pgkiln 0.62.0 → 0.64.0

package/src/remember.ts

@@ -56,7 +56,7 @@ export async function useRemember(req: FastifyRequest, reply: FastifyReply, a: R
   );
   if (!row || !row.active) return clear(), null;
   // an expired password needs the password form; access may have been withdrawn
-  if (row.method === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
+  if (row.method.split('+')[0] === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
   const access = await ssoAccess(a.id, row.username, row.groups);
   if (!access.allowed) return clear(), null;
   return { username: row.username, roles: access.roles, groups: row.groups, method: row.method, expiresAt: new Date(row.expires_at) };

package/src/runtime/account.ts

@@ -12,11 +12,13 @@ import { chrome, clientTexts } from './render.ts';
 import { appStyles, choosable, chosenStyleName, styleChoice } from './styles.ts';
 import { loadApp } from '../metadata.ts';
 import { pushSection } from './push.ts';
+import { twoStepSection } from './two-step.ts';
 import { appWithLocale, loadContext, safeNext, txContext, type Req } from './routes.ts';
 
 // "My account": details, own password, and preferences (light/dark and
 // language). APEX has the APIs for this (APEX_UTIL.CHANGE_CURRENT_USER_PW,
-// theme style per user); pgkiln provides the page itself.
+// theme style per user); pgkiln provides the page itself. (sprint 130)
+// Two-step sign-in: authenticator apps and recovery codes (two-step.ts).
 
 /** Keep a signed-in user's style variant for this app (meta.account_style; '' = the base colours). */
 async function saveStyle(appId: number, username: string, style: string) {
@@ -115,6 +117,7 @@ async function accountPage(ctx: PageContext, reply: FastifyReply, error?: string
               <form method="post" action="${ctx.base}/account/devices">${csrf}<button class="btn">${t('account.forget_devices')}</button></form>
             </div></section>`
           : ''}
+        ${await twoStepSection(ctx)}
         ${await pushSection(ctx)}
       </div>
     </div>

package/src/runtime/routes.ts

@@ -16,7 +16,7 @@ import { accountRoles, loadApp, loadPage, type App, type Page, type Region } fro
 import { passwordDaysLeft, passwordProblem } from '../accounts.ts';
 import { english, type Translate } from '../i18n.ts';
 import { checksumValid, loginWindowMinutes, urlChecksum } from '../security.ts';
-import { enabledProviders, finishSignIn, loadProvider, ssoAccess, SsoError, startSignIn, type SsoResult } from '../sso.ts';
+import { builderSsoFinish, enabledProviders, finishSignIn, loadProvider, ssoAccess, SsoError, startSignIn, type Provider, type SsoResult } from '../sso.ts';
 import { sessionLimits, clientIp, createSession, destroySession, getSession, loginThrottled, logActivity, saveState, takeFlash, type Session } from '../session.ts';
 import { checkPageAccess, computeVisibility, Forbidden, isAuthorized } from './authz.ts';
 import { bindValues, dbg, publicError, stripSemicolon, timed, toState, writeOut, type PageContext } from './context.ts';
@@ -48,6 +48,8 @@ import { resolveLocale, THEME_COOKIE, themeCookieOptions, translateApp, translat
 import { chrome, dialogClosePage, languagePicker, renderPage } from './render.ts';
 import { LOGIN_ERROR, LOGIN_USER, safeNext, signInForm } from './signin.ts';
 import { passwordResetRoutes } from './password-reset.ts';
+import { passwordSignIn, twoStepRoutes } from './two-step.ts';
+import { carriesSecondStep } from '../account-mfa.ts';
 import { devbarOf, devbarRoutes, sessionDebugLevel } from './devbar.ts';
 import { availabilityRefusal } from './availability.ts';
 import { feedbackRoutes } from './feedback.ts';
@@ -229,7 +231,8 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // the session ended, but the browser was remembered: sign in again silently (a new token each time)
   if (app.authentication === 'app_users' && !session.username) {
     const remembered = await useRemember(req, reply, app);
-    if (remembered)
+    // (sprint 130) one made before the application asked this user for a second step doesn't stand in for it
+    if (remembered && (await carriesSecondStep(app, remembered.username, remembered.roles, remembered.method)))
       session = await signIn(req, reply, app, session, remembered.username, {
         extraRoles: remembered.roles, groups: remembered.groups, method: remembered.method,
         remember: true, rememberUntil: remembered.expiresAt, detail: 'remember me',
@@ -238,7 +241,7 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // (067) another application of the session sharing group was signed in to: sign in here too
   if (!session.username && sharingGroup(app)) {
     const shared = await useShared(req, reply, app);
-    if (shared)
+    if (shared && (await carriesSecondStep(app, shared.username, shared.roles, shared.method)))
       session = await signIn(req, reply, app, session, shared.username, {
         extraRoles: shared.roles, groups: shared.groups, method: shared.method, shared: shared.hash, detail: 'shared sign-in',
       });
@@ -619,6 +622,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
   fileRoutes(app, loadContext, txContext, forbidden);
   // (087) "Forgot password?"
   passwordResetRoutes(app);
+  twoStepRoutes(app);
   // (079) the developer toolbar's session state viewer and actions
   devbarRoutes(app, loadContext);
   // (084) users' feedback
@@ -1272,7 +1276,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
           logActivity({ appId: a.id, username: account, event: 'login_failed', ip, detail: `ldap:${d.name}: no access` });
           return fail(locale.t('login.no_access', { user: account, app: a.name }), 403);
         }
-        return completeLogin(req, reply, a, session, account, {
+        return passwordSignIn(req, reply, a, session, account, {
           next, remember, extraRoles: access.roles, groups: user.groups, method: `ldap:${d.name}`, detail: `ldap:${d.name}`,
         });
       }
@@ -1283,7 +1287,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       logActivity({ appId: a.id, username: r.username, event: 'password_expired', ip });
       return reply.type('text/html').send(expiredPage(a, locale, session, r.username, safeNext(a, next)));
     }
-    return completeLogin(req, reply, a, session, r.username, { next, remember });
+    return passwordSignIn(req, reply, a, session, r.username, { next, remember });
   });
 
