pgkiln 0.63.0 → 0.64.0

package/src/i18n/ru.ts

@@ -805,4 +805,38 @@ export const ru: Record<MessageKey, string> = {
   'ai_filter.per_group': "{what} по группам",
   'ai_filter.needs_number': "Для {fn} нужен столбец с числами.",
   'ai_filter.invalid': "Это изменение невозможно: {why}",
+  // (sprint 130) two-step sign-in
+  "mfa.step_title": "Двухэтапный вход",
+  "mfa.step_intro": "Введите 6-значный код из приложения-аутентификатора или один из кодов восстановления.",
+  "mfa.code": "Код",
+  "mfa.verify": "Подтвердить",
+  "mfa.wrong": "Код неверен или уже был использован.",
+  "mfa.expired": "Вход занял слишком много времени. Войдите снова.",
+  "mfa.enrol_title": "Настройка двухэтапного входа",
+  "mfa.enrol_intro": "Это приложение при входе запрашивает код из приложения-аутентификатора. Добавьте его сейчас, чтобы продолжить.",
+  "mfa.scan": "Отсканируйте QR-код приложением-аутентификатором, например Google Authenticator, Microsoft Authenticator или 1Password.",
+  "mfa.or_enter": "Или введите этот ключ:",
+  "mfa.enter_code": "Введите 6-значный код, который показывает приложение.",
+  "mfa.qr_label": "QR-код для приложения-аутентификатора",
+  "mfa.codes_title": "Коды восстановления",
+  "mfa.codes_once": "Храните эти коды в надёжном месте. Каждый из них позволяет войти один раз, если у вас нет телефона. Они показываются только сейчас.",
+  "mfa.codes_saved": "Я сохранил эти коды",
+  "mfa.continue": "Продолжить",
+  "mfa.no_key": "Двухэтапный вход на этом сервере ещё не настроен. Обратитесь к администратору.",
+  "mfa.app_name": "Название",
+  "mfa.app_default": "Приложение-аутентификатор",
+  "mfa.on": "При входе вы также вводите код из приложения-аутентификатора.",
+  "mfa.off": "Добавьте приложение-аутентификатор, чтобы защитить учётную запись вторым шагом при входе.",
+  "mfa.required_you": "Это приложение требует от вас двухэтапного входа: добавьте приложение-аутентификатор.",
+  "mfa.add_app": "Добавить приложение-аутентификатор",
+  "mfa.confirm_app": "Добавить приложение",
+  "mfa.cancel": "Отмена",
+  "mfa.remove": "Удалить",
+  "mfa.remove_code": "Текущий код или код восстановления",
+  "mfa.removed": "Приложение-аутентификатор удалено.",
+  "mfa.keep_one": "Это приложение требует от вас двухэтапного входа: прежде чем удалить это приложение, добавьте другое.",
+  "mfa.added": "Приложение-аутентификатор добавлено.",
+  "mfa.codes_left": "Осталось кодов восстановления: {n}",
+  "mfa.codes_new": "Новые коды восстановления",
+  "mfa.recovery_used": "Вы вошли с кодом восстановления. Осталось кодов восстановления: {n}.",
 };

