@adminforth/two-factors-auth 4.1.4 → 4.2.0

package/build.log

@@ -17,5 +17,5 @@ custom/tsconfig.json
 custom/use2faApi.ts
 custom/utils.js
 
-sent 288,092 bytes  received 248 bytes  576,680.00 bytes/sec
-total size is 287,109  speedup is 1.00
+sent 288,176 bytes  received 248 bytes  576,848.00 bytes/sec
+total size is 287,203  speedup is 1.00

package/custom/TwoFactorsConfirmation.vue

@@ -361,8 +361,9 @@
     if (response.ok === true) {
       return { _options: response.data, challengeId: response.challengeId };
     } else {
-      adminforth.alert({message: t('Error creating sign-in request.'), variant: 'danger'});
-      codeError.value = 'Error creating sign-in request.';
+      const message = response.error || t('Error creating sign-in request.');
+      adminforth.alert({message, variant: 'danger'});
+      codeError.value = message;
     }
   }
 

package/custom/utils.js

@@ -57,7 +57,11 @@
     }
 
     export async function getPasskey() {
-    const { _options } = await createLoginOptions();
+    const signIn = await createLoginOptions();
+    if (!signIn) {
+      return;
+    }
+    const { _options } = signIn;
     let options;
     try {
       options = PublicKeyCredential.parseRequestOptionsFromJSON(_options);
@@ -93,8 +97,9 @@
     if (response.ok === true) {
       return { _options: response.data, challengeId: response.challengeId };
     } else {
-      adminforth.alert({message: 'Error creating sign-in request.', variant: 'warning'});
-      codeError.value = 'Error creating sign-in request.';
+      const message = response.error || 'Error creating sign-in request.';
+      adminforth.alert({message, variant: 'warning'});
+      codeError.value = message;
     }
   }
 

package/dist/custom/TwoFactorsConfirmation.vue

@@ -361,8 +361,9 @@
     if (response.ok === true) {
       return { _options: response.data, challengeId: response.challengeId };
     } else {
-      adminforth.alert({message: t('Error creating sign-in request.'), variant: 'danger'});
-      codeError.value = 'Error creating sign-in request.';
+      const message = response.error || t('Error creating sign-in request.');
+      adminforth.alert({message, variant: 'danger'});
+      codeError.value = message;
     }
   }
 

package/dist/custom/utils.js

@@ -57,7 +57,11 @@
     }
 
     export async function getPasskey() {
-    const { _options } = await createLoginOptions();
+    const signIn = await createLoginOptions();
+    if (!signIn) {
+      return;
+    }
+    const { _options } = signIn;
     let options;
     try {
       options = PublicKeyCredential.parseRequestOptionsFromJSON(_options);
@@ -93,8 +97,9 @@
     if (response.ok === true) {
       return { _options: response.data, challengeId: response.challengeId };
     } else {
-      adminforth.alert({message: 'Error creating sign-in request.', variant: 'warning'});
-      codeError.value = 'Error creating sign-in request.';
+      const message = response.error || 'Error creating sign-in request.';
+      adminforth.alert({message, variant: 'warning'});
+      codeError.value = message;
     }
   }
 

package/dist/endpoints/registerPasskeyEndpoints.js

@@ -24,7 +24,7 @@ export function registerPasskeyEndpoints(server, handlers) {
         method: 'POST',
         path: `/plugin/passkeys/loginOptions`,
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ response }) { return handlers.createLoginOptions({ response }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ response, headers }) { return handlers.createLoginOptions({ response, headers }); }),
     });
     server.endpoint({
         method: 'GET',

package/dist/handlers/createPasskeyHandlers.d.ts

@@ -11,8 +11,9 @@ export declare function createPasskeyHandlers(ctx: any): {
         adminUser: any;
         cookies: any;
     }) => Promise<any>;
-    createLoginOptions: ({ response }: {
+    createLoginOptions: ({ response, headers }: {
         response: any;
+        headers: any;
     }) => Promise<any>;
     getPasskeys: ({ adminUser }: {
         adminUser: any;

