@adminforth/two-factors-auth 4.7.0 → 4.7.1

package/dist/services/totpService.d.ts

@@ -7,9 +7,11 @@ export declare class TotpService {
     private readonly userRepository;
     private readonly adminforth;
     private readonly codeAttemptLimiters;
+    private readonly lastUsedCodeSteps;
     constructor(options: PluginOptions, userRepository: UserRepository, adminforth: IAdminForth);
     generateSecret(issuerName: string, userName: string): string;
     verifySecret(secret: string, code: string): boolean;
+    private findCodeStep;
     verifyUserCode(userPk: string, code: string): Promise<VerificationResult>;
     verifyAdminUserCode(adminUser: AdminUser, code: string): Promise<{
         ok: true;

package/dist/services/totpService.js

@@ -13,21 +13,28 @@ import { TwoFactorErrorCode } from "../utils/errors.js";
 const CODE_ATTEMPT_RATE_LIMITS = ['30/1m', '300/1h', '1000/1d'];
 const VERIFIED_CODE_JWT_TYPE = 'verifiedTotpCode';
 const VERIFIED_CODE_TOKEN_TTL = '1m';
+const TOTP_STEP_SECONDS = 30;
 export class TotpService {
     constructor(options, userRepository, adminforth) {
         this.options = options;
         this.userRepository = userRepository;
         this.adminforth = adminforth;
         this.codeAttemptLimiters = CODE_ATTEMPT_RATE_LIMITS.map((rate) => new RateLimiter(rate));
+        this.lastUsedCodeSteps = new Map();
     }
     generateSecret(issuerName, userName) {
         return twofactor.generateSecret({ name: issuerName, account: userName }).secret;
     }
     verifySecret(secret, code) {
-        return Boolean(twofactor.verifyToken(secret, code, this.options.timeStepWindow));
+        return this.findCodeStep(secret, code) !== null;
+    }
+    findCodeStep(secret, code) {
+        const match = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
+        return match && Math.floor(Date.now() / 1000 / TOTP_STEP_SECONDS) + match.delta;
     }
     verifyUserCode(userPk, code) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const attemptsAllowed = yield Promise.all(this.codeAttemptLimiters.map((limiter) => limiter.consume(userPk)));
             if (!attemptsAllowed.every(Boolean)) {
                 return { error: "Too many attempts to enter the code. Try again later.", code: TwoFactorErrorCode.RATE_LIMITED };
@@ -38,9 +45,14 @@ export class TotpService {
             const secret = this.userRepository.getSecret(user);
             if (!secret)
                 return { error: "2FA is not set up for this user", code: TwoFactorErrorCode.NOT_SET_UP };
-            return this.verifySecret(secret, code)
-                ? { ok: true }
-                : { error: "Wrong or expired OTP code", code: TwoFactorErrorCode.INVALID };
+            const step = this.findCodeStep(secret, code);
+            if (step === null)
+                return { error: "Wrong or expired OTP code", code: TwoFactorErrorCode.INVALID };
+            if (step <= ((_a = this.lastUsedCodeSteps.get(userPk)) !== null && _a !== void 0 ? _a : -Infinity)) {
+                return { error: "This code has already been used. Wait for the next one.", code: TwoFactorErrorCode.INVALID };
+            }
+            this.lastUsedCodeSteps.set(userPk, step);
+            return { ok: true };
         });
     }
     verifyAdminUserCode(adminUser, code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/services/totpService.ts