package/src/i18n/sv.ts

@@ -805,4 +805,38 @@ export const sv: Record<MessageKey, string> = {
   'ai_filter.per_group': "{what} per grupp",
   'ai_filter.needs_number': "{fn} kräver en kolumn med tal.",
   'ai_filter.invalid': "Den ändringen går inte: {why}",
+  // (sprint 130) two-step sign-in
+  "mfa.step_title": "Inloggning i två steg",
+  "mfa.step_intro": "Ange den 6-siffriga koden från din autentiseringsapp, eller en av dina återställningskoder.",
+  "mfa.code": "Kod",
+  "mfa.verify": "Verifiera",
+  "mfa.wrong": "Koden är fel eller har redan använts.",
+  "mfa.expired": "Inloggningen tog för lång tid. Logga in igen.",
+  "mfa.enrol_title": "Konfigurera inloggning i två steg",
+  "mfa.enrol_intro": "Det här programmet ber om en kod från en autentiseringsapp när du loggar in. Lägg till en nu för att fortsätta.",
+  "mfa.scan": "Skanna QR-koden med en autentiseringsapp, till exempel Google Authenticator, Microsoft Authenticator eller 1Password.",
+  "mfa.or_enter": "Eller ange den här nyckeln:",
+  "mfa.enter_code": "Ange den 6-siffriga kod som appen visar.",
+  "mfa.qr_label": "QR-kod för en autentiseringsapp",
+  "mfa.codes_title": "Återställningskoder",
+  "mfa.codes_once": "Förvara koderna på ett säkert ställe. Var och en loggar in dig en gång när du inte har telefonen. De visas bara nu.",
+  "mfa.codes_saved": "Jag har sparat koderna",
+  "mfa.continue": "Fortsätt",
+  "mfa.no_key": "Inloggning i två steg är inte konfigurerad på den här servern än. Kontakta administratören.",
+  "mfa.app_name": "Namn",
+  "mfa.app_default": "Autentiseringsapp",
+  "mfa.on": "När du loggar in anger du också en kod från din autentiseringsapp.",
+  "mfa.off": "Lägg till en autentiseringsapp för att skydda ditt konto med ett andra steg när du loggar in.",
+  "mfa.required_you": "Det här programmet kräver inloggning i två steg för dig: lägg till en autentiseringsapp.",
+  "mfa.add_app": "Lägg till en autentiseringsapp",
+  "mfa.confirm_app": "Lägg till app",
+  "mfa.cancel": "Avbryt",
+  "mfa.remove": "Ta bort",
+  "mfa.remove_code": "En aktuell kod eller en återställningskod",
+  "mfa.removed": "Autentiseringsappen togs bort.",
+  "mfa.keep_one": "Det här programmet kräver inloggning i två steg för dig: lägg till en annan app innan du tar bort den här.",
+  "mfa.added": "Autentiseringsappen lades till.",
+  "mfa.codes_left": "Återstående återställningskoder: {n}",
+  "mfa.codes_new": "Nya återställningskoder",
+  "mfa.recovery_used": "Du loggade in med en återställningskod. Återstående återställningskoder: {n}.",
 };

