maxibase 1.5.0 → 1.7.0

package/README.md

@@ -25,6 +25,31 @@ The tenant defaults to `organizations`: any work or school account, no personal
 `/auth/microsoft` signs in with the Microsoft account already signed in, link to
 `/auth/microsoft?prompt=select_account` to let the user pick another one.
 
+### Resetting a user's second factor
+
+A user who lost their passkeys, authenticator app and recovery codes has no way back in. Remove
+their factors in the database, they sign in with their password or an email code and, under
+`NUXT_FORCE_MFA`, are asked to set up a new one:
+
+```sql
+UPDATE auth.users SET totp = NULL WHERE email = 'user@example.com';
+DELETE FROM auth.credentials WHERE user_id = (SELECT id FROM auth.users WHERE email = 'user@example.com');
+DELETE FROM auth.recovery_codes WHERE user_id = (SELECT id FROM auth.users WHERE email = 'user@example.com');
+```
+
+### Deleting inactive users
+
+Each user's `last_active_on` is set to the day they last signed in or resumed a session. Set
+`NUXT_INACTIVE_USERS_RETENTION_DAYS` and the nightly `clean` task deletes the users inactive for
+longer, with everything that cascades from them and their `u/{id}` file folders, private and
+public. It is `0` by default, which keeps everyone. A user whose files can't be deleted is kept
+and retried the next night. A deleted user stays in the backups until they age out.
+
+`NUXT_INACTIVE_USERS_WARNING_DAYS` (30 by default) emails users that many days before, with
+their deletion date. A failed warning is retried every night but never delays the deletion,
+and signing in again cancels it. When the setting is first turned on, users already past the
+limit are deleted that night without a warning.
+
 ## Deployment
 
 ### On your server

package/layers/base/app/components/AuthCheck.vue

@@ -11,6 +11,8 @@ const email = ref('')
 const password = ref('')
 const otpRequested = ref(false)
 const totp = ref('')
+const recoveryCode = ref('')
+const useRecoveryCode = ref(false)
 const optionsFetched = ref(false)
 const showPassword = ref(false)
 const options = ref({
@@ -67,22 +69,20 @@ async function signInWithOtp() {
   }
 }
 
+function firstFactor(): { otp: string } | { password: string } {
+  if (password.value.length === 6 || password.value === route.query.token) {
+    return { otp: password.value }
+  }
+  return { password: password.value }
+}
+
 async function signInWithTOTP() {
   if (!email.value || !totp.value || !password.value) return
   isLoading.value = true
   try {
-    const body: {
-      email: string
-      token: string
-      otp?: string
-      password?: string
-    } = { email: email.value, token: totp.value }
-    if (password.value.length === 6 || password.value === route.query.token) {
-      body.otp = password.value
-    } else body.password = password.value
     await $fetch('/api/auth/totp/verify', {
       method: 'POST',
-      body,
+      body: { email: email.value, token: totp.value, ...firstFactor() },
     })
     await refreshSession()
     totp.value = ''
@@ -93,6 +93,28 @@ async function signInWithTOTP() {
   }
 }
 
+async function signInWithRecoveryCode() {
+  if (!email.value || !recoveryCode.value || !password.value) return
+  isLoading.value = true
+  try {
+    await $fetch('/api/auth/recovery/verify', {
+      method: 'POST',
+      body: {
+        email: email.value,
+        code: recoveryCode.value,
+        locale: useI18n().$getLocale(),
+        ...firstFactor(),
+      },
+    })
+    await refreshSession()
+    recoveryCode.value = ''
+  } catch (e: any) {
+    handleError(e)
+  } finally {
+    isLoading.value = false
+  }
+}
+
 async function signInWithPassword() {
   if (!email.value || !password.value) return
   isLoading.value = true
@@ -129,7 +151,8 @@ function signIn() {
     if (!email.value || isLoading.value) return
     // paste and change bypass the browser's check, which only guards the submit
     if (!signInForm.value?.reportValidity()) return
-    if (totp.value) signInWithTOTP()
+    if (useRecoveryCode.value) signInWithRecoveryCode()
+    else if (totp.value) signInWithTOTP()
     else if (password.value.length === 6) signInWithOtp()
     else signInWithPassword()
   }, 100)
@@ -180,7 +203,7 @@ async function getSignInOptions(email: string) {
   }
 }
 
