@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/dist/utils/parsePeriod.js

@@ -0,0 +1,17 @@
+const PERIOD_RE = /^(\d+)([dhms])$/;
+export function parsePeriod(period) {
+    if (!period)
+        return 0;
+    const match = PERIOD_RE.exec(period.trim());
+    if (!match)
+        throw new Error(`Invalid suggestionPeriod format: ${period}`);
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    switch (unit) {
+        case 'd': return value * 24 * 60 * 60 * 1000;
+        case 'h': return value * 60 * 60 * 1000;
+        case 'm': return value * 60 * 1000;
+        case 's': return value * 1000;
+        default: return value;
+    }
+}

package/dist/utils/types.d.ts

@@ -0,0 +1,13 @@
+import type { HttpExtra } from "adminforth";
+export type AnyRecord = Record<string, any>;
+export type CookieList = HttpExtra["cookies"];
+export type HttpHeaders = HttpExtra["headers"];
+export type ErrorResponse = {
+    ok: false;
+    code?: string;
+    error: string;
+};
+export type OkResponse<T extends AnyRecord = AnyRecord> = {
+    ok: true;
+} & T;
+export type PluginResponse<T extends AnyRecord = AnyRecord> = OkResponse<T> | ErrorResponse;

package/dist/utils/types.js

@@ -0,0 +1 @@
+export {};

package/endpoints/registerPasskeyEndpoints.ts

@@ -0,0 +1,61 @@
+import type { IHttpServer } from "adminforth";
+
+export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): void {
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/registrationOptions`,
+    noAuth: false,
+    handler: async ({ body, adminUser, response, cookies, headers }) =>
+      handlers.createRegistrationOptions({ body, adminUser, response, cookies, headers }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/finishRegistration`,
+    noAuth: false,
+    handler: async ({ body, adminUser, cookies }) => handlers.finishRegistration({ body, adminUser, cookies }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/loginOptions`,
+    noAuth: true,
+    handler: async ({ response }) => handlers.createLoginOptions({ response }),
+  });
+
+  server.endpoint({
+    method: 'GET',
+    path: `/plugin/passkeys/getPasskeys`,
+    noAuth: false,
+    handler: async ({ adminUser }) => handlers.getPasskeys({ adminUser }),
+  });
+
+  server.endpoint({
+    method: 'DELETE',
+    path: `/plugin/passkeys/deletePasskey`,
+    noAuth: false,
+    handler: async ({ body, adminUser }) => handlers.deletePasskey({ body, adminUser }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/renamePasskey`,
+    noAuth: false,
+    handler: async ({ body, adminUser }) => handlers.renamePasskey({ body, adminUser }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/checkIfUserHasPasskeys`,
+    noAuth: true,
+    handler: async ({ cookies }) => handlers.checkIfUserHasPasskeys({ cookies }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/passkeys/resolveVerifyAuto`,
+    noAuth: false,
+    handler: async ({ body, adminUser, response, cookies, headers }) =>
+      handlers.resolveVerifyAuto({ body, adminUser, response, cookies, headers }),
+  });
+}

package/endpoints/registerTwoFaEndpoints.ts

@@ -0,0 +1,45 @@
+import type { IHttpServer } from "adminforth";
+
+export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void {
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/twofa/initSetup`,
+    noAuth: true,
+    handler: async ({ cookies }) => handlers.initSetup({ cookies }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/twofa/confirmLogin`,
+    noAuth: true,
+    handler: async ({ body, response, cookies }) => handlers.confirmLogin({ body, response, cookies }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/twofa/confirmLoginWithPasskey`,
+    noAuth: true,
+    handler: async ({ body, response, cookies, headers, requestUrl, query }) =>
+      handlers.confirmLoginWithPasskey({ body, response, cookies, headers, requestUrl, query }),
+  });
+
+  server.endpoint({
+    method: "GET",
+    path: "/plugin/twofa/skip-allow",
+    noAuth: true,
+    handler: async ({ cookies }) => handlers.skipAllow({ cookies }),
+  });
+
+  server.endpoint({
+    method: "GET",
+    path: "/plugin/twofa/skip-allow-modal",
+    handler: async ({ adminUser, headers, cookies }) => handlers.skipAllowModal({ adminUser, headers, cookies }),
+  });
+
+  server.endpoint({
+    method: 'POST',
+    path: `/plugin/twofa/verify`,
+    noAuth: false,
+    handler: async ({ adminUser, body }) => handlers.verifyTotp({ adminUser, body }),
+  });
+}