package/src/i18n/tr.ts

@@ -805,4 +805,38 @@ export const tr: Record<MessageKey, string> = {
   'ai_filter.per_group': "grup başına {what}",
   'ai_filter.needs_number': "{fn} sayı içeren bir sütun gerektirir.",
   'ai_filter.invalid': "Bu değişiklik yapılamaz: {why}",
+  // (sprint 130) two-step sign-in
+  "mfa.step_title": "İki adımlı oturum açma",
+  "mfa.step_intro": "Kimlik doğrulama uygulamanızdaki 6 haneli kodu veya kurtarma kodlarınızdan birini girin.",
+  "mfa.code": "Kod",
+  "mfa.verify": "Doğrula",
+  "mfa.wrong": "Kod yanlış veya daha önce kullanılmış.",
+  "mfa.expired": "Oturum açma çok uzun sürdü. Lütfen yeniden oturum açın.",
+  "mfa.enrol_title": "İki adımlı oturum açmayı ayarlayın",
+  "mfa.enrol_intro": "Bu uygulama oturum açarken bir kimlik doğrulama uygulamasından kod ister. Devam etmek için şimdi bir tane ekleyin.",
+  "mfa.scan": "QR kodunu Google Authenticator, Microsoft Authenticator veya 1Password gibi bir kimlik doğrulama uygulamasıyla tarayın.",
+  "mfa.or_enter": "Veya bu anahtarı girin:",
+  "mfa.enter_code": "Uygulamanın gösterdiği 6 haneli kodu girin.",
+  "mfa.qr_label": "Kimlik doğrulama uygulaması için QR kodu",
+  "mfa.codes_title": "Kurtarma kodları",
+  "mfa.codes_once": "Bu kodları güvenli bir yerde saklayın. Telefonunuz yanınızda olmadığında her biri bir kez oturum açmanızı sağlar. Yalnızca şimdi gösterilirler.",
+  "mfa.codes_saved": "Bu kodları kaydettim",
+  "mfa.continue": "Devam",
+  "mfa.no_key": "İki adımlı oturum açma bu sunucuda henüz ayarlanmadı. Lütfen yöneticiye başvurun.",
+  "mfa.app_name": "Ad",
+  "mfa.app_default": "Kimlik doğrulama uygulaması",
+  "mfa.on": "Oturum açarken kimlik doğrulama uygulamanızdan bir kod da girersiniz.",
+  "mfa.off": "Oturum açarken hesabınızı ikinci bir adımla korumak için bir kimlik doğrulama uygulaması ekleyin.",
+  "mfa.required_you": "Bu uygulama sizin için iki adımlı oturum açmayı zorunlu kılıyor: bir kimlik doğrulama uygulaması ekleyin.",
+  "mfa.add_app": "Kimlik doğrulama uygulaması ekle",
+  "mfa.confirm_app": "Uygulama ekle",
+  "mfa.cancel": "İptal",
+  "mfa.remove": "Kaldır",
+  "mfa.remove_code": "Geçerli bir kod veya kurtarma kodu",
+  "mfa.removed": "Kimlik doğrulama uygulaması kaldırıldı.",
+  "mfa.keep_one": "Bu uygulama sizin için iki adımlı oturum açmayı zorunlu kılıyor: bunu kaldırmadan önce başka bir uygulama ekleyin.",
+  "mfa.added": "Kimlik doğrulama uygulaması eklendi.",
+  "mfa.codes_left": "Kalan kurtarma kodları: {n}",
+  "mfa.codes_new": "Yeni kurtarma kodları",
+  "mfa.recovery_used": "Kurtarma koduyla oturum açtınız. Kalan kurtarma kodları: {n}.",
 };

package/src/i18n/uk.ts

@@ -805,4 +805,38 @@ export const uk: Record<MessageKey, string> = {
   'ai_filter.per_group': "{what} за групами",
   'ai_filter.needs_number': "Для {fn} потрібен стовпець із числами.",
   'ai_filter.invalid': "Ця зміна неможлива: {why}",
+  // (sprint 130) two-step sign-in
+  "mfa.step_title": "Двоетапний вхід",
+  "mfa.step_intro": "Введіть 6-значний код із застосунку-автентифікатора або один із кодів відновлення.",
+  "mfa.code": "Код",
+  "mfa.verify": "Підтвердити",
+  "mfa.wrong": "Код неправильний або вже був використаний.",
+  "mfa.expired": "Вхід тривав надто довго. Увійдіть знову.",
+  "mfa.enrol_title": "Налаштування двоетапного входу",
+  "mfa.enrol_intro": "Цей застосунок під час входу запитує код із застосунку-автентифікатора. Додайте його зараз, щоб продовжити.",
+  "mfa.scan": "Відскануйте QR-код застосунком-автентифікатором, наприклад Google Authenticator, Microsoft Authenticator або 1Password.",
+  "mfa.or_enter": "Або введіть цей ключ:",
+  "mfa.enter_code": "Введіть 6-значний код, який показує застосунок.",
+  "mfa.qr_label": "QR-код для застосунку-автентифікатора",
+  "mfa.codes_title": "Коди відновлення",
+  "mfa.codes_once": "Зберігайте ці коди в надійному місці. Кожен із них дає змогу увійти один раз, коли у вас немає телефона. Вони показуються лише зараз.",
+  "mfa.codes_saved": "Я зберіг ці коди",
+  "mfa.continue": "Продовжити",
+  "mfa.no_key": "Двоетапний вхід на цьому сервері ще не налаштовано. Зверніться до адміністратора.",
+  "mfa.app_name": "Назва",
+  "mfa.app_default": "Застосунок-автентифікатор",
+  "mfa.on": "Під час входу ви також вводите код із застосунку-автентифікатора.",
+  "mfa.off": "Додайте застосунок-автентифікатор, щоб захистити обліковий запис другим кроком під час входу.",
+  "mfa.required_you": "Цей застосунок вимагає від вас двоетапного входу: додайте застосунок-автентифікатор.",
+  "mfa.add_app": "Додати застосунок-автентифікатор",
+  "mfa.confirm_app": "Додати застосунок",
+  "mfa.cancel": "Скасувати",
+  "mfa.remove": "Вилучити",
+  "mfa.remove_code": "Поточний код або код відновлення",
+  "mfa.removed": "Застосунок-автентифікатор вилучено.",
+  "mfa.keep_one": "Цей застосунок вимагає від вас двоетапного входу: перш ніж вилучити цей застосунок, додайте інший.",
+  "mfa.added": "Застосунок-автентифікатор додано.",
+  "mfa.codes_left": "Залишилося кодів відновлення: {n}",
+  "mfa.codes_new": "Нові коди відновлення",
+  "mfa.recovery_used": "Ви увійшли з кодом відновлення. Залишилося кодів відновлення: {n}.",
 };