-const pasteFields = { password, totp }
+const pasteFields = { password, totp, recoveryCode }
 
 async function pasteTo(field: keyof typeof pasteFields) {
   try {
@@ -260,7 +283,32 @@ onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
             </button>
           </div>
         </div>
-        <div v-if="options.hasTOTP">
+        <div v-if="useRecoveryCode">
+          <label for="recovery-code">{{ $t('authCheck.recoveryCode') }}</label>
+          <div class="group flex-row">
+            <input
+              id="recovery-code"
+              v-model.trim="recoveryCode"
+              type="text"
+              :disabled="isLoading || !password"
+              autocomplete="off"
+              autocapitalize="none"
+              pattern="[0-9a-fA-F]{5}-?[0-9a-fA-F]{5}"
+              required
+              @paste="signIn"
+            />
+            <button
+              type="button"
+              class="flex-center fg"
+              :title="$t('paste') as string"
+              :disabled="isLoading || !password"
+              @click="pasteTo('recoveryCode')"
+            >
+              <Icon name="lucide:clipboard-paste" />
+            </button>
+          </div>
+        </div>
+        <div v-else-if="options.hasTOTP">
           <label for="totp">{{ $t('authCheck.authenticatorCode') }}</label>
           <div class="group flex-row">
             <input
@@ -288,7 +336,11 @@ onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
         </div>
         <button
           type="submit"
-          :disabled="isLoading || (!password && !otpRequested) || (options.hasTOTP && !totp)"
+          :disabled="
+            isLoading ||
+            (!password && !otpRequested) ||
+            (useRecoveryCode ? !recoveryCode : options.hasTOTP && !totp)
+          "
           :class="['w mt1', isLoading ? 'spin' : '']"
         >
           {{ $t('authCheck.signin') }}
@@ -297,7 +349,7 @@ onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
           v-if="options.hasPasskey"
           type="button"
           :disabled="isLoading"
-          class="flex-center g1 w mt1 bg bg-border"
+          class="flex-center g2 w mt1 bg bg-border"
           @click="signInWithPasskey(email)"
         >
           <Icon name="lucide:key-round" />
@@ -312,6 +364,16 @@ onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
         >
           {{ $t('authCheck.getCode') }}
         </button>
+        <button
+          v-if="options.hasTOTP || options.hasPasskey"
+          type="button"
+          class="w"
+          style="background: none; border: none; color: inherit"
+          :disabled="isLoading"
+          @click="useRecoveryCode = !useRecoveryCode"
+        >
+          {{ useRecoveryCode ? $t('cancel') : $t('authCheck.useRecoveryCode') }}
+        </button>
         <p
           v-if="otpRequested"
           class="text-center"
@@ -349,7 +411,6 @@ onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
         <span class="text-center muted-text my1">{{ $t('or') }}</span>
         <button
           type="button"
-          :disabled="isLoading"
           class="provider flex-center g2 w mb1 fg b"
           style="font-weight: normal"
           @click="signInWithPasskey()"

package/layers/base/app/pages/user/auth.vue

@@ -12,6 +12,7 @@ type AuthInfo = {
   credentials: { id: string; name: string }[]
   hasPassword: boolean
   hasTOTP: boolean
+  recoveryCodes: number
   forceMfa: boolean
 }
 
@@ -19,8 +20,10 @@ const auth = ref<AuthInfo>({
   credentials: [],
   hasPassword: false,
   hasTOTP: false,
+  recoveryCodes: 0,
   forceMfa: false,
 })
+const recoveryCodes = ref<string[]>([])
 const TOTPSecret = ref('')
 const TOTPCode = ref('')
 const password1 = ref('')
@@ -54,6 +57,7 @@ const canRemovePasskey = computed(
   () => !auth.value?.forceMfa || auth.value.hasTOTP || auth.value.credentials.length > 1,
 )
 const canDisableTOTP = computed(() => !auth.value?.forceMfa || auth.value.credentials.length > 0)
+const hasSecondFactor = computed(() => auth.value.hasTOTP || auth.value.credentials.length > 0)
 
 async function getAuth() {
   try {
@@ -70,9 +74,11 @@ const { register } = useWebAuthn({
 async function registerPasskey() {
   try {
     if (!(await checkAuth())) return
+    const isFirstFactor = !hasSecondFactor.value
     await register({ userName: user.value!.email! })
     await getAuth()
     appStore.notify('saved', 'success')
+    if (isFirstFactor) await offerRecoveryCodes()
     if (isMfaSetup.value) {
       await fetchUserSession()
       if (!user.value?.requiresMfaSetup) await navigateTo('/', { replace: true })
@@ -189,6 +195,7 @@ async function confirmTOTP() {
   if (TOTPCode.value.length !== 6) return
   try {
     if (!(await checkAuth())) return
+    const isFirstFactor = !hasSecondFactor.value
     await $fetch('/api/auth/totp/confirm', {
       method: 'POST',
       body: { secret: TOTPSecret.value, token: TOTPCode.value },
@@ -197,6 +204,7 @@ async function confirmTOTP() {
     TOTPCode.value = ''
     auth.value.hasTOTP = true
     showTOTP.value = false
+    if (isFirstFactor) await offerRecoveryCodes()
     if (isMfaSetup.value) {
       await fetchUserSession()
       if (!user.value?.requiresMfaSetup) await navigateTo('/', { replace: true })
@@ -218,6 +226,38 @@ async function disableTOTP() {
   }
 }
 
