@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/services/totpService.ts

@@ -0,0 +1,37 @@
+import type { AdminUser } from "adminforth";
+import twofactor from 'node-2fa';
+import type { PluginOptions } from "../types.js";
+import { UserRepository } from "../repositories/userRepository.js";
+
+export class TotpService {
+  constructor(
+    private readonly options: PluginOptions,
+    private readonly userRepository: UserRepository,
+  ) {}
+
+  public generateSecret(issuerName: string, userName: string): string {
+    return twofactor.generateSecret({ name: issuerName, account: userName }).secret;
+  }
+
+  public verifySecret(secret: string, code: string): boolean {
+    return Boolean(twofactor.verifyToken(secret, code, this.options.timeStepWindow));
+  }
+
+  public async verifyUserCode(userPk: string, code: string): Promise<{ ok: true } | { error: string }> {
+    const user = await this.userRepository.getAuthUser(userPk);
+    if (!user) return { error: "User not found" };
+
+    const secret = this.userRepository.getSecret(user);
+    if (!secret) return { error: "2FA is not set up for this user" };
+
+    return this.verifySecret(secret, code) ? { ok: true } : { error: "Wrong or expired OTP code" };
+  }
+
+  public async verifyAdminUserCode(adminUser: AdminUser, code: string): Promise<{ ok: true } | { error: string }> {
+    return this.verifyUserCode(this.userRepository.getUserPk(adminUser), code);
+  }
+
+  public async saveSecret(userPk: string, secret: string): Promise<void> {
+    await this.userRepository.updateSecret(userPk, secret);
+  }
+}

package/services/verifyMfaConfirmation.ts

@@ -0,0 +1,92 @@
+import type { AdminUser, HttpExtra, IAdminForthHttpResponse } from "adminforth";
+import type { CookieList } from "../utils/types.js";
+
+type TotpConfirmationResult = {
+  mode: "totp";
+  result: string;
+};
+
+type PasskeyConfirmationResult = {
+  mode: "passkey";
+  result: {
+    response: string;
+    origin: string;
+  };
+};
+
+type GraceConfirmationResult = {
+  mode?: undefined;
+};
+
+export type MfaConfirmationResult = TotpConfirmationResult | PasskeyConfirmationResult | GraceConfirmationResult;
+
+export type VerifyOptions = {
+  adminUser: AdminUser;
+  userPk: string;
+  cookies?: CookieList;
+  response?: IAdminForthHttpResponse;
+  extra?: HttpExtra;
+};
+
+export async function verifyMfaConfirmation(
+  ctx: any,
+  confirmationResult: MfaConfirmationResult,
+  opts: VerifyOptions,
+): Promise<{ ok: true } | { error: string }> {
+  if (!confirmationResult) return { error: "Confirmation result is required" };
+
+  const cookies = opts.extra?.cookies || opts.cookies;
+  const response = opts.extra?.response || opts.response;
+
+  if (ctx.options.usersFilterToApply) {
+    const res = ctx.options.usersFilterToApply(opts.adminUser);
+    if ( res === false ) {
+      return { ok: true };
+    }
+  }
+  if (ctx.options.usersFilterToAllowSkipSetup) {
+    const res = await ctx.checkIfSkipSetupAllowSkipVerify(opts.adminUser);
+    if ( res.skipAllowed === true ) {
+      return { ok: true };
+    }
+  }
+  if ( ctx.options.stepUpMfaGracePeriodSeconds && opts.extra?.headers && !confirmationResult.mode) {
+    const verificationResult = await ctx.cookieService.isMfaGraceValid(opts.extra.headers, cookies);
+    if ( verificationResult === true ) {
+      return { ok: true };
+    }
+  }
+  const mode = confirmationResult.mode;
+  if (!mode) {
+    return { error: "Unsupported confirmation mode" };
+  }
+
+  if (mode === "totp") {
+    const { result: code } = confirmationResult as TotpConfirmationResult;
+    const verificationResult = await ctx.totpService.verifyUserCode(opts.userPk, code);
+
+    if ( 'ok' in verificationResult && verificationResult.ok ) {
+      if (ctx.options.stepUpMfaGracePeriodSeconds) {
+        ctx.cookieService.issueMfaGrace({ headers: opts.extra?.headers, response }, cookies);
+      }
+      return { ok: true }
+    }
+    return verificationResult;
+  } else if (mode === "passkey") {
+    const { result } = confirmationResult as PasskeyConfirmationResult;
+    const cookiesValidationResult = await ctx.passkeyService.validateLoginChallengeCookie(cookies);
+    if (!cookiesValidationResult.ok) {
+      return { error: cookiesValidationResult.error };
+    }
+    const verificationResult = await ctx.passkeyService.verifyPasskeyResponse(result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies );
+
+    if (verificationResult.ok && verificationResult.passkeyConfirmed) {
+      if (ctx.options.stepUpMfaGracePeriodSeconds) {
+        ctx.cookieService.issueMfaGrace({ headers: opts.extra?.headers, response }, cookies);
+      }
+      return  { ok: true }
+    }
+    return { error: "Invalid passkey" }
+  }
+  return { error: "Unsupported confirmation mode" };
+}

package/tsconfig.json

@@ -50,7 +50,7 @@
     // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
 
     /* Emit */
-    // "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
+    "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
     // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
     // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
     // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */

package/utils/errors.ts

@@ -0,0 +1,13 @@
+import type { ErrorResponse } from "./types.js";
+
+export function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export function errorResult(message: string): ErrorResponse {
+  return { ok: false, error: message };
+}
+
+export function prefixedErrorResult(prefix: string, error: unknown): ErrorResponse {
+  return errorResult(`${prefix}${errorMessage(error)}`);
+}

package/utils/parsePeriod.ts

@@ -0,0 +1,19 @@
+const PERIOD_RE = /^(\d+)([dhms])$/;
+
+export function parsePeriod(period?: string): number {
+  if (!period) return 0;
+
+  const match = PERIOD_RE.exec(period.trim());
+  if (!match) throw new Error(`Invalid suggestionPeriod format: ${period}`);
+
+  const value = parseInt(match[1], 10);
+  const unit = match[2];
+
+  switch (unit) {
+    case 'd': return value * 24 * 60 * 60 * 1000;
+    case 'h': return value * 60 * 60 * 1000;
+    case 'm': return value * 60 * 1000;
+    case 's': return value * 1000;
+    default: return value;
+  }
+}

package/utils/types.ts

@@ -0,0 +1,17 @@
+import type { HttpExtra } from "adminforth";
+
+export type AnyRecord = Record<string, any>;
+export type CookieList = HttpExtra["cookies"];
+export type HttpHeaders = HttpExtra["headers"];
+
+export type ErrorResponse = {
+  ok: false;
+  code?: string;
+  error: string;
+};
+
+export type OkResponse<T extends AnyRecord = AnyRecord> = {
+  ok: true;
+} & T;
+
+export type PluginResponse<T extends AnyRecord = AnyRecord> = OkResponse<T> | ErrorResponse;