   app.post('/a/:alias/password', async (req: Req, reply) => {
@@ -1309,7 +1313,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
     }
     logActivity({ appId: a.id, username, event: 'password_changed', ip });
     const canonical = (await runtime.one<{ username: string }>('select username from meta.account where lower(username) = lower($1)', [username]))!.username;
-    return completeLogin(req, reply, a, session, canonical, { next });
+    return passwordSignIn(req, reply, a, session, canonical, { next });
   });
 
   // ---------------------------------------------------------------- single sign-on (OpenID Connect)
@@ -1350,8 +1354,19 @@ export async function runtimeRoutes(app: FastifyInstance) {
   });
 
   /** The end of a single sign-on (OpenID Connect or SAML): the app's access rules, then the session. */
-  const finishSso = (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) =>
-    withAppDb(result.appId, () => finishSsoForApp(req, reply, p, result, ip));
+  const finishSso = (req: FastifyRequest, reply: FastifyReply, p: Provider, result: SsoResult, ip: string) => {
+    // (sprint 129) a sign-in to the builder
+    if (result.appId === null) {
+      const builder = builderSsoFinish();
+      if (!builder) return simplePage(reply, 404, english('error.not_found'), english('login.method_unavailable'));
+      return builder(req, reply, p, result, ip).catch((e) => {
+        if (!(e instanceof SsoError)) throw e;
+        logActivity({ username: result.link ?? result.username.slice(0, 100), event: 'login_failed', ip, detail: `builder sso:${p.name}: ${e.message}` });
+        return simplePage(reply, 403, english('login.sso_failed'), e.message, result.link ? '/builder/security' : '/builder/login');
+      });
+    }
+    return withAppDb(result.appId, () => finishSsoForApp(req, reply, p, result, ip));
+  };
   const finishSsoForApp = async (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) => {
     const alias = (await runtime.one<{ alias: string }>('select alias from meta.app where id = $1', [result.appId]))?.alias;
     const loaded = alias ? await appWithLocale(req, alias) : undefined;
@@ -1363,7 +1378,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       return simplePage(reply, 403, locale.t('login.no_access_title'), locale.t('login.no_access', { user: result.username, app: a.name }), `/a/${a.alias}/login`, locale);
     }
     const session = await getSession(req, reply, a.id, `/a/${a.alias}`);
-    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, detail: `sso:${p.name}` });
+    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, method: `sso:${p.name}`, detail: `sso:${p.name}` });
   };
 
