@adminforth/two-factors-auth 4.5.0 → 4.6.0

package/build.log

@@ -17,5 +17,5 @@ custom/tsconfig.json
 custom/use2faApi.ts
 custom/utils.js
 
-sent 311,869 bytes  received 248 bytes  624,234.00 bytes/sec
-total size is 310,909  speedup is 1.00
+sent 312,646 bytes  received 248 bytes  625,788.00 bytes/sec
+total size is 311,686  speedup is 1.00

package/custom/TwoFAModal.vue

@@ -37,6 +37,7 @@
             @on-complete="handleOnComplete"
           />
         </div>
+        <p v-if="codeError" class="af-2fa-code-error text-center text-xs text-red-600 dark:text-red-400">{{ codeError }}</p>
         <p v-if="doesUserHavePasskeys" class="af-2fa-totp-footer text-center text-xs text-gray-500 dark:text-gray-400">
           {{$t('Having trouble?')}}
           <button type="button" class="af-2fa-switch-to-passkey text-lightPrimary dark:text-white hover:underline cursor-pointer" @click="modalMode = 'passkey'">{{$t('Use passkey instead')}}</button>
@@ -141,7 +142,7 @@
     if (props.adminUser) {
       websocket.unsubscribeByPrefix(`/user2fa/`);
       const user2FaTopic = `/user2fa/${props.adminUser.pk}/${getAdminForthClientId()}`;
-      websocket.subscribe(user2FaTopic, async (data: {sessionId: string}) => {
+      websocket.subscribe(user2FaTopic, async (data: {sessionId: string; actionDescription?: string}) => {
         if (!allowAddNewSessions) {
           alert({message: t('Some process or user tries to add new actions to confirm. Action was blocked'), variant: 'warning'});
           return;
@@ -153,7 +154,7 @@
         }
         try {
           isAwaiting2FAResult.value = true;
-          confirmationResult = await twoFactorsAuthApi.get2FaConfirmationResult();
+          confirmationResult = await twoFactorsAuthApi.get2FaConfirmationResult(data.actionDescription);
         } catch (error) {
           if (!isTwoFaCancel(error)) {
             console.error('[AdminForth 2FA] Error during 2FA confirmation', error);
@@ -271,7 +272,8 @@
   const isLoading = ref(false);
   const isFetchingPasskey = ref(false);
   const customDialogTitle = ref("");
-  
+  const codeError = ref("");
+
   async function usePasskeyButtonClick() {
     isFetchingPasskey.value = true;
     let passkeyData;
@@ -322,32 +324,41 @@
   
   async function sendConfirmationResult(value: string) {
     if (!resolveFn) throw new Error(t('Modal is not initialized properly'));
-    if (verifyFn) {
-      try {
-        const ok = await verifyFn(value);
-        if (!ok) {
-          rejectFn?.(new Error(t('Invalid code')));
-          return;
-        }
-      } catch (err) {
-        rejectFn?.(err);
-        return;
-      }
+    let checked: { error: string } | { result: TwoFaConfirmationResult };
+    try {
+      checked = await checkCode(value);
+    } catch (err) {
+      rejectFn?.(err);
+      return;
+    }
+    if ('error' in checked) {
+      codeError.value = checked.error;
+      bindValue.value = '';
+      confirmationResult.value?.clearInput();
+      return;
     }
 
     modelShow.value = false;
-    const dataToReturn = {
-      mode: "totp",
-      result: value
-    }
+    codeError.value = "";
     customDialogTitle.value = "";
     removeEventListenerForOTPInput();
-    resolveFn(dataToReturn);
+    resolveFn(checked.result);
   }
   