package/src/i18n/zh.ts

@@ -805,4 +805,38 @@ export const zh: Record<MessageKey, string> = {
   'ai_filter.per_group': "每组 {what}",
   'ai_filter.needs_number': "{fn} 需要数字列。",
   'ai_filter.invalid': "无法进行此更改：{why}",
+  // (sprint 130) two-step sign-in
+  "mfa.step_title": "两步登录",
+  "mfa.step_intro": "请输入身份验证器应用中的 6 位代码，或你的一个恢复代码。",
+  "mfa.code": "代码",
+  "mfa.verify": "验证",
+  "mfa.wrong": "代码不正确，或已被使用。",
+  "mfa.expired": "登录耗时过长。请重新登录。",
+  "mfa.enrol_title": "设置两步登录",
+  "mfa.enrol_intro": "此应用程序在登录时需要身份验证器应用中的代码。请立即添加一个以继续。",
+  "mfa.scan": "使用身份验证器应用（如 Google Authenticator、Microsoft Authenticator 或 1Password）扫描二维码。",
+  "mfa.or_enter": "或输入此密钥：",
+  "mfa.enter_code": "输入应用显示的 6 位代码。",
+  "mfa.qr_label": "用于身份验证器应用的二维码",
+  "mfa.codes_title": "恢复代码",
+  "mfa.codes_once": "请将这些代码保存在安全的地方。没有手机时，每个代码可让你登录一次。它们只会显示这一次。",
+  "mfa.codes_saved": "我已保存这些代码",
+  "mfa.continue": "继续",
+  "mfa.no_key": "此服务器尚未设置两步登录。请联系管理员。",
+  "mfa.app_name": "名称",
+  "mfa.app_default": "身份验证器应用",
+  "mfa.on": "登录时，你还需要输入身份验证器应用中的代码。",
+  "mfa.off": "添加身份验证器应用，在登录时用第二步保护你的账户。",
+  "mfa.required_you": "此应用程序要求你使用两步登录：请添加身份验证器应用。",
+  "mfa.add_app": "添加身份验证器应用",
+  "mfa.confirm_app": "添加应用",
+  "mfa.cancel": "取消",
+  "mfa.remove": "移除",
+  "mfa.remove_code": "当前代码或恢复代码",
+  "mfa.removed": "已移除身份验证器应用。",
+  "mfa.keep_one": "此应用程序要求你使用两步登录：请先添加另一个应用，再移除此应用。",
+  "mfa.added": "已添加身份验证器应用。",
+  "mfa.codes_left": "剩余恢复代码：{n}",
+  "mfa.codes_new": "新的恢复代码",
+  "mfa.recovery_used": "你使用恢复代码登录了。剩余恢复代码：{n}。",
 };