+async function generateRecoveryCodes() {
+  try {
+    if (auth.value.recoveryCodes && !(await appStore.confirm($t('replaceRecoveryCodes') as string)))
+      return
+    if (!(await checkAuth())) return
+    const response = await $fetch<{ codes: string[] }>('/api/auth/recovery/generate', {
+      method: 'POST',
+    })
+    recoveryCodes.value = response.codes
+    auth.value.recoveryCodes = response.codes.length
+  } catch (e: any) {
+    appStore.notify(e?.data?.message || e?.message, 'error')
+  }
+}
+
+let recoveryCodesClosed: (() => void) | undefined
+
+function closeRecoveryCodes() {
+  recoveryCodes.value = []
+  recoveryCodesClosed?.()
+}
+
+// Resolves once the codes are closed, so the MFA setup redirect does not hide them
+async function offerRecoveryCodes() {
+  if (auth.value.recoveryCodes) return
+  if (!(await appStore.confirm($t('offerRecoveryCodes') as string))) return
+  await generateRecoveryCodes()
+  if (!recoveryCodes.value.length) return
+  await new Promise<void>((resolve) => (recoveryCodesClosed = resolve))
+  recoveryCodesClosed = undefined
+}
+
 async function deleteRefreshTokens() {
   if (!(await checkAuth())) return
   appStore.setLoading(true)
@@ -453,6 +493,25 @@ onMounted(getAuth)
           :title="canDisableTOTP ? '' : $t('lastFactor')"
           @click.prevent="toggleTOTP"
         />
+
+        <h3 class="mt2 mb0">{{ $t('recoveryCodes') }}</h3>
+        <p class="muted-text mt0">
+          {{ $t('recoveryCodesDescription') }}
+          <span
+            v-if="hasSecondFactor"
+            :class="auth.recoveryCodes < 5 ? 'danger-text' : ''"
+          >
+            {{ $t('recoveryCodesLeft', { count: auth.recoveryCodes }) }}
+          </span>
+        </p>
+        <button
+          class="flex"
+          :disabled="!hasSecondFactor"
+          :title="hasSecondFactor ? '' : $t('recoveryCodesRequireFactor')"
+          @click="generateRecoveryCodes"
+        >
+          {{ $t('generateRecoveryCodes') }}
+        </button>
       </section>
       <div class="flex-row my3">
         <button
@@ -464,6 +523,43 @@ onMounted(getAuth)
       </div>
     </template>
 
+    <div
+      v-if="recoveryCodes.length"
+      class="modal"
+    >
+      <div
+        class="p3"
+        style="max-width: min(400px, 90vw)"
+      >
+        <p class="mt0">{{ $t('recoveryCodesSave') }}</p>
+        <ul
+          class="text-center p0"
+          style="list-style: none; font-family: monospace; columns: 2"
+        >
+          <li
+            v-for="code in recoveryCodes"
+            :key="code"
+          >
+            {{ code }}
+          </li>
+        </ul>
+        <div class="flex-row g1">
+          <button
+            class="fg fg-border"
+            @click="copyToClipboard(recoveryCodes.join('\n'))"
+          >
+            {{ $t('copy') }}
+          </button>
+          <button
+            class="ml"
+            @click="closeRecoveryCodes"
+          >
+            {{ $t('recoveryCodesSaved') }}
+          </button>
+        </div>
+      </div>
+    </div>
+
     <div
       v-if="showTOTP && TOTPSecret"
       class="modal"

package/layers/base/nuxt.config.ts

@@ -74,6 +74,10 @@ export default defineNuxtConfig({
     logs: {
       retentionDays: 90,
     },
+    inactiveUsers: {
+      retentionDays: 0, // delete users inactive for this many days, 0 keeps them forever
+      warningDays: 30, // email users this many days before deletion, 0 deletes without warning
+    },
     rateLimit: {
       enabled: true,
       banMultiplier: 5, // banned after limit × multiplier requests in one window

package/layers/base/server/api/auth/anonymous.post.ts

@@ -16,7 +16,10 @@ export default defineEventHandler(async (event) => {
     })
   }
 