   
+  async function checkCode(code: string): Promise<{ error: string } | { result: TwoFaConfirmationResult }> {
+    if (verifyFn) {
+      return (await verifyFn(code)) ? { result: { mode: 'totp', result: code } } : { error: t('Wrong or expired OTP code') };
+    }
+    const response = await callAdminForthApi({ method: 'POST', path: '/plugin/twofa/verify', body: { code } });
+    return response?.ok
+      ? { result: { mode: 'verifiedTotp', result: response.verifiedCodeToken } }
+      : { error: response?.error ?? t('Wrong or expired OTP code') };
+  }
+
   function onCancel() {
     modelShow.value = false;
+    codeError.value = "";
     bindValue.value = '';
     confirmationResult.value?.clearInput();
     removeEventListenerForOTPInput();

package/custom/TwoFactorsPasskeysSettings.vue

@@ -130,7 +130,7 @@
     import { Dialog, Tooltip, Spinner, Input } from '@/afcl';
     import { IconTrashBinSolid, IconPenSolid, IconPlusOutline, IconInfoCircleOutline } from '@iconify-prerendered/vue-flowbite';
     import { useCoreStore } from '@/stores/core';
-    import { useTwoFactorsAuth } from './use2faApi';
+    import { useTwoFactorsAuth, type TwoFaConfirmationResult } from './use2faApi';
 
     const { t } = useI18n();
     const coreStore = useCoreStore();
@@ -215,9 +215,7 @@
         }
     }
 
-    type ConfirmationResult = { mode: 'totp'; result: string } | { mode: 'passkey'; result: Record<string, any> } | { mode?: undefined };
-
-    async function requestPasskeyChallenge(confirmationResult: ConfirmationResult) {
+    async function requestPasskeyChallenge(confirmationResult: TwoFaConfirmationResult) {
         try {
             const response = await callAdminForthApi({
                 path: '/plugin/passkeys/registrationOptions',

package/custom/use2faApi.ts

@@ -3,6 +3,7 @@ import { defineStore } from 'pinia';
 
 export type TwoFaConfirmationResult =
   | { mode: 'totp'; result: string }
+  | { mode: 'verifiedTotp'; result: string }
   | { mode: 'passkey'; result: Record<string, any> }
   | { mode?: undefined };
 

package/dist/custom/TwoFAModal.vue

@@ -37,6 +37,7 @@
             @on-complete="handleOnComplete"
           />
         </div>
+        <p v-if="codeError" class="af-2fa-code-error text-center text-xs text-red-600 dark:text-red-400">{{ codeError }}</p>
         <p v-if="doesUserHavePasskeys" class="af-2fa-totp-footer text-center text-xs text-gray-500 dark:text-gray-400">
           {{$t('Having trouble?')}}
           <button type="button" class="af-2fa-switch-to-passkey text-lightPrimary dark:text-white hover:underline cursor-pointer" @click="modalMode = 'passkey'">{{$t('Use passkey instead')}}</button>
@@ -141,7 +142,7 @@
     if (props.adminUser) {
       websocket.unsubscribeByPrefix(`/user2fa/`);
       const user2FaTopic = `/user2fa/${props.adminUser.pk}/${getAdminForthClientId()}`;
-      websocket.subscribe(user2FaTopic, async (data: {sessionId: string}) => {
+      websocket.subscribe(user2FaTopic, async (data: {sessionId: string; actionDescription?: string}) => {
         if (!allowAddNewSessions) {
           alert({message: t('Some process or user tries to add new actions to confirm. Action was blocked'), variant: 'warning'});
           return;
@@ -153,7 +154,7 @@
         }
         try {
           isAwaiting2FAResult.value = true;
-          confirmationResult = await twoFactorsAuthApi.get2FaConfirmationResult();
+          confirmationResult = await twoFactorsAuthApi.get2FaConfirmationResult(data.actionDescription);
         } catch (error) {
           if (!isTwoFaCancel(error)) {
             console.error('[AdminForth 2FA] Error during 2FA confirmation', error);
@@ -271,7 +272,8 @@
   const isLoading = ref(false);
   const isFetchingPasskey = ref(false);
   const customDialogTitle = ref("");
-  
+  const codeError = ref("");
+
   async function usePasskeyButtonClick() {
     isFetchingPasskey.value = true;
     let passkeyData;
@@ -322,32 +324,41 @@
   