@@ -8,9 +8,11 @@ import type { VerificationFailure, VerificationResult } from "../utils/types.js"
 const CODE_ATTEMPT_RATE_LIMITS = ['30/1m', '300/1h', '1000/1d'];
 const VERIFIED_CODE_JWT_TYPE = 'verifiedTotpCode';
 const VERIFIED_CODE_TOKEN_TTL = '1m';
+const TOTP_STEP_SECONDS = 30;
 
 export class TotpService {
   private readonly codeAttemptLimiters = CODE_ATTEMPT_RATE_LIMITS.map((rate) => new RateLimiter(rate));
+  private readonly lastUsedCodeSteps = new Map<string, number>();
 
   constructor(
     private readonly options: PluginOptions,
@@ -23,7 +25,12 @@ export class TotpService {
   }
 
   public verifySecret(secret: string, code: string): boolean {
-    return Boolean(twofactor.verifyToken(secret, code, this.options.timeStepWindow));
+    return this.findCodeStep(secret, code) !== null;
+  }
+
+  private findCodeStep(secret: string, code: string): number | null {
+    const match = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
+    return match && Math.floor(Date.now() / 1000 / TOTP_STEP_SECONDS) + match.delta;
   }
 
   public async verifyUserCode(userPk: string, code: string): Promise<VerificationResult> {
@@ -38,9 +45,14 @@ export class TotpService {
     const secret = this.userRepository.getSecret(user);
     if (!secret) return { error: "2FA is not set up for this user", code: TwoFactorErrorCode.NOT_SET_UP };
 
-    return this.verifySecret(secret, code)
-      ? { ok: true }
-      : { error: "Wrong or expired OTP code", code: TwoFactorErrorCode.INVALID };
+    const step = this.findCodeStep(secret, code);
+    if (step === null) return { error: "Wrong or expired OTP code", code: TwoFactorErrorCode.INVALID };
+
+    if (step <= (this.lastUsedCodeSteps.get(userPk) ?? -Infinity)) {
+      return { error: "This code has already been used. Wait for the next one.", code: TwoFactorErrorCode.INVALID };
+    }
+    this.lastUsedCodeSteps.set(userPk, step);
+    return { ok: true };
   }
 
   public async verifyAdminUserCode(adminUser: AdminUser, code: string): Promise<{ ok: true; verifiedCodeToken: string } | VerificationFailure> {

package/tests/totpService.test.mjs

@@ -36,3 +36,30 @@ test('a correct code gives a token that confirms the code only for its user', as
   assert.equal(await service.isVerifiedCodeToken(verifiedCodeToken, 'user-2'), false);
   assert.equal(await service.isVerifiedCodeToken('forged', 'user-1'), false);
 });
+
+const STEP_MS = 30_000;
+const codeAt = (t, time) => {
+  t.mock.timers.setTime(time);
+  return twofactor.generateToken(SECRET).token;
+};
+
+test('a code confirms only one request, so a phished code can not be replayed', async (t) => {
+  t.mock.timers.enable({ apis: ['Date'], now: 1_000 * STEP_MS });
+  const service = createService();
+  const code = codeAt(t, 1_000 * STEP_MS);
+  const results = await Promise.all([service.verifyUserCode('user-1', code), service.verifyUserCode('user-1', code)]);
+  assert.equal(results.filter((result) => result.ok).length, 1);
+  assert.equal((await service.verifyUserCode('user-1', code)).code, TwoFactorErrorCode.INVALID);
+  assert.equal((await service.verifyAdminUserCode({ pk: 'user-1' }, code)).code, TwoFactorErrorCode.INVALID);
+  assert.deepEqual(await service.verifyUserCode('user-2', code), { ok: true });
+});
+
+test('after a code is used, older codes from the window are rejected and the next code is accepted', async (t) => {
+  t.mock.timers.enable({ apis: ['Date'], now: 1_000 * STEP_MS });
+  const service = createService();
+  const olderCode = codeAt(t, 1_000 * STEP_MS);
+  const code = codeAt(t, 1_001 * STEP_MS);
+  assert.deepEqual(await service.verifyUserCode('user-1', code), { ok: true });
+  assert.equal((await service.verifyUserCode('user-1', olderCode)).code, TwoFactorErrorCode.INVALID);
+  assert.deepEqual(await service.verifyUserCode('user-1', codeAt(t, 1_002 * STEP_MS)), { ok: true });
+});