package/src/i18n.ts

@@ -832,6 +832,40 @@ const en = {
   'ai_filter.per_group': "{what} per group",
   'ai_filter.needs_number': "{fn} needs a column with numbers.",
   'ai_filter.invalid': "That change is not possible: {why}",
+  // (sprint 130) two-factor sign-in
+  "mfa.step_title": "Two-factor sign-in",
+  "mfa.step_intro": "Enter the 6-digit code from your authenticator app, or one of your recovery codes.",
+  "mfa.code": "Code",
+  "mfa.verify": "Verify",
+  "mfa.wrong": "That code is not right, or it was used already.",
+  "mfa.expired": "Signing in took too long. Please sign in again.",
+  "mfa.enrol_title": "Set up two-factor sign-in",
+  "mfa.enrol_intro": "This application asks for a code from an authenticator app when you sign in. Add one now to continue.",
+  "mfa.scan": "Scan the QR code with an authenticator app, such as Google Authenticator, Microsoft Authenticator or 1Password.",
+  "mfa.or_enter": "Or enter this key:",
+  "mfa.enter_code": "Enter the 6-digit code the app shows.",
+  "mfa.qr_label": "QR code for an authenticator app",
+  "mfa.codes_title": "Recovery codes",
+  "mfa.codes_once": "Keep these codes in a safe place. Each one signs you in once when you don't have your phone. They are shown only now.",
+  "mfa.codes_saved": "I have saved these codes",
+  "mfa.continue": "Continue",
+  "mfa.no_key": "Two-factor sign-in is not set up on this server yet. Please ask the administrator.",
+  "mfa.app_name": "Name",
+  "mfa.app_default": "Authenticator app",
+  "mfa.on": "When you sign in, you also give a code from your authenticator app.",
+  "mfa.off": "Add an authenticator app to protect your account with a second step when you sign in.",
+  "mfa.required_you": "This application requires two-factor sign-in for you: add an authenticator app.",
+  "mfa.add_app": "Add an authenticator app",
+  "mfa.confirm_app": "Add app",
+  "mfa.cancel": "Cancel",
+  "mfa.remove": "Remove",
+  "mfa.remove_code": "A current code or a recovery code",
+  "mfa.removed": "The authenticator app was removed.",
+  "mfa.keep_one": "This application requires two-factor sign-in for you: add another app before you remove this one.",
+  "mfa.added": "The authenticator app was added.",
+  "mfa.codes_left": "Recovery codes left: {n}",
+  "mfa.codes_new": "New recovery codes",
+  "mfa.recovery_used": "You signed in with a recovery code. Recovery codes left: {n}.",
 };
 