   // SAML: the IdP posts the response cross-site, where SameSite=Lax cookies aren't sent; post it on

package/src/runtime/two-step.ts

@@ -0,0 +1,395 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import {
+  accountCodesLeft, accountFactors, accountHasFactor, accountId, addAccountTotp, checkAccountCode, confirmAccountCodes, mfaOn, mfaRequired,
+  newAccountCodes, removeAccountFactor, secondStep, withSecondStep,
+} from '../account-mfa.ts';
+import { html, raw, type Raw } from '../html.ts';
+import { documentShell } from '../layout.ts';
+import { accountRoles, type App } from '../metadata.ts';
+import { matchTotp, newTotpSecret, otpauthUri, unbase32 } from '../mfa.ts';
+import { qrSvg } from '../qrcode.ts';
+import { secretKeyConfigured } from '../secrets.ts';
+import { loginWindowMinutes } from '../security.ts';
+import { clientIp, getSession, loginThrottled, logActivity, saveState, type Session } from '../session.ts';
+import type { PageContext } from './context.ts';
+import type { Locale } from './locale.ts';
+import { pwaHead } from './pwa.ts';
+import { appWithLocale, completeLogin, loadContext, rootAttrs, safeNext, signIn, type Req } from './routes.ts';
+
+// (sprint 130, SEC-3) The second step of signing in to an application, and "Two-step sign-in" on My account.
+//
+// A password or LDAP sign-in that the application asks a second step of (src/account-mfa.ts) doesn't get a session
+// yet: what it would have become is kept in the signed-out session for five minutes (ten while adding an app), and
+// /a/<alias>/login/2fa asks for a code from the authenticator app or a recovery code. When the application requires
+// the step and the user has no app yet, the same page shows a QR code first, then the recovery codes once. Wrong
+// codes count as failed sign-ins (the same lockout). The sign-in's method gets "+2fa", so a remembered or shared
+// sign-in made from it may skip the step later.
+
+const PENDING = '__MFA';
+const STEP_SECONDS = 300;
+const ENROL_SECONDS = 600;
+
+interface Pending {
+  u: string;
+  next?: string;
+  remember?: boolean;
+  extraRoles?: string[];
+  groups?: string[];
+  method?: string;
+  detail?: string;
+  at: number;
+  enrol?: boolean;
+  /** while adding an app: the new secret, then (after its first code) the recovery codes to show once */
+  secret?: string;
+  codes?: string[];
+}
+
+function pendingOf(s: Session): Pending | null {
+  try {
+    const p = JSON.parse(String(s.state[PENDING] ?? '')) as Pending;
+    const limit = (p?.enrol ? ENROL_SECONDS : STEP_SECONDS) * 1000;
+    return p && typeof p.u === 'string' && Date.now() - Number(p.at) < limit ? p : null;
+  } catch {
+    return null;
+  }
+}
+
+interface PasswordSignIn {
+  next?: string;
+  remember?: boolean;
+  extraRoles?: string[];
+  groups?: string[];
+  method?: string;
+  detail?: string;
+}
+
+/**
+ * A password or LDAP sign-in that succeeded: signed in at once, or on to the second step when the application asks
+ * for one of this user.
+ */
+export async function passwordSignIn(req: FastifyRequest, reply: FastifyReply, a: App, session: Session, username: string, opts: PasswordSignIn = {}) {
+  const roles = [...(await accountRoles(a.id, username)), ...(opts.extraRoles ?? []).map((r) => r.toLowerCase())];
+  const need = await secondStep(a, username, roles);
+  if (!need) return completeLogin(req, reply, a, session, username, opts);
+  const p: Pending = { u: username, ...opts, at: Date.now(), enrol: need === 'enrol' };
+  session.state[PENDING] = JSON.stringify(p);
+  await saveState(session);
+  return reply.redirect(`/a/${a.alias}/login/2fa`, 303);
+}
+
+function card(a: App, locale: Locale, title: string, body: Raw) {
+  return documentShell(
+    `${title} · ${a.name}`,
+    html`<main class="login">
+      <div class="card login-card">
+        <h1>${title}</h1>
+        ${body}
+        <a class="login-forgot" href="/a/${a.alias}/login">${locale.t('reset.back')}</a>
+      </div>
+    </main>`,
+    'login-body',
+    {},
+    pwaHead(a),
+    rootAttrs(locale),
+  );
+}
+
+const csrfField = (s: Session) => html`<input type="hidden" name="__csrf" value="${s.csrf_token}">`;