   async function sendConfirmationResult(value: string) {
     if (!resolveFn) throw new Error(t('Modal is not initialized properly'));
-    if (verifyFn) {
-      try {
-        const ok = await verifyFn(value);
-        if (!ok) {
-          rejectFn?.(new Error(t('Invalid code')));
-          return;
-        }
-      } catch (err) {
-        rejectFn?.(err);
-        return;
-      }
+    let checked: { error: string } | { result: TwoFaConfirmationResult };
+    try {
+      checked = await checkCode(value);
+    } catch (err) {
+      rejectFn?.(err);
+      return;
+    }
+    if ('error' in checked) {
+      codeError.value = checked.error;
+      bindValue.value = '';
+      confirmationResult.value?.clearInput();
+      return;
     }
 
     modelShow.value = false;
-    const dataToReturn = {
-      mode: "totp",
-      result: value
-    }
+    codeError.value = "";
     customDialogTitle.value = "";
     removeEventListenerForOTPInput();
-    resolveFn(dataToReturn);
+    resolveFn(checked.result);
   }
   
   
+  async function checkCode(code: string): Promise<{ error: string } | { result: TwoFaConfirmationResult }> {
+    if (verifyFn) {
+      return (await verifyFn(code)) ? { result: { mode: 'totp', result: code } } : { error: t('Wrong or expired OTP code') };
+    }
+    const response = await callAdminForthApi({ method: 'POST', path: '/plugin/twofa/verify', body: { code } });
+    return response?.ok
+      ? { result: { mode: 'verifiedTotp', result: response.verifiedCodeToken } }
+      : { error: response?.error ?? t('Wrong or expired OTP code') };
+  }
+
   function onCancel() {
     modelShow.value = false;
+    codeError.value = "";
     bindValue.value = '';
     confirmationResult.value?.clearInput();
     removeEventListenerForOTPInput();

package/dist/custom/TwoFactorsPasskeysSettings.vue

@@ -130,7 +130,7 @@
     import { Dialog, Tooltip, Spinner, Input } from '@/afcl';
     import { IconTrashBinSolid, IconPenSolid, IconPlusOutline, IconInfoCircleOutline } from '@iconify-prerendered/vue-flowbite';
     import { useCoreStore } from '@/stores/core';
-    import { useTwoFactorsAuth } from './use2faApi';
+    import { useTwoFactorsAuth, type TwoFaConfirmationResult } from './use2faApi';
 
     const { t } = useI18n();
     const coreStore = useCoreStore();
@@ -215,9 +215,7 @@
         }
     }
 
-    type ConfirmationResult = { mode: 'totp'; result: string } | { mode: 'passkey'; result: Record<string, any> } | { mode?: undefined };
-
-    async function requestPasskeyChallenge(confirmationResult: ConfirmationResult) {
+    async function requestPasskeyChallenge(confirmationResult: TwoFaConfirmationResult) {
         try {
             const response = await callAdminForthApi({
                 path: '/plugin/passkeys/registrationOptions',

package/dist/custom/use2faApi.ts

@@ -3,6 +3,7 @@ import { defineStore } from 'pinia';
 
 export type TwoFaConfirmationResult =
   | { mode: 'totp'; result: string }
+  | { mode: 'verifiedTotp'; result: string }
   | { mode: 'passkey'; result: Record<string, any> }
   | { mode?: undefined };
 

package/dist/handlers/createPasskeyHandlers.d.ts

@@ -1,3 +1,4 @@
+import { TwoFactorErrorCode } from "../utils/errors.js";
 export declare function createPasskeyHandlers(ctx: any): {
     createRegistrationOptions: ({ body, adminUser, response, cookies, headers }: {
         body: any;
@@ -41,12 +42,8 @@ export declare function createPasskeyHandlers(ctx: any): {
         headers: any;
     }) => Promise<{
         ok: boolean;
-        code: string;
-        error: any;
-    } | {
-        ok: boolean;
-        error: any;
-        code?: undefined;
+        code: TwoFactorErrorCode;
+        error: string;
     } | {
         ok: boolean;
     }>;