 export type MessageKey = keyof typeof en;
@@ -1633,6 +1667,40 @@ const nl: Record<MessageKey, string> = {
   'ai_filter.per_group': "{what} per groep",
   'ai_filter.needs_number': "{fn} vraagt een kolom met getallen.",
   'ai_filter.invalid': "Die wijziging kan niet: {why}",
+  // (sprint 130) two-factor sign-in
+  "mfa.step_title": "Aanmelden in twee stappen",
+  "mfa.step_intro": "Voer de 6-cijferige code uit je authenticator-app in, of een van je herstelcodes.",
+  "mfa.code": "Code",
+  "mfa.verify": "Controleren",
+  "mfa.wrong": "Die code klopt niet, of is al gebruikt.",
+  "mfa.expired": "Het aanmelden duurde te lang. Meld je opnieuw aan.",
+  "mfa.enrol_title": "Aanmelden in twee stappen instellen",
+  "mfa.enrol_intro": "Deze applicatie vraagt bij het aanmelden om een code uit een authenticator-app. Voeg er nu een toe om verder te gaan.",
+  "mfa.scan": "Scan de QR-code met een authenticator-app, zoals Google Authenticator, Microsoft Authenticator of 1Password.",
+  "mfa.or_enter": "Of voer deze sleutel in:",
+  "mfa.enter_code": "Voer de 6-cijferige code in die de app toont.",
+  "mfa.qr_label": "QR-code voor een authenticator-app",
+  "mfa.codes_title": "Herstelcodes",
+  "mfa.codes_once": "Bewaar deze codes op een veilige plek. Met elke code meld je je één keer aan als je je telefoon niet bij je hebt. Ze worden alleen nu getoond.",
+  "mfa.codes_saved": "Ik heb deze codes bewaard",
+  "mfa.continue": "Doorgaan",
+  "mfa.no_key": "Aanmelden in twee stappen is op deze server nog niet ingesteld. Vraag het de beheerder.",
+  "mfa.app_name": "Naam",
+  "mfa.app_default": "Authenticator-app",
+  "mfa.on": "Bij het aanmelden geef je ook een code uit je authenticator-app.",
+  "mfa.off": "Voeg een authenticator-app toe om je account bij het aanmelden met een tweede stap te beschermen.",
+  "mfa.required_you": "Deze applicatie vereist voor jou aanmelden in twee stappen: voeg een authenticator-app toe.",
+  "mfa.add_app": "Authenticator-app toevoegen",
+  "mfa.confirm_app": "App toevoegen",
+  "mfa.cancel": "Annuleren",
+  "mfa.remove": "Verwijderen",
+  "mfa.remove_code": "Een actuele code of een herstelcode",
+  "mfa.removed": "De authenticator-app is verwijderd.",
+  "mfa.keep_one": "Deze applicatie vereist voor jou aanmelden in twee stappen: voeg eerst een andere app toe voordat je deze verwijdert.",
+  "mfa.added": "De authenticator-app is toegevoegd.",
+  "mfa.codes_left": "Resterende herstelcodes: {n}",
+  "mfa.codes_new": "Nieuwe herstelcodes",
+  "mfa.recovery_used": "Je hebt je aangemeld met een herstelcode. Resterende herstelcodes: {n}.",
 };
 
 const BUILTIN: Record<string, Record<string, string>> = { en, nl, de, fr, es, it, pt, pl, sv, da, nb, cs, ja, zh, fi, tr, el, ru, uk, ko, ar, he };

package/src/metadata.ts

@@ -78,6 +78,9 @@ export interface App {
   password_reset: boolean;
   /** (067) session sharing group (src/sharedlogin.ts) */
   session_group: string | null;
+  /** (132) two-step sign-in for the application's users (src/account-mfa.ts) */
+  mfa: 'off' | 'optional' | 'required' | 'roles';
+  mfa_roles: string[];
   /** LDAP directories the password form checks after local accounts */
   ldap_directories: string[];
   /** Progressive Web App: installable, offline pages, offline form queue */
@@ -369,7 +372,7 @@ const agg = (table: string, fk: string, parent: string, appId: string) =>
 // No caching on purpose: edits made in the builder show up on the next request.
 export async function loadApp(alias: string) {
   return runtime.one<App>(
-    `select a.id, a.alias, a.name, a.version, a.home_page, a.authentication, a.access_control, a.sso_providers, a.local_login, a.remember_me_days, a.login_page, a.password_reset, a.session_group, a.ldap_directories, a.header_name, a.header_auto_create, a.logout_url, a.db_auth_roles, a.db_auth_member_of, a.custom_auth_function, a.custom_auth_code, a.custom_auth_post_code, a.nav_list, a.navbar_list, a.pwa, a.pwa_short_name, a.pwa_icon is not null as pwa_has_icon, a.pwa_offline_pages, a.pwa_offline_submit, a.pwa_push, a.db_role, a.debug, a.debug_level, a.theme,
+    `select a.id, a.alias, a.name, a.version, a.home_page, a.authentication, a.access_control, a.sso_providers, a.local_login, a.remember_me_days, a.login_page, a.password_reset, a.session_group, a.mfa, a.mfa_roles, a.ldap_directories, a.header_name, a.header_auto_create, a.logout_url, a.db_auth_roles, a.db_auth_member_of, a.custom_auth_function, a.custom_auth_code, a.custom_auth_post_code, a.nav_list, a.navbar_list, a.pwa, a.pwa_short_name, a.pwa_icon is not null as pwa_has_icon, a.pwa_offline_pages, a.pwa_offline_submit, a.pwa_push, a.db_role, a.debug, a.debug_level, a.theme,
             a.availability, a.availability_message, a.availability_users, a.feedback, a.error_function, a.session_warning_seconds, a.component_settings,
             a.language, a.languages, a.language_from, a.date_format, a.timestamp_format, a.time_zone, a.time_zone_auto, a.currency,
             coalesce((select jsonb_agg(jsonb_build_object('name', l.name, 'query', l.query, 'rest_source', l.rest_source)) from meta.lov l where l.app_id = a.id), '[]') as lovs,