+const alert = (error?: string) => html`${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}`;
+const grouped = (secret: string) => secret.replace(/(.{4})/g, '$1 ').trim();
+
+function codesList(codes: string[]) {
+  return html`<ol class="mfa-codes">${codes.map((c) => html`<li><code>${c}</code></li>`)}</ol>`;
+}
+
+/** The second step's page: a code; or a new app (QR code, then its first code); or the recovery codes, once. */
+function stepPage(a: App, locale: Locale, s: Session, p: Pending, error?: string) {
+  const t = locale.t;
+  const action = `/a/${a.alias}/login/2fa`;
+  if (p.codes)
+    return card(a, locale, t('mfa.codes_title'), html`<p>${t('mfa.codes_once')}</p>${codesList(p.codes)}
+      <form method="post" action="${action}/done" class="login-form">${csrfField(s)}
+        <label class="check"><input type="checkbox" name="saved" value="1" required> ${t('mfa.codes_saved')}</label>
+        <button class="btn btn-hot">${t('mfa.continue')}</button></form>`);
+  if (p.enrol && p.secret)
+    return card(a, locale, t('mfa.enrol_title'), html`<p class="muted">${t('mfa.enrol_intro')}</p>${alert(error)}
+      <ol class="mfa-steps">
+        <li>${t('mfa.scan')}</li>
+        <li>${t('mfa.or_enter')} <code class="mfa-secret">${grouped(p.secret)}</code></li>
+        <li>${t('mfa.enter_code')}</li>
+      </ol>
+      <div class="mfa-qr">${raw(qrSvg(otpauthUri(p.secret, p.u, a.name), { label: t('mfa.qr_label'), px: 4 }) ?? '')}</div>
+      <form method="post" action="${action}" class="login-form">${csrfField(s)}
+        <div class="field"><label class="label" for="code">${t('mfa.code')}</label><input id="code" name="code" required inputmode="numeric" autocomplete="one-time-code" maxlength="7" autofocus></div>
+        <button class="btn btn-hot">${t('mfa.verify')}</button></form>`);
+  return card(a, locale, t('mfa.step_title'), html`<p class="muted">${t('mfa.step_intro')}</p>${alert(error)}
+    <form method="post" action="${action}" class="login-form">${csrfField(s)}
+      <div class="field"><label class="label" for="code">${t('mfa.code')}</label><input id="code" name="code" required autocomplete="one-time-code" maxlength="20" spellcheck="false" autocapitalize="off" autofocus></div>
+      <button class="btn btn-hot">${t('mfa.verify')}</button></form>`);
+}
+
+/** The signed-out session's pending sign-in, or a page that says it expired. */
+async function start(req: Req, reply: FastifyReply) {
+  const loaded = await appWithLocale(req, req.params.alias);
+  if (!loaded) return null;
+  const session = await getSession(req, reply, loaded.app.id, `/a/${loaded.app.alias}`);
+  const { app: a, locale } = (await appWithLocale(req, req.params.alias, session))!;
+  const p = session.username ? null : pendingOf(session);
+  return { a, locale, session, p };
+}
+
+const expired = async (reply: FastifyReply, a: App, locale: Locale, s: Session) => {
+  delete s.state[PENDING];
+  await saveState(s);
+  return reply.code(410).type('text/html').send(card(a, locale, locale.t('mfa.step_title'), alert(locale.t('mfa.expired'))));
+};
+
+/** Sign in with the pending sign-in's options, now with "+2fa" in its method. */
+async function finish(req: Req, reply: FastifyReply, a: App, s: Session, p: Pending, detail: string, next?: string, flash?: string) {
+  const n = await signIn(req, reply, a, s, p.u, {
+    extraRoles: p.extraRoles, groups: p.groups, remember: p.remember, method: withSecondStep(p.method),
+    detail: `${p.detail ?? 'password'} ${detail}`,
+  });
+  if (flash) {
+    n.state.__FLASH = flash;
+    await saveState(n);
+  }
+  return reply.redirect(next ?? safeNext(a, p.next), 303);
+}
+
+export async function twoStepRoutes(app: FastifyInstance) {
+  app.get('/a/:alias/login/2fa', async (req: Req, reply) => {
+    const r = await start(req, reply);
+    if (!r) return reply.code(404).send('Not found');
+    const { a, locale, session: s, p } = r;
+    if (!p) return expired(reply, a, locale, s);
+    const id = await accountId(p.u);
+    if (id === null) return expired(reply, a, locale, s);
+    if (p.enrol && !p.codes && !(await accountHasFactor(id))) {