-  const insertedUsers = await db.insert(auth).values({}).returning()
+  const insertedUsers = await db
+    .insert(auth)
+    .values({ locale: useLocaleServerMiddleware(event).current })
+    .returning()
 
   if (!insertedUsers[0]) {
     throw createError({

package/layers/base/server/api/auth/index.get.ts

@@ -5,6 +5,7 @@ export default defineEventHandler(async (event) => {
     credentials: user.credentials!.map(({ id, name }) => ({ id, name })),
     hasPassword: !!user.password,
     hasTOTP: !!user.totp,
+    recoveryCodes: await countRecoveryCodes(user.id),
     forceMfa: useRuntimeConfig().forceMfa,
   }
 })

package/layers/base/server/api/auth/options.post.ts

@@ -7,15 +7,11 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   const { email } = await readValidatedBody(event, bodySchema.parse)
 
-  try {
-    const user = await getAuth(event, email, true)
-    return {
-      hasOTP: true,
-      hasPassword: !!user.password,
-      hasTOTP: !!user.totp,
-      hasPasskey: user.credentials!.length > 0,
-    }
-  } catch {
+  const user = await getAuth(event, email, true).catch((error: any) => {
+    if (error?.statusCode === 404) return null
+    throw error
+  })
+  if (!user) {
     return {
       hasOTP: true,
       hasPassword: false,
@@ -23,4 +19,11 @@ export default defineEventHandler(async (event) => {
       hasPasskey: false,
     }
   }
+
+  return {
+    hasOTP: true,
+    hasPassword: !!user.password,
+    hasTOTP: !!user.totp,
+    hasPasskey: user.credentials!.length > 0,
+  }
 })

package/layers/base/server/api/auth/otp/verify.post.ts

@@ -26,7 +26,7 @@ export default defineEventHandler(async (event) => {
 async function signUp(event: H3Event, email: string) {
   const session = await getUserSession(event)
   if (session?.user?.isAnonymous) return setAuth({ id: session.user.id, email })
-  if (useRuntimeConfig().autoSignup) return createAuth({ email })
+  if (useRuntimeConfig().autoSignup) return createAuth({ email }, event)
   throw createError({ status: 404, message: 'User not found' })
 }
 

package/layers/base/server/api/auth/recovery/generate.post.ts

@@ -0,0 +1,13 @@
+export default defineEventHandler(async (event) => {
+  await requireRecentAuth(event)
+  const user = await getAuth(event, undefined, true)
+
+  if (!user.totp && !user.credentials!.length) {
+    throw createError({ status: 400, message: 'Set up a second factor first.' })
+  }
+
+  const codes = await generateRecoveryCodes(user.id)
+  await log('Recovery codes generated', undefined, undefined, 'security', event)
+
+  return { codes }
+})

package/layers/base/server/api/auth/recovery/verify.post.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod'
+import { verifyFirstFactor } from '../totp/verify.post'
+
+export default defineEventHandler(async (event) => {
+  const {
+    email,
+    password,
+    otp,
+    code,
+    locale = 'en',
+  } = await readValidatedBody(
+    event,
+    z.object({
+      email: emailSchema,
+      password: passwordSchema().optional(),
+      otp: otpSchema.optional(),
+      code: z.string().min(10).max(16),
+      locale: z.string().optional(),
+    }).parse,
+  )
+
+  const user = await verifyFirstFactor(event, email, { password, otp })
+  if (!user) throw createError({ status: 400, message: 'Invalid recovery code.' })
+
+  await enforceRateLimit(event, 'recovery', { limit: 5, window: 900 }, user.id)
+
+  const remaining = await consumeRecoveryCode(user.id, code)
+  if (remaining === null) throw createError({ status: 400, message: 'Invalid recovery code.' })
+
+  if (otp) await useStorage('auth').removeItem(email)
+  const session = await setSession(event, user)
+
+  await log('Recovery code used', { remaining }, undefined, 'security', event)
+  await sendEmailTemplate('recoveryCodeUsed', locale, { remaining }, user.email!).catch(() => {})
+
+  return session
+})

package/layers/base/server/api/auth/totp/verify.post.ts

@@ -1,17 +1,13 @@
 import { z } from 'zod'
 import { verify } from 'otplib'
+import type { H3Event } from 'h3'
 import { verifyOTP } from '../otp/verify.post'
 
-export default defineEventHandler(async (event) => {
-  const { email, password, otp, token } = await readValidatedBody(
-    event,
-    z.object({
-      email: emailSchema,
-      password: passwordSchema().optional(),
-      otp: otpSchema.optional(),
-      token: z.string().length(6),
-    }).parse,
-  )
+export async function verifyFirstFactor(
+  event: H3Event,
+  email: string,
+  { password, otp }: { password?: string; otp?: string },
+) {
   if (!otp && !password) {
     throw createError({
       status: 400,
@@ -32,6 +28,22 @@ export default defineEventHandler(async (event) => {
     throw createError({ status: 400, message: 'Invalid password.' })
   }
 