package/dist/handlers/createPasskeyHandlers.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { HttpStatus, errorMessage, respondWithStatus } from "../utils/errors.js";
+import { HttpStatus, TwoFactorErrorCode, errorMessage, respondWithStatus } from "../utils/errors.js";
 export function createPasskeyHandlers(ctx) {
     return {
         createRegistrationOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
@@ -73,12 +73,11 @@ export function createPasskeyHandlers(ctx) {
             return checkResult;
         }),
         resolveVerifyAuto: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
-            var _b;
             const sessionsIds = body === null || body === void 0 ? void 0 : body.sessionsIds;
             const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
             const idsToResolve = Array.isArray(sessionsIds) ? sessionsIds : [];
             const resolveAllIdsAsFailed = (message, code) => {
-                const payload = code ? { ok: false, code, error: message } : { ok: false, error: message };
+                const payload = { ok: false, code, error: message };
                 for (const id of idsToResolve) {
                     ctx.autoVerify.resolveResponse(id, payload);
                 }
@@ -86,15 +85,15 @@ export function createPasskeyHandlers(ctx) {
             };
             try {
                 if (!idsToResolve.length || !confirmationResult) {
-                    return respondWithStatus(resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'), response, HttpStatus.BAD_REQUEST);
+                    return respondWithStatus(resolveAllIdsAsFailed('Confirmation window was closed', TwoFactorErrorCode.CANCELLED), response, HttpStatus.BAD_REQUEST);
                 }
                 for (const id of idsToResolve) {
                     const validationResult = yield ctx.adminforth.auth.verify(id, 'auto2FA', false);
                     if (!validationResult) {
-                        return respondWithStatus(resolveAllIdsAsFailed('Invalid session ID or confirmation result'), response, HttpStatus.FORBIDDEN);
+                        return respondWithStatus(resolveAllIdsAsFailed('Invalid session ID or confirmation result', TwoFactorErrorCode.INVALID_SESSION), response, HttpStatus.FORBIDDEN);
                     }
                     if (validationResult.adminUserPk !== adminUser.pk) {
-                        return respondWithStatus(resolveAllIdsAsFailed('Session does not belong to the authenticated user'), response, HttpStatus.FORBIDDEN);
+                        return respondWithStatus(resolveAllIdsAsFailed('Session does not belong to the authenticated user', TwoFactorErrorCode.INVALID_SESSION), response, HttpStatus.FORBIDDEN);
                     }
                 }
                 const verificationResult = yield ctx.verifyMfaConfirmation(confirmationResult, {
@@ -106,20 +105,17 @@ export function createPasskeyHandlers(ctx) {
                         headers: headers,
                     }
                 });
-                if (!verificationResult || !('ok' in verificationResult)) {
-                    return respondWithStatus(resolveAllIdsAsFailed((_b = verificationResult === null || verificationResult === void 0 ? void 0 : verificationResult.error) !== null && _b !== void 0 ? _b : 'Verification failed'), response, HttpStatus.FORBIDDEN);
+                if ('error' in verificationResult) {
+                    return respondWithStatus(resolveAllIdsAsFailed(verificationResult.error, verificationResult.code), response, HttpStatus.FORBIDDEN);
                 }
-                if ('ok' in verificationResult && verificationResult.ok) {
-                    for (const id of idsToResolve) {
-                        ctx.autoVerify.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
-                    }
-                    return { ok: true };
+                for (const id of idsToResolve) {
+                    ctx.autoVerify.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
                 }
-                return respondWithStatus(resolveAllIdsAsFailed('Verification failed'), response, HttpStatus.FORBIDDEN);
+                return { ok: true };
             }
             catch (error) {
                 console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
-                return respondWithStatus(resolveAllIdsAsFailed(errorMessage(error)), response, HttpStatus.INTERNAL_SERVER_ERROR);
+                return respondWithStatus(resolveAllIdsAsFailed(errorMessage(error), TwoFactorErrorCode.INTERNAL_ERROR), response, HttpStatus.INTERNAL_SERVER_ERROR);
             }
         }),
     };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AdminForthPlugin, RateLimiter } from "adminforth";
+import { AdminForthPlugin, HttpExtra, RateLimiter } from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth } from "adminforth";
 import { PluginOptions } from "./types.js";
 import { PasskeyService } from "./services/passkeyService.js";
@@ -6,6 +6,10 @@ import { TotpService } from "./services/totpService.js";
 import { type MfaConfirmationResult, type VerifyOptions } from "./services/verifyMfaConfirmation.js";
 import { CookieService } from "./services/cookieService.js";
 import { UserRepository } from "./repositories/userRepository.js";
+import { TwoFactorErrorCode } from "./utils/errors.js";
+import type { VerificationResult } from "./utils/types.js";
+export { TwoFactorErrorCode };
+export type { VerificationResult };
 export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     options: PluginOptions;
     adminforth: IAdminForth;
@@ -17,6 +21,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     userRepository: UserRepository;
     passkeyLoginRateLimiters: RateLimiter[];
     private ctx;
+    private readonly mfaRequestContext;
     constructor(options: PluginOptions);
     instanceUniqueRepresentation(pluginOptions: any): string;
     checkIfSkipSetupAllowSkipVerify(adminUser: AdminUser): Promise<{
@@ -25,12 +30,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     private pending;
     private waitForResponse;
     private resolveResponse;
-    verifyAuto(adminUser: AdminUser): Promise<any>;
-    verify(confirmationResult: MfaConfirmationResult, opts: VerifyOptions): Promise<{
-        ok: true;
-    } | {
-        error: string;
-    }>;
+    withVerificationContext<T>(confirmationResult: MfaConfirmationResult | undefined, extra: HttpExtra, callback: () => Promise<T>): Promise<(import("./utils/types.js").VerificationFailure & {
+        actionDescription?: string;
+    }) | T>;
+    verifyAuto(adminUser: AdminUser, actionDescription?: string): Promise<any>;
+    verify(confirmationResult: MfaConfirmationResult | undefined, opts: VerifyOptions): Promise<VerificationResult>;
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     activate(resourceConfig: AdminForthResource, adminforth: IAdminForth): void;