package/handlers/createPasskeyHandlers.ts

@@ -0,0 +1,103 @@
+import type { HttpExtra } from "adminforth";
+import { errorMessage } from "../utils/errors.js";
+
+export function createPasskeyHandlers(ctx: any) {
+  return {
+    createRegistrationOptions: async ({ body, adminUser, response, cookies, headers }) => {
+      const mode = body?.mode;
+
+      const confirmationResult = body?.confirmationResult;
+      const verificationResult = await ctx.verifyMfaConfirmation(confirmationResult, {
+        adminUser: adminUser,
+        userPk: adminUser.pk,
+        cookies: cookies,
+        response: response,
+        extra: {
+          headers,
+        } as HttpExtra
+      });
+      if (!verificationResult || !('ok' in verificationResult)) {
+        return { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' };
+      }
+
+      return ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+    },
+
+    finishRegistration: async ({ body, adminUser, cookies }) => {
+      return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+    },
+
+    createLoginOptions: async ({ response }) => {
+      return ctx.passkeyService.createLoginOptions(response);
+    },
+
+    getPasskeys: async ({ adminUser }) => {
+      return ctx.passkeyService.getPasskeys(adminUser);
+    },
+
+    deletePasskey: async ({ body, adminUser }) => {
+      return ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+    },
+
+    renamePasskey: async ({ body, adminUser }) => {
+      return ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+    },
+
+    checkIfUserHasPasskeys: async ({ cookies }) => {
+      return ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+    },
+
+    resolveVerifyAuto: async ({ body, adminUser, response, cookies, headers }) => {
+      const sessionsIds = body?.sessionsIds;
+      const confirmationResult = body?.confirmationResult;
+      const idsToResolve = Array.isArray(sessionsIds) ? sessionsIds : [];
+
+      const resolveAllIdsAsFailed = (message, code?: string) => {
+        const payload = code ? { ok: false, code, error: message } : { ok: false, error: message };
+        for (const id of idsToResolve) {
+          ctx.autoVerify.resolveResponse(id, payload);
+        }
+        return payload;
+      }
+
+      try {
+        if (!idsToResolve.length || !confirmationResult) {
+          return(resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'));
+        }
+
+        for (const id of idsToResolve) {
+          const validationResult = await ctx.adminforth.auth.verify(id, 'auto2FA', false);
+          if (!validationResult) {
+            return(resolveAllIdsAsFailed('Invalid session ID or confirmation result'));
+          }
+          if (validationResult.adminUserPk !== adminUser.pk) {
+            return(resolveAllIdsAsFailed('Session does not belong to the authenticated user'));
+          }
+        }
+
+        const verificationResult = await ctx.verifyMfaConfirmation(confirmationResult, {
+          adminUser: adminUser,
+          userPk: adminUser.pk,
+          cookies: cookies,
+          response: response,
+          extra: {
+            headers: headers,
+          } as HttpExtra
+        });
+        if ( !verificationResult || !('ok' in verificationResult) ) {
+          return(resolveAllIdsAsFailed(verificationResult?.error ?? 'Verification failed'));
+        }
+        if ('ok' in verificationResult && verificationResult.ok){
+          for (const id of idsToResolve) {
+            ctx.autoVerify.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
+          }
+          return { ok: true };
+        }
+        return(resolveAllIdsAsFailed('Verification failed'));
+      } catch (error) {
+        console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
+        return(resolveAllIdsAsFailed(errorMessage(error)));
+      }
+    },
+  };
+}