+  return user
+}
+
+export default defineEventHandler(async (event) => {
+  const { email, password, otp, token } = await readValidatedBody(
+    event,
+    z.object({
+      email: emailSchema,
+      password: passwordSchema().optional(),
+      otp: otpSchema.optional(),
+      token: z.string().length(6),
+    }).parse,
+  )
+
+  const user = await verifyFirstFactor(event, email, { password, otp })
+
   if (!user?.totp) {
     throw createError({ status: 400, message: 'TOTP is not enabled.' })
   }

package/layers/base/server/api/auth/webauthn/authenticate.post.ts

@@ -14,6 +14,9 @@ export default defineWebAuthnAuthenticateEventHandler({
 
     return challenge as string
   },
+  getOptions() {
+    return { userVerification: passkeyUserVerification() }
+  },
   async allowCredentials(event, userName) {
     const user = await getAuth(event, userName, true)
     return (user as any).credentials || []
@@ -29,6 +32,8 @@ export default defineWebAuthnAuthenticateEventHandler({
     return credential as any
   },
   async onSuccess(event, { credential, authenticationInfo }) {
+    requireUserVerification(authenticationInfo.userVerified)
+
     // the next assertion must report a higher counter, which exposes a cloned authenticator
     await db
       .update(credentials)

package/layers/base/server/api/auth/webauthn/register.post.ts

@@ -14,6 +14,9 @@ const registerHandler = defineWebAuthnRegisterEventHandler({
 
     return challenge as string
   },
+  getOptions() {
+    return { authenticatorSelection: { userVerification: passkeyUserVerification() } }
+  },
   async validateUser(userBody, event) {
     const session = await requireUserSession(event)
     const parsed = z
@@ -28,7 +31,9 @@ const registerHandler = defineWebAuthnRegisterEventHandler({
 
     return parsed.data
   },
-  async onSuccess(event, { credential }) {
+  async onSuccess(event, { credential, registrationInfo }) {
+    requireUserVerification(registrationInfo.userVerified)
+
     const session = await requireUserSession(event)
     await db.insert(credentials).values({
       name: new Date().toISOString().substring(0, 10),

package/layers/base/server/database/relations.ts

@@ -13,6 +13,10 @@ export const authRelations = defineRelationsPart(schema, (r) => ({
       from: r.auth.id,
       to: r.credentials.userId,
     }),
+    recoveryCodes: r.many.recoveryCodes({
+      from: r.auth.id,
+      to: r.recoveryCodes.userId,
+    }),
   },
   refreshTokens: {
     auth: r.one.auth({
@@ -26,6 +30,12 @@ export const authRelations = defineRelationsPart(schema, (r) => ({
       to: r.auth.id,
     }),
   },
+  recoveryCodes: {
+    auth: r.one.auth({
+      from: r.recoveryCodes.userId,
+      to: r.auth.id,
+    }),
+  },
   logs: {
     auth: r.one.auth({
       from: r.logs.userId,

package/layers/base/server/database/schema.ts

@@ -4,6 +4,7 @@ import {
   text,
   integer,
   timestamp,
+  date,
   uuid,
   boolean,
   primaryKey,
@@ -23,6 +24,9 @@ export const auth = authSchema.table('users', {
   createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
   totp: text(),
   role: appRoleEnum().notNull().default('user'),
+  lastActiveOn: date({ mode: 'date' }).notNull().defaultNow(),
+  deletionWarnedOn: date({ mode: 'date' }),
+  locale: text(),
 })
 
 export const refreshTokens = authSchema.table('refresh_tokens', {
@@ -49,6 +53,18 @@ export const credentials = authSchema.table(
   (table) => [primaryKey({ columns: [table.userId, table.id] })],
 )
 
+export const recoveryCodes = authSchema.table(
+  'recovery_codes',
+  {
+    userId: uuid()
+      .notNull()
+      .references(() => auth.id, { onDelete: 'cascade' }),
+    code: text().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [primaryKey({ columns: [table.userId, table.code] })],
+)
+
 export const logs = authSchema.table(
   'logs',
   {

package/layers/base/server/middleware/1.session.ts

@@ -10,5 +10,6 @@ export default defineEventHandler(async (event) => {
 
     const sessionData = await setSession(event, user, false)
     session.user = sessionData?.user // to update the session on SSR
+    await updateLastActive(user.id)
   } catch {}
 })

package/layers/base/server/routes/auth/microsoft.get.ts

@@ -15,7 +15,7 @@ async function onSuccess(event: H3Event, { tokens }: { tokens: any }) {
     const config = useRuntimeConfig()
 
     if (error.statusCode === 404 && config.autoSignup) {
-      return createAuth({ email: claims.email })
+      return createAuth({ email: claims.email }, event)
     }
     throw error
   })