+      // fail closed: without the instance key there is nowhere safe to keep the app's secret
+      if (!secretKeyConfigured()) return reply.code(503).type('text/html').send(card(a, locale, locale.t('mfa.enrol_title'), alert(locale.t('mfa.no_key'))));
+      if (!p.secret) {
+        p.secret = newTotpSecret();
+        s.state[PENDING] = JSON.stringify(p);
+      }
+    }
+    await saveState(s);
+    return reply.type('text/html').send(stepPage(a, locale, s, p));
+  });
+
+  app.post('/a/:alias/login/2fa', async (req: Req, reply) => {
+    const r = await start(req, reply);
+    if (!r) return reply.code(404).send('Not found');
+    const { a, locale, session: s, p } = r;
+    const t = locale.t;
+    if (!p || req.body?.__csrf !== s.csrf_token) return expired(reply, a, locale, s);
+    const ip = clientIp(req);
+    const id = await accountId(p.u);
+    if (id === null) return expired(reply, a, locale, s);
+    if (await loginThrottled(a.id, p.u, ip)) {
+      logActivity({ appId: a.id, username: p.u, event: 'login_locked', ip, detail: '2fa' });
+      delete s.state[PENDING];
+      await saveState(s);
+      return reply.code(429).type('text/html').send(card(a, locale, t('mfa.step_title'), alert(t('login.throttled', { minutes: loginWindowMinutes() }))));
+    }
+    const code = String(req.body?.code ?? '').slice(0, 40);
+    // adding the first app while signing in: its first code proves it works
+    if (p.enrol && p.secret && !p.codes) {
+      const step = matchTotp(unbase32(p.secret), code.replace(/\s/g, ''), null);
+      if (step === null) {
+        await logActivity({ appId: a.id, username: p.u, event: 'login_failed', ip, detail: '2fa (new app)' });
+        return reply.code(401).type('text/html').send(stepPage(a, locale, s, p, t('mfa.wrong')));
+      }
+      await addAccountTotp(id, t('mfa.app_default'), p.secret, step);
+      await logActivity({ appId: a.id, username: p.u, event: '2fa_enrolled', ip, detail: 'authenticator app (sign-in)' });
+      p.codes = await newAccountCodes(id);
+      delete p.secret;
+      s.state[PENDING] = JSON.stringify(p);
+      await saveState(s);
+      return reply.type('text/html').send(stepPage(a, locale, s, p));
+    }
+    const ok = await checkAccountCode(id, code);
+    if (!ok) {
+      await logActivity({ appId: a.id, username: p.u, event: 'login_failed', ip, detail: '2fa' });
+      return reply.code(401).type('text/html').send(stepPage(a, locale, s, p, t('mfa.wrong')));
+    }
+    if (ok.kind === 'recovery') {
+      const left = await accountCodesLeft(id);
+      await logActivity({ appId: a.id, username: p.u, event: '2fa_recovery_used', ip, detail: `${left} left` });
+      // to My account: one code fewer, maybe time for new ones
+      return finish(req, reply, a, s, p, '2fa (recovery code)', `/a/${a.alias}/account#two-step`, t('mfa.recovery_used', { n: left }));
+    }
+    return finish(req, reply, a, s, p, '2fa');
+  });
+
+  // the recovery codes were shown once after adding the first app while signing in
+  app.post('/a/:alias/login/2fa/done', async (req: Req, reply) => {
+    const r = await start(req, reply);
+    if (!r) return reply.code(404).send('Not found');
+    const { a, locale, session: s, p } = r;
+    if (!p?.codes || req.body?.__csrf !== s.csrf_token) return expired(reply, a, locale, s);
+    if (req.body?.saved !== '1') return reply.code(422).type('text/html').send(stepPage(a, locale, s, p));
+    const id = await accountId(p.u);
+    if (id === null) return expired(reply, a, locale, s);
+    await confirmAccountCodes(id);
+    return finish(req, reply, a, s, p, '2fa (new app)');
+  });
+
+  // ---------------------------------------------------------------- My account → Two-step sign-in
+  const SECRET_MINUTES = 10;
+  const signedIn = async (req: Req, reply: FastifyReply) => {
+    const ctx = await loadContext(req, reply, { pageNo: 'home' });
+    if (!ctx) return null;
+    const id = await accountId(ctx.user);
+    if (req.body?.__csrf !== ctx.session.csrf_token || !mfaOn(ctx.app) || id === null) {
+      reply.redirect(`${ctx.base}/account`, 303);
+      return null;
+    }
+    return { ctx, id };
+  };
+  const done = async (reply: FastifyReply, ctx: PageContext, flash?: string, error?: boolean) => {
+    if (flash) ctx.session.state[error ? '__FLASH_ERROR' : '__FLASH'] = flash;
+    await saveState(ctx.session);
+    return reply.redirect(`${ctx.base}/account#two-step`, 303);
+  };
+
+  app.post('/a/:alias/account/2fa/start', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    if (secretKeyConfigured()) r.ctx.session.state.__TOTP_NEW = JSON.stringify({ secret: newTotpSecret(), at: Date.now() });
+    return done(reply, r.ctx);
+  });
+
+  app.post('/a/:alias/account/2fa/cancel', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    delete r.ctx.session.state.__TOTP_NEW;
+    return done(reply, r.ctx);
+  });
+
+  app.post('/a/:alias/account/2fa/confirm', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    const { ctx, id } = r;
+    const t = ctx.locale.t;
+    const pending = newSecret(ctx.session, SECRET_MINUTES);
+    if (!pending) {
+      delete ctx.session.state.__TOTP_NEW;
+      return done(reply, ctx, t('mfa.expired'), true);
+    }
+    const step = matchTotp(unbase32(pending), String(req.body?.code ?? '').replace(/\s/g, ''), null);
+    if (step === null) return done(reply, ctx, t('mfa.wrong'), true);
+    const first = !(await accountHasFactor(id));
+    await addAccountTotp(id, String(req.body?.name ?? '') || t('mfa.app_default'), pending, step);
+    delete ctx.session.state.__TOTP_NEW;
+    await logActivity({ appId: ctx.app.id, username: ctx.user, event: '2fa_enrolled', ip: ctx.ip, detail: 'authenticator app' });
+    if (first || !(await accountCodesLeft(id))) ctx.session.state.__CODES_NEW = JSON.stringify(await newAccountCodes(id));
+    return done(reply, ctx, t('mfa.added'));
+  });
+
+  app.post('/a/:alias/account/2fa/codes', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    if (!(await accountHasFactor(r.id))) return done(reply, r.ctx);
+    r.ctx.session.state.__CODES_NEW = JSON.stringify(await newAccountCodes(r.id));
+    await logActivity({ appId: r.ctx.app.id, username: r.ctx.user, event: '2fa_codes', ip: r.ctx.ip, detail: 'new recovery codes' });
+    return done(reply, r.ctx);
+  });
+
+  app.post('/a/:alias/account/2fa/codes/confirm', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    if (req.body?.saved !== '1') return done(reply, r.ctx);
+    await confirmAccountCodes(r.id);
+    delete r.ctx.session.state.__CODES_NEW;
+    return done(reply, r.ctx);
+  });
+
+  // removing an app asks for a code (from any app, or a recovery code): a session left open is not enough
+  app.post('/a/:alias/account/2fa/:id/delete', async (req: Req, reply) => {
+    const r = await signedIn(req, reply);
+    if (!r) return;
+    const { ctx, id } = r;
+    const t = ctx.locale.t;
+    if (await loginThrottled(ctx.app.id, ctx.user, ctx.ip)) {
+      logActivity({ appId: ctx.app.id, username: ctx.user, event: 'login_locked', ip: ctx.ip, detail: '2fa remove' });
+      return done(reply, ctx, t('login.throttled', { minutes: loginWindowMinutes() }), true);
+    }
+    const factors = await accountFactors(id);
+    const factorId = Number((req.params as { id?: string }).id);
+    if (!factors.some((f) => f.id === factorId)) return done(reply, ctx);
+    if (factors.length === 1 && mfaRequired(ctx.app, ctx.roles)) return done(reply, ctx, t('mfa.keep_one'), true);
+    if (!(await checkAccountCode(id, String(req.body?.code ?? '').slice(0, 40)))) {
+      await logActivity({ appId: ctx.app.id, username: ctx.user, event: 'login_failed', ip: ctx.ip, detail: '2fa remove' });
+      return done(reply, ctx, t('mfa.wrong'), true);
+    }
+    await removeAccountFactor(id, factorId);
+    await logActivity({ appId: ctx.app.id, username: ctx.user, event: '2fa_removed', ip: ctx.ip, detail: 'authenticator app' });
+    return done(reply, ctx, t('mfa.removed'));
+  });
+}
+
+/** The app secret being added on My account (kept in the session for some minutes), or null. */
+function newSecret(s: Session, minutes: number): string | null {
+  try {
+    const p = JSON.parse(String(s.state.__TOTP_NEW ?? ''));