package/dist/index.js

@@ -12,6 +12,7 @@ import * as AdminForthRuntime from "adminforth";
 import { PasskeyService } from "./services/passkeyService.js";
 import { TotpService } from "./services/totpService.js";
 import { verifyMfaConfirmation } from "./services/verifyMfaConfirmation.js";
+import { MfaRequestContext } from './services/mfaRequestContext.js';
 import { CookieService } from "./services/cookieService.js";
 import { UserRepository } from "./repositories/userRepository.js";
 import { registerPasskeyEndpoints } from "./endpoints/registerPasskeyEndpoints.js";
@@ -19,12 +20,15 @@ import { registerTwoFaEndpoints } from "./endpoints/registerTwoFaEndpoints.js";
 import { createPasskeyHandlers } from "./handlers/createPasskeyHandlers.js";
 import { createTwoFaHandlers } from "./handlers/createTwoFaHandlers.js";
 import { parsePeriod } from "./utils/parsePeriod.js";
+import { TwoFactorErrorCode } from "./utils/errors.js";
 import crypto from 'crypto';
+export { TwoFactorErrorCode };
 const getRequestWebsocketClientId = AdminForthRuntime.getRequestWebsocketClientId;
 export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     constructor(options) {
         super(options, import.meta.url);
         this.passkeyLoginRateLimiters = [];
+        this.mfaRequestContext = new MfaRequestContext();
         this.pending = new Map();
         this.options = options;
         this.shouldHaveSingleInstancePerWholeApp = () => true;
@@ -66,7 +70,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             };
             timeout = setTimeout(() => {
                 cleanup();
-                resolve({ ok: false, error: 'Verification timed out' });
+                resolve({ ok: false, error: 'Verification timed out', code: TwoFactorErrorCode.TIMEOUT });
             }, timeoutMs);
             this.pending.set(id, (value) => {
                 cleanup();
@@ -80,16 +84,30 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             resolve(data);
         }
     }
-    verifyAuto(adminUser) {
+    withVerificationContext(confirmationResult, extra, callback) {
+        return this.mfaRequestContext.run(confirmationResult, extra, callback);
+    }
+    verifyAuto(adminUser, actionDescription) {
         return __awaiter(this, void 0, void 0, function* () {
+            const contextualResult = yield this.mfaRequestContext.verify(adminUser, actionDescription, (confirmationResult, extra) => this.verify(confirmationResult, {
+                adminUser,
+                userPk: adminUser.pk,
+                extra,
+            }));
+            if (contextualResult)
+                return contextualResult;
             const websocketClientId = getRequestWebsocketClientId === null || getRequestWebsocketClientId === void 0 ? void 0 : getRequestWebsocketClientId();
             if (!websocketClientId) {
-                return { ok: false, error: '2FA auto verification requires an active browser request context' };
+                return {
+                    ok: false,
+                    error: '2FA auto verification requires an active browser request context',
+                    code: TwoFactorErrorCode.BROWSER_CONTEXT_REQUIRED,
+                };
             }
             const sessionId = crypto.randomUUID();
             const jwt = this.adminforth.auth.issueJWT({ sessionId, adminUserPk: adminUser.pk }, 'auto2FA', '5m');
             const resultPromise = this.waitForResponse(jwt, 5 * 60 * 1000);
-            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}/${websocketClientId}`, { sessionId: jwt });
+            this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}/${websocketClientId}`, { sessionId: jwt, actionDescription });
             const result = yield resultPromise;
             this.adminforth.websocket.publish(`/user2fa/${adminUser.pk}/${websocketClientId}/resolve`, { sessionId: jwt });
             return result;
@@ -107,7 +125,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         this.adminForthAuth = adminforth.auth;
         this.userRepository = new UserRepository(this.adminforth, this.options);
         this.cookieService = new CookieService(this.adminforth, this.options);
-        this.totpService = new TotpService(this.options, this.userRepository);
+        this.totpService = new TotpService(this.options, this.userRepository, this.adminforth.auth);
         this.passkeyService = new PasskeyService(this.options, this.adminforth, this.userRepository, undefined, this.cookieService);
         this.passkeyLoginRateLimiters = adminforth.config.auth.rateLimit.map((rate) => new RateLimiter(rate));
         this.ctx = {

