@adminforth/two-factors-auth 4.4.0 → 4.4.2

package/handlers/createTwoFaHandlers.ts

@@ -1,3 +1,5 @@
+import { HttpStatus, respondWithStatus } from "../utils/errors.js";
+
 export function createTwoFaHandlers(ctx: any) {
   return {
     initSetup: async ({ cookies }) => {
@@ -11,17 +13,16 @@ export function createTwoFaHandlers(ctx: any) {
 
     confirmLogin: async ({ body, response, cookies, headers }) => {
       if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
-        response.setStatus(429);
-        return { error: 'Too many login attempts, please try again later' };
+        return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
       }
 
       const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
       if (!totpTemporaryJWT) {
-        return { error: 'Login session expired. Please log in again.' }
+        return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN)
       }
       const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
       if (!decoded) {
-        return { error: 'Login session expired. Please log in again.' }
+        return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN)
       }
 
       if (decoded.newSecret) {
@@ -34,7 +35,7 @@ export function createTwoFaHandlers(ctx: any) {
           ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
           return { status: 'ok', allowedLogin: true }
         } else {
-          return {error: 'Wrong or expired OTP code'}
+          return respondWithStatus({ error: 'Wrong or expired OTP code' }, response, HttpStatus.FORBIDDEN)
         }
       }
 
@@ -43,7 +44,7 @@ export function createTwoFaHandlers(ctx: any) {
       if (body.usePasskey && ctx.options.passkeys) {
         const cookiesValidationResult = await ctx.passkeyService.validateLoginChallengeCookie(cookies);
         if (!cookiesValidationResult.ok) {
-          return { error: cookiesValidationResult.error };
+          return respondWithStatus({ error: cookiesValidationResult.error }, response, HttpStatus.FORBIDDEN);
         }
         const res = await ctx.passkeyService.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
         if (res.ok && res.passkeyConfirmed) {
@@ -63,28 +64,27 @@ export function createTwoFaHandlers(ctx: any) {
         ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
         return { status: 'ok', allowedLogin: true }
       } else {
-        return {error: verificationError}
+        return respondWithStatus({ error: verificationError }, response, HttpStatus.FORBIDDEN)
       }
     },
 
     confirmLoginWithPasskey: async ({ body, response, cookies, headers, requestUrl, query }) => {
       if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
-        response.setStatus(429);
-        return { error: 'Too many login attempts, please try again later' };
+        return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
       }
 
       if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
-        return { error: 'Login with passkeys is not allowed' };
+        return respondWithStatus({ error: 'Login with passkeys is not allowed' }, response, HttpStatus.FORBIDDEN);
       }
 
       const passkeyResponse = body.passkeyResponse;
       if (!passkeyResponse) {
-        return { error: 'Passkey response is required' };
+        return respondWithStatus({ error: 'Passkey response is required' }, response, HttpStatus.BAD_REQUEST);
       }
 
       const passkeyLoginResult = await ctx.passkeyService.getLoginUserByPasskeyResponse(passkeyResponse, cookies);
       if (!passkeyLoginResult.ok) {
-        return { error: passkeyLoginResult.error };
+        return respondWithStatus({ error: passkeyLoginResult.error }, response, HttpStatus.FORBIDDEN);
       }
       const user = passkeyLoginResult.user;
       const username = user[ctx.adminforth.config.auth.usernameField];
@@ -134,10 +134,10 @@ export function createTwoFaHandlers(ctx: any) {
       return toReturn;
     },
 
-    skipAllow: async ({ cookies }) => {
+    skipAllow: async ({ cookies, response }) => {
       const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
       if (!decoded) {
-        return { status: "error", message: "Invalid token" };
+        return respondWithStatus({ status: "error", message: "Invalid token" }, response, HttpStatus.FORBIDDEN);
       }
       if (!decoded.newSecret) {
         return { status: "ok", skipAllowed: false };
@@ -173,10 +173,14 @@ export function createTwoFaHandlers(ctx: any) {
       return { skipAllowed: false };
     },
 
-    verifyTotp: async ({ adminUser, body }) => {
-      if (!body?.code) return { error: 'Code is required' };
+    verifyTotp: async ({ adminUser, body, response }) => {
+      if (!body?.code) return respondWithStatus({ error: 'Code is required' }, response, HttpStatus.BAD_REQUEST);
 
-      return ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+      const verificationResult = await ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+      if (!verificationResult.ok) {
+        return respondWithStatus(verificationResult, response, HttpStatus.FORBIDDEN);
+      }
+      return verificationResult;
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.4.0",
+  "version": "4.4.2",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/services/passkeyService.ts

@@ -170,18 +170,18 @@ export class PasskeyService {
   public async finishRegistration(body: PasskeyRegistrationPayload, adminUser: AdminUser, cookies: CookieList) {
     const passkeysCookies = this.cookieService.getRegisterPasskeyTemporary(cookies);
     if (!passkeysCookies) {
-      return { error: 'Passkey token is required' };
+      return { ok: false, error: 'Passkey token is required' };
     }
     const decodedPasskeysCookies = await this.cookieService.verifyRegisterPasskeyTemporary(cookies);
     if (!decodedPasskeysCookies) {
-      return { error: 'Invalid passkey token' };
+      return { ok: false, error: 'Invalid passkey token' };
     }
     if (decodedPasskeysCookies.user_id !== adminUser.pk) {
-      return { error: 'Invalid user' };
+      return { ok: false, error: 'Invalid user' };
     }
     const secret = this.userRepository.getSecret(adminUser.dbUser)
     if (!secret || secret.length === 0) {
-      return { error: 'TOTP must be set up before registering a passkey' };
+      return { ok: false, error: 'TOTP must be set up before registering a passkey' };
     }
     const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
     const expectedOrigin = body.origin;
@@ -235,7 +235,7 @@ export class PasskeyService {
       }, adminUser);
     } catch (error) {
       console.error(error);
-      return { error: 'Error registering passkey: ' + errorMessage(error) };
+      return { ok: false, error: 'Error registering passkey: ' + errorMessage(error) };
     }
     return { ok: true };
   }

package/utils/errors.ts

@@ -1,5 +1,19 @@
+import type { IAdminForthHttpResponse } from "adminforth";
 import type { ErrorResponse } from "./types.js";
 
+export enum HttpStatus {
+  BAD_REQUEST = 400,
+  FORBIDDEN = 403,
+  NOT_FOUND = 404,
+  TOO_MANY_REQUESTS = 429,
+  INTERNAL_SERVER_ERROR = 500,
+}
+
+export function respondWithStatus<T>(body: T, response: IAdminForthHttpResponse, status: HttpStatus): T {
+  response.setStatus(status);
+  return body;
+}
+
 export function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }