, ok: true };
+            }
             const secret = adminUser.dbUser[this.options.twoFaSecretFieldName];
             const userName = adminUser.dbUser[adminforth.config.auth.usernameField];
             const brandName = adminforth.config.customization.brandName;
@@ -259,7 +269,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             const authResource = adminforth.config.resources.find((res) => res.resourceId === adminforth.config.auth.usersResourceId);
             const authPk = authResource.columns.find((col) => col.primaryKey).name;
             const userPk = adminUser.dbUser[authPk];
-            const rememberMe = ((_b = extra === null || extra === void 0 ? void 0 : extra.body) === null || _b === void 0 ? void 0 : _b.rememberMe) || false;
+            const rememberMe = ((_c = extra === null || extra === void 0 ? void 0 : extra.body) === null || _c === void 0 ? void 0 : _c.rememberMe) || false;
             const rememberMeDays = rememberMe ? adminforth.config.auth.rememberMeDays || 30 : 1;
             let newSecret = null;
             const userNeeds2FA = this.options.usersFilterToApply ? this.options.usersFilterToApply(adminUser) : true;
@@ -376,29 +386,107 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             })
         });
         server.endpoint({
-            method: "GET",
-            path: "/plugin/twofa/skip-allow",
+            method: 'POST',
+            path: `/plugin/twofa/confirmLoginWithPasskey`,
             noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({
-                    cookies,
-                    name: `2FaTemporaryJWT`,
-                });
-                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, "temp2FA");
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
+                if (this.options.passkeys.allowLoginWithPasskeys !== true) {
+                    return { error: 'Login with passkeys is not allowed' };
+                }
+                const passkeyResponse = body.passkeyResponse;
+                if (!passkeyResponse) {
+                    return { error: 'Passkey response is required' };
+                }
+                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "passkeyLoginTemporaryJWT" });
+                if (!totpTemporaryJWT) {
+                    return { error: 'Authentication session is expired. Please, try again' };
+                }
+                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
                 if (!decoded) {
-                    return { status: "error", message: "Invalid token" };
+                    return { error: 'Authentication session is expired. Please, try again' };
                 }
-                if (!decoded.newSecret) {
-                    return { status: "ok", skipAllowed: false };
+                let parsedPasskeyResponse;
+                try {
+                    parsedPasskeyResponse = JSON.parse(passkeyResponse.response);
                 }
-                else {
-                    return {
-                        status: "ok",
-                        skipAllowed: decoded.userCanSkipSetup,
-                    };
+                catch (e) {
+                    return { error: 'Malformed passkey response' };
                 }
-            }),
-        });
+                const credential_id = parsedPasskeyResponse.id;
+                if (!credential_id) {
+                    return { error: 'Credential ID is required' };
+                }
+                const passkeyRecord = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credential_id)]);
+                if (!passkeyRecord) {
+                    return { error: 'Passkey not found' };
+                }
+                const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
+                if (!userPk) {
+                    return { error: 'User ID not found in passkey record' };
+                }
+                const userResourceId = this.adminforth.config.auth.usersResourceId;
+                const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
+                const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
+                const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
+                const user = yield this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, userPk)]);
+                if (!user) {
+                    return { error: 'User not found' };
+                }
+                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+                if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
+                    return { error: 'Passkey verification failed' };
+                }
+                const username = user[this.adminforth.config.auth.usernameField];
+                const adminUser = {
+                    dbUser: user,
+                    pk: user.id,
+                    username,
+                };
+                const toReturn = { allowedLogin: true, error: '' };
+                yield this.adminforth.restApi.processLoginCallbacks(adminUser, toReturn, response, {
+                    headers,
+                    cookies,
+                    requestUrl,
+                    query,
+                    body: {
+                        loginAllowedByPasskeyDirectSignIn: true
+                    },
+                });
+                if (toReturn.allowedLogin === true) {
+                    this.adminforth.auth.setAuthCookie({
+                        response,
+                        username,
+                        pk: user.id,
+                        expireInDays: this.options.passkeys.rememberDaysAfterPasskeyLogin ? this.options.passkeys.rememberDaysAfterPasskeyLogin : this.adminforth.config.auth.rememberMeDays,
+                    });
+                }
+                return toReturn;
+            })
+        }),
+            server.endpoint({
+                method: "GET",
+                path: "/plugin/twofa/skip-allow",
+                noAuth: true,
+                handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
+                    const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({
+                        cookies,
+                        name: `2FaTemporaryJWT`,
+                    });
+                    const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, "temp2FA");
+                    if (!decoded) {
+                        return { status: "error", message: "Invalid token" };
+                    }
+                    if (!decoded.newSecret) {
+                        return { status: "ok", skipAllowed: false };
+                    }
+                    else {
+                        return {
+                            status: "ok",
+                            skipAllowed: decoded.userCanSkipSetup,
+                        };
+                    }
+                }),
+            });
         server.endpoint({
             method: 'POST',
             path: `/plugin/twofa/verify`,

package/index.ts

@@ -174,6 +174,14 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         slug: 'passkeys',
         component: this.componentPath('TwoFactorsPasskeysSettings.vue'),
       });
+
+      if ( this.options.passkeys.allowLoginWithPasskeys !== false ) {
+        this.options.passkeys.allowLoginWithPasskeys = true;
+        if ( !this.adminforth.config.customization.loginPageInjections ) {
+          this.adminforth.config.customization.loginPageInjections = { underInputs: [],  panelHeader: [] };
+        }
+        this.adminforth.config.customization.loginPageInjections.underInputs.push({ file: this.componentPath('LoginWithPasskeyButton.vue'), meta: {} });
+      }
     }
   }
 
