@adminforth/two-factors-auth 3.1.3 → 3.1.4

package/build.log

@@ -16,5 +16,5 @@ custom/pnpm-lock.yaml
 custom/tsconfig.json
 custom/utils.js
 
-sent 283,319 bytes  received 229 bytes  567,096.00 bytes/sec
-total size is 282,425  speedup is 1.00
+sent 283,900 bytes  received 229 bytes  568,258.00 bytes/sec
+total size is 282,994  speedup is 1.00

package/custom/TwoFAModal.vue

@@ -102,29 +102,47 @@
 
   const { alert } = useAdminforth();
 
-  let isAwaiting2FAResult = false;
+  const isAwaiting2FAResult = ref(false);
+  let allowAddNewSessions = true;
+  const ALLOW_NEW_SESSIONS_PERIOD = 1000;
   const sessionsIdsToResolve = ref<string[]>([]);
+
+  watch(isAwaiting2FAResult, (awaiting) => {
+    if (awaiting) {
+      allowAddNewSessions = true;
+      setTimeout(() => {
+        if (isAwaiting2FAResult.value) {
+          allowAddNewSessions = false;
+        }
+      }, ALLOW_NEW_SESSIONS_PERIOD);
+    }
+  });
+  
   watch( props, () => {
     if (props.adminUser) {
       websocket.unsubscribeByPrefix(`/user2fa/`);
       websocket.subscribe(`/user2fa/${props.adminUser.pk}`, async (data: {sessionId: string}) => {
+        if (!allowAddNewSessions) {
+          alert({message: 'Some process or user tries to add new actions to confirm. Action was blocked', variant: 'warning'});
+          return;
+        }
         sessionsIdsToResolve.value.push(data.sessionId);
         let confirmationResult;
-        if (isAwaiting2FAResult) {
+        if (isAwaiting2FAResult.value) {
           return;
         }
         try {
-          isAwaiting2FAResult = true;
+          isAwaiting2FAResult.value = true;
           confirmationResult = await window.adminforthTwoFaModal.get2FaConfirmationResult();
         } catch (error) {
           console.error('Error during 2FA confirmation:', error);
         }
-        isAwaiting2FAResult = false;
+        isAwaiting2FAResult.value = false;
         try {
           const response = await callAdminForthApi({
             method: "POST",
             path: "/plugin/passkeys/resolveVerifyAuto",
-            body: { confirmationResult, sessionId: data.sessionId, sessionsIds: sessionsIdsToResolve.value }
+            body: { confirmationResult, sessionsIds: sessionsIdsToResolve.value }
           });
           if (!response.ok && response.error === 'No session ID or confirmation result'){
             alert({message: 'Verification session finished or cancelled.', variant: 'warning'});
@@ -137,6 +155,7 @@
         } catch (error) {
           console.error('Error resolving automatic 2FA verification:', error);
         }
+        allowAddNewSessions = true;
       });
       websocket.subscribe(`/user2fa/${props.adminUser.pk}-resolve`, async (data: {sessionId: string}) => {
         if (sessionsIdsToResolve.value.includes(data.sessionId) && rejectFn && modelShow.value) {

package/dist/custom/TwoFAModal.vue

@@ -102,29 +102,47 @@
 
   const { alert } = useAdminforth();
 
-  let isAwaiting2FAResult = false;
+  const isAwaiting2FAResult = ref(false);
+  let allowAddNewSessions = true;
+  const ALLOW_NEW_SESSIONS_PERIOD = 1000;
   const sessionsIdsToResolve = ref<string[]>([]);
+
+  watch(isAwaiting2FAResult, (awaiting) => {
+    if (awaiting) {
+      allowAddNewSessions = true;
+      setTimeout(() => {
+        if (isAwaiting2FAResult.value) {
+          allowAddNewSessions = false;
+        }
+      }, ALLOW_NEW_SESSIONS_PERIOD);
+    }
+  });
+  
   watch( props, () => {
     if (props.adminUser) {
       websocket.unsubscribeByPrefix(`/user2fa/`);
       websocket.subscribe(`/user2fa/${props.adminUser.pk}`, async (data: {sessionId: string}) => {
+        if (!allowAddNewSessions) {
+          alert({message: 'Some process or user tries to add new actions to confirm. Action was blocked', variant: 'warning'});
+          return;
+        }
         sessionsIdsToResolve.value.push(data.sessionId);
         let confirmationResult;
-        if (isAwaiting2FAResult) {
+        if (isAwaiting2FAResult.value) {
           return;
         }
         try {
-          isAwaiting2FAResult = true;
+          isAwaiting2FAResult.value = true;
           confirmationResult = await window.adminforthTwoFaModal.get2FaConfirmationResult();
         } catch (error) {
           console.error('Error during 2FA confirmation:', error);
         }
-        isAwaiting2FAResult = false;
+        isAwaiting2FAResult.value = false;
         try {
           const response = await callAdminForthApi({
             method: "POST",
             path: "/plugin/passkeys/resolveVerifyAuto",
-            body: { confirmationResult, sessionId: data.sessionId, sessionsIds: sessionsIdsToResolve.value }
+            body: { confirmationResult, sessionsIds: sessionsIdsToResolve.value }
           });
           if (!response.ok && response.error === 'No session ID or confirmation result'){
             alert({message: 'Verification session finished or cancelled.', variant: 'warning'});
@@ -137,6 +155,7 @@
         } catch (error) {
           console.error('Error resolving automatic 2FA verification:', error);
         }
+        allowAddNewSessions = true;
       });
       websocket.subscribe(`/user2fa/${props.adminUser.pk}-resolve`, async (data: {sessionId: string}) => {
         if (sessionsIdsToResolve.value.includes(data.sessionId) && rejectFn && modelShow.value) {