package/dist/services/mfaRequestContext.d.ts

@@ -0,0 +1,13 @@
+import type { AdminUser, HttpExtra } from 'adminforth';
+import type { MfaConfirmationResult } from './verifyMfaConfirmation.js';
+import type { VerificationFailure, VerificationResult } from '../utils/types.js';
+type ContextualVerificationFailure = VerificationFailure & {
+    actionDescription?: string;
+};
+/** Keeps verification within one external request, including every CRUD hook it invokes. */
+export declare class MfaRequestContext {
+    private readonly storage;
+    run<T>(confirmationResult: MfaConfirmationResult | undefined, extra: HttpExtra, callback: () => Promise<T>): Promise<T | ContextualVerificationFailure>;
+    verify(adminUser: AdminUser, actionDescription: string | undefined, verifier: (confirmationResult: MfaConfirmationResult | undefined, extra: HttpExtra) => Promise<VerificationResult>): Promise<VerificationResult | undefined>;
+}
+export {};

package/dist/services/mfaRequestContext.js

@@ -0,0 +1,50 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AsyncLocalStorage } from 'node:async_hooks';
+class MfaVerificationError extends Error {
+    constructor(result) {
+        super(result.error);
+        this.result = result;
+    }
+}
+/** Keeps verification within one external request, including every CRUD hook it invokes. */
+export class MfaRequestContext {
+    constructor() {
+        this.storage = new AsyncLocalStorage();
+    }
+    run(confirmationResult, extra, callback) {
+        return this.storage.run({ confirmationResult, extra, results: new Map() }, () => __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield callback();
+            }
+            catch (error) {
+                if (error instanceof MfaVerificationError)
+                    return error.result;
+                throw error;
+            }
+        }));
+    }
+    verify(adminUser, actionDescription, verifier) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const context = this.storage.getStore();
+            if (!context)
+                return undefined;
+            let result = context.results.get(adminUser.pk);
+            if (!result) {
+                result = verifier(context.confirmationResult, context.extra);
+                context.results.set(adminUser.pk, result);
+            }
+            const verified = yield result;
+            if ('error' in verified)
+                throw new MfaVerificationError(Object.assign(Object.assign({}, verified), { actionDescription }));
+            return verified;
+        });
+    }
+}