package/handlers/createTwoFaHandlers.ts

@@ -0,0 +1,172 @@
+export function createTwoFaHandlers(ctx: any) {
+  return {
+    initSetup: async ({ cookies }) => {
+      const toReturn = {totpJWT:null,status:'ok',}
+      const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
+      if (totpTemporaryJWT){
+        toReturn.totpJWT = totpTemporaryJWT
+      }
+      return toReturn
+    },
+
+    confirmLogin: async ({ body, response, cookies }) => {
+      const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
+      if (!totpTemporaryJWT) {
+        return { error: 'Login session expired. Please log in again.' }
+      }
+      const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
+      if (!decoded) {
+        return { error: 'Login session expired. Please log in again.' }
+      }
+
+      if (decoded.newSecret) {
+        const verified = body.skip && decoded.userCanSkipSetup ? true : ctx.totpService.verifySecret(decoded.newSecret, body.code);
+        if (verified) {
+          if (!body.skip) {
+            await ctx.totpService.saveSecret(decoded.pk, decoded.newSecret);
+          }
+          ctx.cookieService.removeTotpTemporary(response)
+          ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
+          return { status: 'ok', allowedLogin: true }
+        } else {
+          return {error: 'Wrong or expired OTP code'}
+        }
+      }
+
+      let verified = false;
+      let verificationError = 'Wrong or expired OTP code';
+      if (body.usePasskey && ctx.options.passkeys) {
+        const cookiesValidationResult = await ctx.passkeyService.validateLoginChallengeCookie(cookies);
+        if (!cookiesValidationResult.ok) {
+          return { error: cookiesValidationResult.error };
+        }
+        const res = await ctx.passkeyService.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
+        if (res.ok && res.passkeyConfirmed) {
+          verified = true;
+        } else {
+          verificationError = res.error ?? 'Invalid passkey';
+        }
+      } else {
+        const verificationResult = await ctx.totpService.verifyUserCode(decoded.pk, body.code);
+        verified = 'ok' in verificationResult && verificationResult.ok;
+        if (!verified) {
+          verificationError = verificationResult.error ?? verificationError;
+        }
+      }
+      if (verified) {
+        ctx.cookieService.removeTotpTemporary(response)
+        ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
+        return { status: 'ok', allowedLogin: true }
+      } else {
+        return {error: verificationError}
+      }
+    },
+
+    confirmLoginWithPasskey: async ({ body, response, cookies, headers, requestUrl, query }) => {
+      if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
+        return { error: 'Login with passkeys is not allowed' };
+      }
+
+      const passkeyResponse = body.passkeyResponse;
+      if (!passkeyResponse) {
+        return { error: 'Passkey response is required' };
+      }
+
+      const passkeyLoginResult = await ctx.passkeyService.getLoginUserByPasskeyResponse(passkeyResponse, cookies);
+      if (!passkeyLoginResult.ok) {
+        return { error: passkeyLoginResult.error };
+      }
+      const user = passkeyLoginResult.user;
+      const username = user[ctx.adminforth.config.auth.usernameField];
+      const userPk = user[ctx.userRepository.getUserPkField()];
+
+      const adminUser = {
+        dbUser: user,
+        pk: userPk,
+        username,
+      };
+
+      const toReturn = { allowedLogin: true, error: '' };
+      const rememberMe = body?.rememberMe || false;
+      const rememberDaysAfterPasskeyLogin = ctx.options.passkeys.rememberDaysAfterPasskeyLogin
+        ? ctx.options.passkeys.rememberDaysAfterPasskeyLogin.toString().concat('d')
+        : null;
+      const expireInDuration = rememberMe
+        ? (rememberDaysAfterPasskeyLogin ?? ctx.adminforth.config.auth.rememberMeDuration ?? '30d')
+        : '1d';
+
+      await ctx.adminforth.restApi.processLoginCallbacks(
+        adminUser,
+        toReturn,
+        response,
+        {
+          headers,
+          cookies,
+          requestUrl,
+          query,
+          body: {},
+          response,
+          meta: {
+            loginAllowedByPasskeyDirectSignIn: true
+          },
+        },
+        expireInDuration,
+      );
+
+      if ( toReturn.allowedLogin === true ) {
+        ctx.cookieService.setAuthCookie({
+          response,
+          username,
+          pk: userPk,
+          expireInDuration,
+        });
+      }
+      return toReturn;
+    },
+
+    skipAllow: async ({ cookies }) => {
+      const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
+      if (!decoded) {
+        return { status: "error", message: "Invalid token" };
+      }
+      if (!decoded.newSecret) {
+        return { status: "ok", skipAllowed: false };
+      } else {
+        return {
+          status: "ok",
+          skipAllowed: decoded.userCanSkipSetup,
+        };
+      }
+    },
+
+    skipAllowModal: async ({ adminUser, headers, cookies }) => {
+      if ( ctx.options.usersFilterToApply ) {
+        const res = ctx.options.usersFilterToApply(adminUser);
+        if ( res === false ) {
+          return { skipAllowed: true };
+        }
+      }
+      if ( ctx.options.usersFilterToAllowSkipSetup ) {
+        const res = await ctx.checkIfSkipSetupAllowSkipVerify(adminUser);
+        if ( res.skipAllowed === true ) {
+          return { skipAllowed: true };
+        }
+      }
+
+      if ( ctx.options.stepUpMfaGracePeriodSeconds ) {
+        const verificationResult = await ctx.cookieService.isMfaGraceValid(headers, cookies, true);
+        if ( verificationResult === true ) {
+          return { skipAllowed: true };
+        }
+      }
+
+      return { skipAllowed: false };
+    },
+
+    verifyTotp: async ({ adminUser, body }) => {
+      if (!body?.code) return { error: 'Code is required' };
+
+      return ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+    },
+  };
+}