package/layers/base/server/tasks/clean.ts

@@ -1,7 +1,7 @@
 export default defineTask({
   meta: {
     name: 'clean',
-    description: 'Clean old backups, logs and unfinished uploads',
+    description: 'Clean old backups, logs, unfinished uploads and inactive users',
   },
   async run() {
     const config = useRuntimeConfig()
@@ -9,6 +9,7 @@ export default defineTask({
     const steps: [string, () => Promise<unknown>][] = [['backups', cleanOldBackups]]
     if (config.s3.privateBucket) steps.push(['S3 backups', cleanOldS3Backups])
     steps.push(['logs', cleanLogs], ['uploads', () => cleanTempUploads()])
+    if (config.inactiveUsers.retentionDays > 0) steps.push(['inactive users', cleanInactiveUsers])
 
     const results = await Promise.allSettled(steps.map(([, step]) => step()))
 

package/layers/base/server/utils/auth.ts

@@ -1,5 +1,5 @@
 import { auth, refreshTokens } from '#server/database/schema'
-import { eq, lte } from 'drizzle-orm'
+import { and, eq, inArray, isNotNull, isNull, lt, lte, or, sql } from 'drizzle-orm'
 import { createHash, randomBytes } from 'crypto'
 import type { H3Event } from 'h3'
 
@@ -32,11 +32,25 @@ export function requireSecondFactor(user: Pick<AuthUser, 'totp'> & { credentials
   }
 }
 
-export async function createAuth(user: Pick<AuthUser, 'email'>) {
+export function passkeyUserVerification(): 'required' | 'preferred' {
+  return useRuntimeConfig().forceMfa ? 'required' : 'preferred'
+}
+
+export function requireUserVerification(userVerified: boolean) {
+  if (useRuntimeConfig().forceMfa && !userVerified) {
+    throw createError({
+      status: 400,
+      message: 'Set a PIN on your security key to use it.',
+    })
+  }
+}
+
+export async function createAuth(user: Pick<AuthUser, 'email'>, event: H3Event) {
   const insertedUsers = await db
     .insert(auth)
     .values({
       email: user.email?.trim().toLowerCase(),
+      locale: useLocaleServerMiddleware(event).current,
     })
     .returning()
   if (!insertedUsers[0]) {
@@ -149,8 +163,99 @@ export function hashRefreshToken(token: string) {
   return createHash('sha256').update(token).digest('base64url')
 }
 
+export async function updateLastActive(userId: string) {
+  await db
+    .update(auth)
+    .set({ lastActiveOn: sql`current_date` })
+    .where(and(eq(auth.id, userId), lt(auth.lastActiveOn, sql`current_date`)))
+}
+
+export async function cleanInactiveUsers() {
+  const { retentionDays, warningDays } = useRuntimeConfig().inactiveUsers
+  const inactive = lt(auth.lastActiveOn, sql`current_date - ${retentionDays}::int`)
+
+  const users = await db.select({ id: auth.id }).from(auth).where(inactive)
+  const ids: string[] = []
+  for (const { id } of users) {
+    await deleteUserFiles(id).then(
+      () => ids.push(id),
+      () => {},
+    )
+  }
+
+  if (ids.length) {
+    const deleted = await db
+      .delete(auth)
+      .where(and(inArray(auth.id, ids), inactive))
+      .returning({ id: auth.id })
+    await log(
+      `Deleted ${deleted.length} users inactive for ${retentionDays} days`,
+      undefined,
+      'clean task',
+    )
+  }
+
+  const failedWarnings = warningDays > 0 ? await warnInactiveUsers(retentionDays, warningDays) : 0
+
+  const errors = []
+  if (users.length > ids.length) {
+    errors.push(`files of ${users.length - ids.length} users could not be deleted`)
+  }
+  if (failedWarnings) errors.push(`${failedWarnings} warnings failed to send`)
+  if (errors.length) throw new Error(`Inactive users: ${errors.join(', ')}`)
+}
+
+async function warnInactiveUsers(retentionDays: number, warningDays: number) {
+  const warnAfterDays = Math.max(retentionDays - warningDays, 0)
+
+  const users = await db
+    .select({
+      id: auth.id,
+      email: auth.email,
+      locale: auth.locale,
+      lastActiveOn: auth.lastActiveOn,
+    })
+    .from(auth)
+    .where(
+      and(
+        lt(auth.lastActiveOn, sql`current_date - ${warnAfterDays}::int`),
+        isNotNull(auth.email),
+        or(isNull(auth.deletionWarnedOn), lte(auth.deletionWarnedOn, auth.lastActiveOn)),
+      ),
+    )
+
+  let failed = 0
+  for (const user of users) {
+    // The first nightly run where lastActiveOn < current_date - retentionDays
+    const deletionOn = new Date(user.lastActiveOn.getTime() + daysToMilliseconds(retentionDays + 1))
+    const locale = user.locale ?? 'en'
+    const date = new Intl.DateTimeFormat(locale, { dateStyle: 'long', timeZone: 'UTC' }).format(
+      deletionOn,
+    )
+    try {
+      await sendEmailTemplate('inactiveDeletion', locale, { date }, user.email!)
+      await db
+        .update(auth)
+        .set({ deletionWarnedOn: sql`current_date` })
+        .where(eq(auth.id, user.id))
+    } catch {
+      failed++
+    }
+  }
+
+  if (users.length > failed) {
+    await log(
+      `Warned ${users.length - failed} inactive users of their deletion`,
+      undefined,
+      'clean task',
+    )
+  }
+  return failed
+}
+
 export async function createRefreshToken(userId: string, event: H3Event) {
   const token = generateRefreshToken()
+  await updateLastActive(userId)
 