+    return p && typeof p.secret === 'string' && Date.now() - Number(p.at) < minutes * 60_000 ? p.secret : null;
+  } catch {
+    return null;
+  }
+}
+
+/** My account → Two-step sign-in (when the application has a second step). */
+export async function twoStepSection(ctx: PageContext): Promise<Raw | ''> {
+  if (!mfaOn(ctx.app)) return '';
+  const id = await accountId(ctx.user);
+  if (id === null) return '';
+  const t = ctx.locale.t;
+  const [factors, left] = await Promise.all([accountFactors(id), accountCodesLeft(id)]);
+  const required = mfaRequired(ctx.app, ctx.roles);
+  const pending = newSecret(ctx.session, 10);
+  let shown: string[] | null = null;
+  try {
+    const c = JSON.parse(String(ctx.session.state.__CODES_NEW ?? ''));
+    shown = Array.isArray(c) ? c : null;
+  } catch {
+    shown = null;
+  }
+  const error = typeof ctx.session.state.__FLASH_ERROR === 'string' ? ctx.session.state.__FLASH_ERROR : '';
+  delete ctx.session.state.__FLASH_ERROR;
+  const base = `${ctx.base}/account/2fa`;
+  const csrf = html`<input type="hidden" name="__csrf" value="${ctx.session.csrf_token}">`;
+  const when = (v: string | null) => (v ? String(v).slice(0, 10) : '');
+  return html`<section class="region region-standard col-6" id="two-step"><header class="region-header"><h2>${t('mfa.step_title')}</h2></header><div class="region-body">
+    ${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
+    <p class="muted u-mt0">${factors.length ? t('mfa.on') : required ? t('mfa.required_you') : t('mfa.off')}</p>
+    ${shown
+      ? html`<h3>${t('mfa.codes_title')}</h3><p>${t('mfa.codes_once')}</p>${codesList(shown)}
+        <form method="post" action="${base}/codes/confirm">${csrf}
+          <label class="check"><input type="checkbox" name="saved" value="1" required> ${t('mfa.codes_saved')}</label>
+          <div class="buttons"><button class="btn btn-hot">${t('mfa.continue')}</button></div></form>`
+      : ''}
+    ${factors.length
+      ? html`<ul class="mfa-factors">${factors.map((f) => html`<li><strong>${f.name}</strong> <span class="muted">${when(f.created_at)}</span>
+          <details><summary class="link-button">${t('mfa.remove')}</summary>
+            <form method="post" action="${base}/${f.id}/delete">${csrf}
+              <div class="field"><label class="label" for="rm_${f.id}">${t('mfa.remove_code')}</label><input id="rm_${f.id}" name="code" required autocomplete="one-time-code" maxlength="20"></div>
+              <div class="buttons"><button class="btn btn-danger">${t('mfa.remove')}</button></div></form></details></li>`)}</ul>
+        <p>${t('mfa.codes_left', { n: left })}</p>
+        <form method="post" action="${base}/codes">${csrf}<button class="btn">${t('mfa.codes_new')}</button></form>`
+      : ''}
+    ${pending
+      ? html`<h3>${t('mfa.add_app')}</h3>
+        <ol class="mfa-steps"><li>${t('mfa.scan')}</li><li>${t('mfa.or_enter')} <code class="mfa-secret">${grouped(pending)}</code></li><li>${t('mfa.enter_code')}</li></ol>
+        <div class="mfa-qr">${raw(qrSvg(otpauthUri(pending, ctx.user, ctx.app.name), { label: t('mfa.qr_label'), px: 4 }) ?? '')}</div>
+        <form method="post" action="${base}/confirm">${csrf}
+          <div class="field"><label class="label" for="mfa_name">${t('mfa.app_name')}</label><input id="mfa_name" name="name" value="${t('mfa.app_default')}" required maxlength="60"></div>
+          <div class="field"><label class="label" for="mfa_code">${t('mfa.code')}</label><input id="mfa_code" name="code" required inputmode="numeric" autocomplete="one-time-code" maxlength="7"></div>
+          <div class="buttons"><button class="btn btn-hot">${t('mfa.confirm_app')}</button></div></form>
+        <form method="post" action="${base}/cancel">${csrf}<button class="link-button">${t('mfa.cancel')}</button></form>`
+      : secretKeyConfigured()
+        ? html`<form method="post" action="${base}/start">${csrf}<div class="buttons"><button class="btn${factors.length ? '' : ' btn-hot'}">${t('mfa.add_app')}</button></div></form>`
+        : html`<p class="alert alert-info" role="status">${t('mfa.no_key')}</p>`}
+  </div></section>`;
+}
+