package/dist/index.js

@@ -149,9 +149,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     verifyAuto(adminUser) {
         return __awaiter(this, void 0, void 0, function* () {
             const sessionId = crypto.randomUUID();
-            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}`, { sessionId });
-            const result = yield this.waitForResponse(sessionId);
-            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}-resolve`, { sessionId });
+            const jwt = this.adminforth.auth.issueJWT({ sessionId, adminUserPk: adminUser.pk }, 'auto2FA', '5m');
+            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}`, { sessionId: jwt });
+            const result = yield this.waitForResponse(jwt);
+            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}-resolve`, { sessionId: jwt });
             return result;
         });
     }
@@ -1019,15 +1020,26 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             path: `/plugin/passkeys/resolveVerifyAuto`,
             noAuth: false,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
-                const sessionId = body === null || body === void 0 ? void 0 : body.sessionId;
                 const sessionsIds = body === null || body === void 0 ? void 0 : body.sessionsIds;
                 const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
-                const idsToResolve = sessionsIds && Array.isArray(sessionsIds) ? sessionsIds : [sessionId];
-                if (!(sessionId || sessionsIds) || !confirmationResult) {
+                const idsToResolve = sessionsIds;
+                const resolveAllIdsAsFailed = (message) => {
                     for (const id of idsToResolve) {
-                        this.resolveResponse(id, { ok: false, error: 'No session ID or confirmation result' });
+                        this.resolveResponse(id, { ok: false, error: message });
+                    }
+                    return { ok: false, error: message };
+                };
+                if (!(sessionsIds) || !confirmationResult) {
+                    resolveAllIdsAsFailed('Confirmation window was closed or did not return required data');
+                }
+                for (const id of idsToResolve) {
+                    const validationResult = yield this.adminforth.auth.verify(id, 'auto2FA', false);
+                    if (!validationResult) {
+                        resolveAllIdsAsFailed('Invalid session ID or confirmation result');
+                    }
+                    if (validationResult.adminUserPk !== adminUser.pk) {
+                        resolveAllIdsAsFailed('Session does not belong to the authenticated user');
                     }
-                    return { ok: false, error: 'No session ID or confirmation result' };
                 }
                 const verificationResult = yield this.verify(confirmationResult, {
                     adminUser: adminUser,
@@ -1039,10 +1051,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                     }
                 });
                 if (!verificationResult || !('ok' in verificationResult)) {
-                    for (const id of idsToResolve) {
-                        this.resolveResponse(id, { ok: false, error: 'Verification failed' });
-                    }
-                    return { ok: false, error: 'Verification failed' };
+                    resolveAllIdsAsFailed('Verification failed');
                 }
                 for (const id of idsToResolve) {
                     this.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });

package/index.ts

@@ -159,9 +159,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
 
   public async verifyAuto(adminUser: AdminUser) {
     const sessionId = crypto.randomUUID();
-    this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}`, { sessionId });
-    const result = await this.waitForResponse(sessionId);
-    this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}-resolve`, { sessionId });
+    const jwt = this.adminforth.auth.issueJWT({sessionId, adminUserPk: adminUser.pk}, 'auto2FA', '5m');
+    this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}`, { sessionId: jwt });
+    const result = await this.waitForResponse(jwt);
+    this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}-resolve`, { sessionId: jwt });
     return result;
   }
 
@@ -1080,16 +1081,31 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       path: `/plugin/passkeys/resolveVerifyAuto`,
       noAuth: false,
       handler: async ({ body, adminUser, response, cookies, headers }) => {
-        const sessionId = body?.sessionId;
         const sessionsIds = body?.sessionsIds;
         const confirmationResult = body?.confirmationResult;
-        const idsToResolve = sessionsIds && Array.isArray(sessionsIds) ? sessionsIds : [sessionId];
-        if (!(sessionId || sessionsIds) || !confirmationResult) {
+        const idsToResolve = sessionsIds;
+
+        const resolveAllIdsAsFailed = (message) => {
           for (const id of idsToResolve) {
-            this.resolveResponse(id, { ok: false, error: 'No session ID or confirmation result' });
+            this.resolveResponse(id, { ok: false, error: message });
           }
-          return { ok: false, error: 'No session ID or confirmation result' };
+          return { ok: false, error: message };
+        }
+
+        if (!(sessionsIds) || !confirmationResult) {
+          resolveAllIdsAsFailed('Confirmation window was closed or did not return required data');
         }
+
+        for (const id of idsToResolve) {
+          const validationResult = await this.adminforth.auth.verify(id, 'auto2FA', false);
+          if (!validationResult) {
+            resolveAllIdsAsFailed('Invalid session ID or confirmation result');
+          }
+          if (validationResult.adminUserPk !== adminUser.pk) {
+            resolveAllIdsAsFailed('Session does not belong to the authenticated user');
+          }
+        }
+
         const verificationResult = await this.verify(confirmationResult, {
           adminUser: adminUser,
           userPk: adminUser.pk, 
@@ -1100,11 +1116,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
           } as HttpExtra
         });
         if ( !verificationResult || !('ok' in verificationResult) ) {
-          for (const id of idsToResolve) {
-            this.resolveResponse(id, { ok: false, error: 'Verification failed' });
-          }
-          return { ok: false, error: 'Verification failed' };
+          resolveAllIdsAsFailed('Verification failed');
         }
+
         for (const id of idsToResolve) {
           this.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "3.1.3",
+  "version": "3.1.4",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",