@cairs-npm/express-auth-2fa 0.1.2 → 0.1.3

package/dist/index.cjs

@@ -185,6 +185,12 @@ var configSchema = import_zod.z.object({
       (v) => typeof v === "function"
     )
   ]).default(false),
+  /**
+   * Project-wide 2-Step Verification switch. False: password sign-in never asks for a code
+   * (whatever each user chose) and the two-step setting can't be turned on. Passwordless
+   * sign-in still sends a code — it's the only factor there.
+   */
+  twoStepEnabled: import_zod.z.boolean().default(true),
   /** 2-Step Verification state for users who have not chosen one yet. */
   twoStepDefault: import_zod.z.boolean().default(false),
   limits: limitSchema.default({}),
@@ -647,11 +653,16 @@ var MethodService = class {
     const cred = await this.cols.credentials.findOne({ userId });
     const docs = await this.cols.methods.find({ userId, status: "active" }).toArray();
     const methods = docs.sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.createdAt.getTime() - b.createdAt.getTime()).map(toApiMethod);
-    return { twoStepEnabled: cred?.twoStepEnabled ?? this.config.twoStepDefault, methods };
+    const available = this.config.twoStepEnabled;
+    const twoStepEnabled = available && (cred?.twoStepEnabled ?? this.config.twoStepDefault);
+    return { twoStepEnabled, twoStepAvailable: available, methods };
   }
   /** BR-15 — enable needs ≥1 active method; disable needs step-up + revokes trusted devices. */
   async setTwoStep(userId, sid, enabled, stepUpToken) {
     const now = this.config.clock();
+    if (enabled && !this.config.twoStepEnabled) {
+      throw apiError(409, "VALIDATION_ERROR", "2-Step Verification is turned off for this application.");
+    }
     if (enabled) {
       await ensureEmailMethod(this.config, this.cols, userId);
       const count = await this.cols.methods.countDocuments({ userId, status: "active" });
@@ -891,8 +902,9 @@ var AuthService = class {
       throw apiError(423, "LOCKED", "Too many attempts. Try again later.", { retryAt: cred.lockedUntil });
     }
     await this.resetFailedLogins(cred, now);
-    const trustedOk = cred.twoStepEnabled && await this.checkTrustedDevice(req, user.id);
-    if (!cred.twoStepEnabled || trustedOk) {
+    const twoStep = this.config.twoStepEnabled && cred.twoStepEnabled;
+    const trustedOk = twoStep && await this.checkTrustedDevice(req, user.id);
+    if (!twoStep || trustedOk) {
       await this.audit.record(user.id, "login_success", ctx);
       return this.authenticate(user.id, req, res, ["pwd"], { rememberMe: input.rememberMe });
     }