package/dist/services/totpService.d.ts

@@ -1,21 +1,20 @@
-import type { AdminUser } from "adminforth";
+import { type AdminUser, type IAdminForthAuth } from "adminforth";
 import type { PluginOptions } from "../types.js";
 import { UserRepository } from "../repositories/userRepository.js";
+import type { VerificationFailure, VerificationResult } from "../utils/types.js";
 export declare class TotpService {
     private readonly options;
     private readonly userRepository;
-    constructor(options: PluginOptions, userRepository: UserRepository);
+    private readonly auth;
+    private readonly codeAttemptLimiters;
+    constructor(options: PluginOptions, userRepository: UserRepository, auth: IAdminForthAuth);
     generateSecret(issuerName: string, userName: string): string;
     verifySecret(secret: string, code: string): boolean;
-    verifyUserCode(userPk: string, code: string): Promise<{
-        ok: true;
-    } | {
-        error: string;
-    }>;
+    verifyUserCode(userPk: string, code: string): Promise<VerificationResult>;
     verifyAdminUserCode(adminUser: AdminUser, code: string): Promise<{
         ok: true;
-    } | {
-        error: string;
-    }>;
+        verifiedCodeToken: string;
+    } | VerificationFailure>;
+    isVerifiedCodeToken(token: string, userPk: string): Promise<boolean>;
     saveSecret(userPk: string, secret: string): Promise<void>;
 }

package/dist/services/totpService.js

@@ -7,11 +7,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { RateLimiter } from "adminforth";
 import twofactor from 'node-2fa';
+import { TwoFactorErrorCode } from "../utils/errors.js";
+const CODE_ATTEMPT_RATE_LIMITS = ['30/1m', '300/1h', '1000/1d'];
+const VERIFIED_CODE_JWT_TYPE = 'verifiedTotpCode';
+const VERIFIED_CODE_TOKEN_TTL = '1m';
 export class TotpService {
-    constructor(options, userRepository) {
+    constructor(options, userRepository, auth) {
         this.options = options;
         this.userRepository = userRepository;
+        this.auth = auth;
+        this.codeAttemptLimiters = CODE_ATTEMPT_RATE_LIMITS.map((rate) => new RateLimiter(rate));
     }
     generateSecret(issuerName, userName) {
         return twofactor.generateSecret({ name: issuerName, account: userName }).secret;
@@ -21,18 +28,33 @@ export class TotpService {
     }
     verifyUserCode(userPk, code) {
         return __awaiter(this, void 0, void 0, function* () {
+            const attemptsAllowed = yield Promise.all(this.codeAttemptLimiters.map((limiter) => limiter.consume(userPk)));
+            if (!attemptsAllowed.every(Boolean)) {
+                return { error: "Too many attempts to enter the code. Try again later.", code: TwoFactorErrorCode.RATE_LIMITED };
+            }
             const user = yield this.userRepository.getAuthUser(userPk);
             if (!user)
-                return { error: "User not found" };
+                return { error: "User not found", code: TwoFactorErrorCode.USER_NOT_FOUND };
             const secret = this.userRepository.getSecret(user);
             if (!secret)
-                return { error: "2FA is not set up for this user" };
-            return this.verifySecret(secret, code) ? { ok: true } : { error: "Wrong or expired OTP code" };
+                return { error: "2FA is not set up for this user", code: TwoFactorErrorCode.NOT_SET_UP };
+            return this.verifySecret(secret, code)
+                ? { ok: true }
+                : { error: "Wrong or expired OTP code", code: TwoFactorErrorCode.INVALID };
         });
     }
     verifyAdminUserCode(adminUser, code) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.verifyUserCode(this.userRepository.getUserPk(adminUser), code);
+            const result = yield this.verifyUserCode(this.userRepository.getUserPk(adminUser), code);
+            if ('error' in result)
+                return result;
+            return { ok: true, verifiedCodeToken: this.auth.issueJWT({ pk: adminUser.pk }, VERIFIED_CODE_JWT_TYPE, VERIFIED_CODE_TOKEN_TTL) };
+        });
+    }
+    isVerifiedCodeToken(token, userPk) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const payload = yield this.auth.verify(token, VERIFIED_CODE_JWT_TYPE, false);
+            return (payload === null || payload === void 0 ? void 0 : payload.pk) === userPk;
         });
     }
     saveSecret(userPk, secret) {