package/dist/handlers/createPasskeyHandlers.js

@@ -30,7 +30,11 @@ export function createPasskeyHandlers(ctx) {
         finishRegistration: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
             return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
         }),
-        createLoginOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ response }) {
+        createLoginOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ response, headers }) {
+            if (!(yield ctx.checkPasskeyLoginRateLimit(headers))) {
+                response.setStatus(429);
+                return { error: 'Too many login attempts, please try again later' };
+            }
             return ctx.passkeyService.createLoginOptions(response);
         }),
         getPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser }) {

package/dist/handlers/createTwoFaHandlers.js

@@ -74,6 +74,10 @@ export function createTwoFaHandlers(ctx) {
         }),
         confirmLoginWithPasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
             var _b;
+            if (!(yield ctx.checkPasskeyLoginRateLimit(headers))) {
+                response.setStatus(429);
+                return { error: 'Too many login attempts, please try again later' };
+            }
             if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
                 return { error: 'Login with passkeys is not allowed' };
             }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AdminForthPlugin } from "adminforth";
+import { AdminForthPlugin, RateLimiter } from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth } from "adminforth";
 import { PluginOptions } from "./types.js";
 import { PasskeyService } from "./services/passkeyService.js";
@@ -15,6 +15,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     totpService: TotpService;
     cookieService: CookieService;
     userRepository: UserRepository;
+    passkeyLoginRateLimiters: RateLimiter[];
     private ctx;
     constructor(options: PluginOptions);
     instanceUniqueRepresentation(pluginOptions: any): string;

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthPlugin, suggestIfTypo } from "adminforth";
+import { AdminForthPlugin, suggestIfTypo, RateLimiter } from "adminforth";
 import * as AdminForthRuntime from "adminforth";
 import { PasskeyService } from "./services/passkeyService.js";
 import { TotpService } from "./services/totpService.js";
@@ -24,6 +24,7 @@ const getRequestWebsocketClientId = AdminForthRuntime.getRequestWebsocketClientI
 export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     constructor(options) {
         super(options, import.meta.url);
+        this.passkeyLoginRateLimiters = [];
         this.pending = new Map();
         this.options = options;
         this.shouldHaveSingleInstancePerWholeApp = () => true;
@@ -44,7 +45,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 //check if user has 2FA set up
                 const users2FASecret = this.userRepository.getSecret(userRecord);
                 //check if user has any passkeys registered
-                const userHasPasskeys = yield this.passkeyService.hasPasskeysForUser(adminUser.dbUser[userPkFieldName]);
+                let userHasPasskeys = false;
+                if (this.options.passkeys) {
+                    userHasPasskeys = yield this.passkeyService.hasPasskeysForUser(adminUser.dbUser[userPkFieldName]);
+                }
                 // If user has either 2FA secret or any passkeys, they cannot skip
                 if (users2FASecret || userHasPasskeys) {
                     return { skipAllowed: false };
@@ -106,6 +110,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         this.cookieService = new CookieService(this.adminforth, this.options);
         this.totpService = new TotpService(this.options, this.userRepository);
         this.passkeyService = new PasskeyService(this.options, this.adminforth, this.userRepository, undefined, this.cookieService);
+        this.passkeyLoginRateLimiters = adminforth.config.auth.rateLimit.map((rate) => new RateLimiter(rate));
         this.ctx = {
             adminforth: this.adminforth,
             options: this.options,
@@ -114,6 +119,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             totpService: this.totpService,
             passkeyService: this.passkeyService,
             cookieService: this.cookieService,
+            checkPasskeyLoginRateLimit: (headers) => __awaiter(this, void 0, void 0, function* () {
+                const passkeyLoginRateLimitKey = this.adminforth.auth.getClientIp(headers) || 'unknown';
+                const rateLimitResults = yield Promise.all(this.passkeyLoginRateLimiters.map((limiter) => limiter.consume(passkeyLoginRateLimitKey)));
+                return rateLimitResults.every(Boolean);
+            }),
             verifyMfaConfirmation: (confirmationResult, opts) => verifyMfaConfirmation(this.ctx, confirmationResult, opts),
             checkIfSkipSetupAllowSkipVerify: this.checkIfSkipSetupAllowSkipVerify.bind(this),
             autoVerify: {