package/src/saml.ts

@@ -76,7 +76,7 @@ function client(p: Provider, cache: CacheProvider) {
 }
 
 /** Start: the IdP URL with the AuthnRequest, and the browser-binding cookie value. */
-export async function startSamlSignIn(p: Provider, appId: number, next: string | undefined) {
+export async function startSamlSignIn(p: Provider, appId: number | null, next: string | undefined, link?: string) {
   const state = b64url(randomBytes(32));
   const browserKey = b64url(randomBytes(32));
   await owner.query(`delete from meta.sso_pending where created_at < now() - make_interval(mins => $1)`, [PENDING_MINUTES]);
@@ -86,9 +86,9 @@ export async function startSamlSignIn(p: Provider, appId: number, next: string |
   if (!requestId) throw new SsoError('The AuthnRequest has no ID.');
   // code_verifier is unused for SAML; nonce holds the AuthnRequest ID the response must answer
   await owner.query(
-    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next)
-     values ($1, $2, $3, '', $4, $5, $6)`,
-    [state, appId, p.id, requestId, sha256(browserKey), next ?? null],
+    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next, link_username)
+     values ($1, $2, $3, '', $4, $5, $6, $7)`,
+    [state, appId, p.id, requestId, sha256(browserKey), next ?? null, link ?? null],
   );
   return { url, browserKey };
 }
@@ -99,7 +99,7 @@ const values = (v: unknown): string[] => (v === undefined || v === null ? [] : (
 export async function finishSamlSignIn(p: Provider, body: { SAMLResponse?: string; RelayState?: string }, browserKey: string | undefined): Promise<SsoResult> {
   const pending = await owner.one(
     `delete from meta.sso_pending where state = $1 and provider_id = $2 and created_at > now() - make_interval(mins => $3)
-     returning app_id, nonce, browser_hash, next`,
+     returning app_id, nonce, browser_hash, next, link_username`,
     [body.RelayState ?? '', p.id, PENDING_MINUTES],
   );
   if (!pending) throw new SsoError('This sign-in has expired or was already used. Please try again.');
@@ -117,8 +117,14 @@ export async function finishSamlSignIn(p: Provider, body: { SAMLResponse?: strin
   if (!profile?.nameID) throw new SsoError('The SAML response names no user.');
   const username = p.username_claim === 'nameID' ? profile.nameID : values(profile[p.username_claim])[0];
   if (!usableUsername(username)) throw new SsoError(`The SAML response has no usable "${p.username_claim}" attribute.`);
-  const account = await resolveAccount(p, { sub: profile.nameID, name: values(profile.displayName ?? profile.cn)[0], email: profile.email ?? profile.mail }, username);
-  return { appId: pending.app_id, next: pending.next, username: account, groups: values(profile[p.groups_claim]) };
+  const name = values(profile.displayName ?? profile.cn)[0];
+  const email = values(profile.email ?? profile.mail)[0];
+  const groups = values(profile[p.groups_claim]);
+  if (pending.app_id === null)
+    // the builder: devsso.ts finds the developer (sprint 129)
+    return { appId: null, next: pending.next, username, groups, link: pending.link_username, identity: { subject: profile.nameID, name: name ?? null, email: email ?? null, mayLink: true } };
+  const account = await resolveAccount(p, { sub: profile.nameID, name, email: profile.email ?? profile.mail }, username);
+  return { appId: pending.app_id, next: pending.next, username: account, groups };
 }
 
 /** Service provider metadata (entity ID, ACS) to register pgkiln at the IdP. */

package/src/sharedlogin.ts

@@ -73,7 +73,7 @@ export async function useShared(req: FastifyRequest, reply: FastifyReply, a: Sha
     await owner.query('delete from meta.shared_login where token_hash = $1', [hash]);
     return clear(), null;
   }
-  if (row.method === 'password' && (await passwordDaysLeft(row.username)) === 0) return null;
+  if (row.method.split('+')[0] === 'password' && (await passwordDaysLeft(row.username)) === 0) return null;
   const access = await ssoAccess(a.id, row.username, row.groups);
   if (!access.allowed) return null; // no access to this app: its own sign-in page (the shared sign-in stays for the others)
   return { username: row.username, roles: access.roles, groups: row.groups, method: row.method, hash };