   await db.insert(refreshTokens).values({
     userId,

package/layers/base/server/utils/files.ts

@@ -386,6 +386,20 @@ export async function getFile(
 
 export async function deletePath(event: H3Event, path: string, isPrivate = true) {
   await checkFileAccess(event, path)
+  await removePath(path, isPrivate)
+}
+
+// The u/{id} folders of the default checkFileAccess, private and public
+export async function deleteUserFiles(userId: string) {
+  const { s3 } = useRuntimeConfig()
+  for (const isPrivate of [true, false]) {
+    if (useS3() && !(isPrivate ? s3.privateBucket : s3.publicBucket)) continue
+    await removePath(`u/${userId}`, isPrivate)
+  }
+}
+
+// No access check, for server code acting on its own
+async function removePath(path: string, isPrivate: boolean) {
   path = getSecurePath(path, isPrivate)
   // An empty path resolves to the root folder, deleting it would wipe every file
   if (path === getSecurePath('', isPrivate)) throw invalidPath()

package/layers/base/server/utils/recoveryCodes.ts

@@ -0,0 +1,56 @@
+import { and, eq } from 'drizzle-orm'
+import { randomBytes } from 'crypto'
+import { recoveryCodes } from '#server/database/schema'
+
+const RECOVERY_CODE_COUNT = 10
+
+function generateRecoveryCode() {
+  const code = randomBytes(5).toString('hex')
+  return `${code.slice(0, 5)}-${code.slice(5)}`
+}
+
+function normalizeRecoveryCode(code: string) {
+  return code.toLowerCase().replace(/[^0-9a-f]/g, '')
+}
+
+export async function generateRecoveryCodes(userId: string) {
+  const codes = Array.from({ length: RECOVERY_CODE_COUNT }, generateRecoveryCode)
+  const hashes = await Promise.all(codes.map((code) => hashPassword(normalizeRecoveryCode(code))))
+
+  await db.transaction(async (tx) => {
+    await tx.delete(recoveryCodes).where(eq(recoveryCodes.userId, userId))
+    await tx.insert(recoveryCodes).values(hashes.map((code) => ({ userId, code })))
+  })
+
+  return codes
+}
+
+export async function consumeRecoveryCode(userId: string, code: string) {
+  const normalized = normalizeRecoveryCode(code)
+  const rows = await db
+    .select({ code: recoveryCodes.code })
+    .from(recoveryCodes)
+    .where(eq(recoveryCodes.userId, userId))
+
+  let match: string | undefined
+  for (const row of rows) {
+    if (await verifyPassword(row.code, normalized)) {
+      match = row.code
+      break
+    }
+  }
+  if (!match) return null
+
+  const deleted = await db
+    .delete(recoveryCodes)
+    .where(and(eq(recoveryCodes.userId, userId), eq(recoveryCodes.code, match)))
+    .returning()
+  // a concurrent request used it first
+  if (!deleted.length) return null
+
+  return rows.length - 1
+}
+
+export function countRecoveryCodes(userId: string) {
+  return db.$count(recoveryCodes, eq(recoveryCodes.userId, userId))
+}

package/locales/en.json

@@ -32,6 +32,8 @@
     "otpSent": "Code sent to {email}",
     "passkey": "Use a passkey",
     "password": "Password",
-    "signin": "Sign In"
+    "recoveryCode": "Recovery code",
+    "signin": "Sign In",
+    "useRecoveryCode": "Use a recovery code"
   }
 }

package/locales/fr.json

@@ -32,6 +32,8 @@
     "otpSent": "Code envoyé à {email}",
     "passkey": "Utiliser une passkey",
     "password": "Mot de passe",
-    "signin": "Se connecter"
+    "recoveryCode": "Code de récupération",
+    "signin": "Se connecter",
+    "useRecoveryCode": "Utiliser un code de récupération"
   }
 }