package/endpoints/registerPasskeyEndpoints.ts

@@ -20,7 +20,7 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     method: 'POST',
     path: `/plugin/passkeys/loginOptions`,
     noAuth: true,
-    handler: async ({ response }) => handlers.createLoginOptions({ response }),
+    handler: async ({ response, headers }) => handlers.createLoginOptions({ response, headers }),
   });
 
   server.endpoint({

package/handlers/createPasskeyHandlers.ts

@@ -27,7 +27,11 @@ export function createPasskeyHandlers(ctx: any) {
       return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
     },
 
-    createLoginOptions: async ({ response }) => {
+    createLoginOptions: async ({ response, headers }) => {
+      if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
+        response.setStatus(429);
+        return { error: 'Too many login attempts, please try again later' };
+      }
       return ctx.passkeyService.createLoginOptions(response);
     },
 

package/handlers/createTwoFaHandlers.ts

@@ -63,6 +63,11 @@ export function createTwoFaHandlers(ctx: any) {
     },
 
     confirmLoginWithPasskey: async ({ body, response, cookies, headers, requestUrl, query }) => {
+      if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
+        response.setStatus(429);
+        return { error: 'Too many login attempts, please try again later' };
+      }
+
       if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
         return { error: 'Login with passkeys is not allowed' };
       }

package/index.ts

@@ -1,4 +1,4 @@
-import {  AdminForthPlugin, suggestIfTypo, HttpExtra } from "adminforth";
+import {  AdminForthPlugin, suggestIfTypo, HttpExtra, RateLimiter } from "adminforth";
 import * as AdminForthRuntime from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth, IAdminForthHttpResponse } from "adminforth";
 import  { PluginOptions } from "./types.js"
@@ -27,6 +27,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
   totpService: TotpService;
   cookieService: CookieService;
   userRepository: UserRepository;
+  passkeyLoginRateLimiters: RateLimiter[] = [];
   private ctx: any;
 
   constructor(options: PluginOptions) {
@@ -53,7 +54,10 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       //check if user has 2FA set up
       const users2FASecret = this.userRepository.getSecret(userRecord);
       //check if user has any passkeys registered
-      const userHasPasskeys = await this.passkeyService.hasPasskeysForUser(adminUser.dbUser[userPkFieldName]);
+      let userHasPasskeys = false;
+      if(this.options.passkeys) {
+        userHasPasskeys = await this.passkeyService.hasPasskeysForUser(adminUser.dbUser[userPkFieldName]);
+      }
 
       // If user has either 2FA secret or any passkeys, they cannot skip
       if (users2FASecret || userHasPasskeys) {
@@ -124,6 +128,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     this.cookieService = new CookieService(this.adminforth, this.options);
     this.totpService = new TotpService(this.options, this.userRepository);
     this.passkeyService = new PasskeyService(this.options, this.adminforth, this.userRepository, undefined, this.cookieService);
+    this.passkeyLoginRateLimiters = (adminforth.config.auth as any).rateLimit.map((rate) => new RateLimiter(rate));
     this.ctx = {
       adminforth: this.adminforth,
       options: this.options,
@@ -132,6 +137,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       totpService: this.totpService,
       passkeyService: this.passkeyService,
       cookieService: this.cookieService,
+      checkPasskeyLoginRateLimit: async (headers) => {
+        const passkeyLoginRateLimitKey = this.adminforth.auth.getClientIp(headers) || 'unknown';
+        const rateLimitResults = await Promise.all(this.passkeyLoginRateLimiters.map((limiter) => limiter.consume(passkeyLoginRateLimitKey)));
+        return rateLimitResults.every(Boolean);
+      },
       verifyMfaConfirmation: (confirmationResult, opts) => verifyMfaConfirmation(this.ctx, confirmationResult, opts),
       checkIfSkipSetupAllowSkipVerify: this.checkIfSkipSetupAllowSkipVerify.bind(this),
       autoVerify: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.1.4",
+  "version": "4.2.0",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",