@@ -281,6 +289,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     const beforeLoginConfirmationArray = Array.isArray(beforeLoginConfirmation) ? beforeLoginConfirmation : [beforeLoginConfirmation];
     beforeLoginConfirmationArray.push(
       async({ adminUser, response, extra }: { adminUser: AdminUser, response: IAdminForthHttpResponse, extra?: any} )=> {
+        if (extra?.body?.loginAllowedByPasskeyDirectSignIn === true) {
+          return { body: { loginAllowed: true }, ok: true };
+        }
         const secret = adminUser.dbUser[this.options.twoFaSecretFieldName]
         const userName = adminUser.dbUser[adminforth.config.auth.usernameField]
         const brandName = adminforth.config.customization.brandName;
@@ -299,7 +310,6 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         if (!userNeeds2FA){
           return { body:{loginAllowed: true}, ok: true}
         }
-
         const userCanSkipSetup = this.options.usersFilterToAllowSkipSetup ? this.options.usersFilterToAllowSkipSetup(adminUser) : false;
 
         if (!secret){
@@ -413,6 +423,95 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         }
       }
     })
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/twofa/confirmLoginWithPasskey`,
+      noAuth: true,
+      handler: async ({ body, response, cookies, headers, requestUrl, query }) => {
+        if ( this.options.passkeys.allowLoginWithPasskeys !== true ) {
+          return { error: 'Login with passkeys is not allowed' };
+        }
+
+        const passkeyResponse = body.passkeyResponse;
+        if (!passkeyResponse) {
+          return { error: 'Passkey response is required' };
+        }
+
+        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "passkeyLoginTemporaryJWT"});
+        if (!totpTemporaryJWT) {
+          return { error: 'Authentication session is expired. Please, try again' }
+        }
+
+        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'tempLoginPasskeyChallenge', false);
+        if (!decoded) {
+          return { error: 'Authentication session is expired. Please, try again' }
+        }
+
+        let parsedPasskeyResponse;
+        try {
+          parsedPasskeyResponse = JSON.parse(passkeyResponse.response);
+        } catch (e) {
+          return { error: 'Malformed passkey response' };
+        }
+        const credential_id = parsedPasskeyResponse.id;
+        if (!credential_id) {
+          return { error: 'Credential ID is required' };
+        }
+
+        const passkeyRecord = await this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credential_id)]);
+        if (!passkeyRecord) {
+          return { error: 'Passkey not found' };
+        }
+
+        const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
+        if (!userPk) {
+          return { error: 'User ID not found in passkey record' };
+        }
+
+        const userResourceId = this.adminforth.config.auth.usersResourceId;
+        const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
+        const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
+        const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
+        const user = await this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, userPk)]);
+        if (!user) {
+          return { error: 'User not found' };
+        }
+
+        const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, decoded);
+        if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
+          return { error: 'Passkey verification failed' };
+        }
+        const username = user[this.adminforth.config.auth.usernameField];
+
+        const adminUser = { 
+          dbUser: user,
+          pk: user.id,
+          username,
+        };
+        
+        const toReturn = { allowedLogin: true, error: '' };
+
+        await this.adminforth.restApi.processLoginCallbacks(adminUser, toReturn, response, {
+          headers,
+          cookies,
+          requestUrl,
+          query,
+          body: {
+            loginAllowedByPasskeyDirectSignIn: true
+          },
+        });
+
+        if ( toReturn.allowedLogin === true ) {
+          this.adminforth.auth.setAuthCookie({
+            response,
+            username,
+            pk: user.id,
+            expireInDays: this.options.passkeys.rememberDaysAfterPasskeyLogin ? this.options.passkeys.rememberDaysAfterPasskeyLogin : this.adminforth.config.auth.rememberMeDays,
+          });
+        }
+        return toReturn;
+      }
+    }),
     server.endpoint({
       method: "GET",
       path: "/plugin/twofa/skip-allow",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/types.ts

@@ -26,6 +26,16 @@ export type PluginOptions = {
         credentialIdFieldName: string,
         credentialMetaFieldName: string,
         credentialUserIdFieldName: string,
+
+        /** 
+         * Allow login with Passkeys even if 2FA is not set up. Default is true.
+         */
+        allowLoginWithPasskeys?: boolean;
+
+        /**
+         * Remember user for number of days after login with Passkey, so that user won't be challenged with 2FA on every login.
+         */
+        rememberDaysAfterPasskeyLogin?: number;
         /**
          *  Period between showing alert suggesting to set up Passkeys if not set up yet.
          */