package/locales/pages/user-auth/en.json

@@ -17,5 +17,15 @@
   "registerPasskey": "Add a passkey",
   "settings": "Settings",
   "setupTotp": "Use an authenticator app",
-  "totpSecret": "Scan this QR code with your authenticator app or copy the code manually."
+  "totpSecret": "Scan this QR code with your authenticator app or copy the code manually.",
+  "copy": "Copy",
+  "generateRecoveryCodes": "Generate recovery codes",
+  "recoveryCodes": "Recovery codes",
+  "recoveryCodesDescription": "Single-use codes to sign in if you lose your passkey or authenticator app.",
+  "recoveryCodesLeft": "Codes left: {count}.",
+  "recoveryCodesRequireFactor": "Add a passkey or an authenticator app first.",
+  "recoveryCodesSave": "Save these codes somewhere safe, they will not be shown again. Each code works once.",
+  "recoveryCodesSaved": "I saved them",
+  "replaceRecoveryCodes": "Your current recovery codes will stop working. Generate new ones?",
+  "offerRecoveryCodes": "Generate recovery codes now? They let you sign in if you lose this device."
 }

package/locales/pages/user-auth/fr.json

@@ -17,5 +17,15 @@
   "registerPasskey": "Ajouter une passkey",
   "settings": "Paramètres",
   "setupTotp": "Utiliser une application d'authentification",
-  "totpSecret": "Scannez ce code QR avec votre application d'authentification ou copiez le code manuellement."
+  "totpSecret": "Scannez ce code QR avec votre application d'authentification ou copiez le code manuellement.",
+  "copy": "Copier",
+  "generateRecoveryCodes": "Générer des codes de récupération",
+  "recoveryCodes": "Codes de récupération",
+  "recoveryCodesDescription": "Codes à usage unique pour vous connecter si vous perdez votre passkey ou votre application d'authentification.",
+  "recoveryCodesLeft": "Codes restants : {count}.",
+  "recoveryCodesRequireFactor": "Ajoutez d'abord une passkey ou une application d'authentification.",
+  "recoveryCodesSave": "Conservez ces codes en lieu sûr, ils ne seront plus affichés. Chaque code ne fonctionne qu'une fois.",
+  "recoveryCodesSaved": "Je les ai sauvegardés",
+  "replaceRecoveryCodes": "Vos codes de récupération actuels ne fonctionneront plus. En générer de nouveaux ?",
+  "offerRecoveryCodes": "Générer des codes de récupération maintenant ? Ils vous permettent de vous connecter si vous perdez cet appareil."
 }

package/nuxt.config.ts

@@ -34,6 +34,8 @@ export default defineNuxtConfig({
         '/api/auth/email/verify': { limit: 10, window: 60 },
         '/api/auth/otp/verify': { limit: 10, window: 60 },
         '/api/auth/totp/verify': { limit: 10, window: 60 },
+        '/api/auth/recovery/verify': { limit: 10, window: 60 },
+        '/api/auth/recovery/generate': { limit: 5, window: 900 },
         '/api/auth/webauthn/authenticate': { limit: 10, window: 60 },
         '/api/auth/webauthn/register': { limit: 10, window: 60 },
         '/api/auth/anonymous': { limit: 5, window: 3600 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",

package/server/assets/emails/en/inactiveDeletion.html

@@ -0,0 +1,12 @@
+<title>Your {{appName}} account will be deleted</title>
+<p>
+  You haven't used {{appName}} for a long time, so your account and its data will be deleted on
+  {{date}}.
+</p>
+<p>To keep them, sign in before then.</p>
+<a
+  href="{{url}}"
+  class="button"
+>
+  Sign in
+</a>

package/server/assets/emails/en/recoveryCodeUsed.html

@@ -0,0 +1,3 @@
+<title>Recovery code used</title>
+<p>A recovery code was used to sign in to your account. Codes left: {{remaining}}.</p>
+<p>If this was not you, change your password and generate new recovery codes.</p>

package/server/assets/emails/fr/inactiveDeletion.html

@@ -0,0 +1,12 @@
+<title>Votre compte {{appName}} va être supprimé</title>
+<p>
+  Vous n'avez pas utilisé {{appName}} depuis longtemps, votre compte et ses données seront donc
+  supprimés le {{date}}.
+</p>
+<p>Pour les conserver, connectez-vous d'ici là.</p>
+<a
+  href="{{url}}"
+  class="button"
+>
+  Se connecter
+</a>

package/server/assets/emails/fr/recoveryCodeUsed.html

@@ -0,0 +1,8 @@
+<title>Code de récupération utilisé</title>
+<p>
+  Un code de récupération a été utilisé pour vous connecter à votre compte. Codes restants :
+  {{remaining}}.
+</p>
+<p>
+  Si ce n'était pas vous, changez votre mot de passe et générez de nouveaux codes de récupération.
+</p>