package/src/mfa.ts

@@ -94,6 +94,75 @@ export function newRecoveryCode(): string {
 export const normaliseCode = (code: string) => code.toLowerCase().replace(/[^a-z0-9]/g, '');
 export const hashCode = (code: string) => createHash('sha256').update(normaliseCode(code)).digest('hex');
 
+// ---------------------------------------------------------------- where factors are kept
+
+/**
+ * (sprint 130, SEC-3) The tables of one kind of user: developers (128, by user name) or application accounts
+ * (132, by account id). The code checks, recovery codes and the "each step once" rule are the same for both.
+ */
+export interface FactorStore { factors: string; codes: string; key: string }
+export const DEVELOPERS: FactorStore = { factors: 'meta.developer_factor', codes: 'meta.developer_recovery_code', key: 'username' };
+export const ACCOUNTS: FactorStore = { factors: 'meta.account_factor', codes: 'meta.account_recovery_code', key: 'account_id' };
+type Who = string | number;
+
+export async function storeCodesLeft(st: FactorStore, who: Who): Promise<number> {
+  return (await owner.one<{ n: number }>(`select count(*)::int as n from ${st.codes} where ${st.key} = $1 and confirmed and used_at is null`, [who]))!.n;
+}
+
+export async function storeHasFactor(st: FactorStore, who: Who): Promise<boolean> {
+  return !!(await owner.one(`select 1 as ok from ${st.factors} where ${st.key} = $1`, [who]));
+}
+
+export async function storeAddTotp(st: FactorStore, who: Who, name: string, secret: string, step: number) {
+  await owner.query(
+    `insert into ${st.factors} (${st.key}, kind, name, secret_enc, last_step, last_used_at) values ($1, 'totp', $2, $3, $4, now())`,
+    [who, name.trim().slice(0, 60) || 'Authenticator', encryptSecret(secret), step],
+  );
+}
+
+export async function storeNewCodes(st: FactorStore, who: Who): Promise<string[]> {
+  const codes = Array.from({ length: RECOVERY_CODES }, newRecoveryCode);
+  await owner.tx(async (c) => {
+    await c.query(`delete from ${st.codes} where ${st.key} = $1`, [who]);
+    for (const code of codes) await c.query(`insert into ${st.codes} (${st.key}, code_hash) values ($1, $2)`, [who, hashCode(code)]);
+  });
+  return codes;
+}
+
+export async function storeConfirmCodes(st: FactorStore, who: Who) {
+  await owner.query(`update ${st.codes} set confirmed = true where ${st.key} = $1 and used_at is null`, [who]);
+}
+
+/**
+ * Check a second-factor code: an authenticator code (each step once) or a confirmed, unused recovery code
+ * (then used up). Returns what matched, or null.
+ */
+export async function storeCheck(st: FactorStore, who: Who, code: string): Promise<{ kind: 'totp' | 'recovery'; name?: string } | null> {
+  const digits = code.replace(/\s/g, '');
+  if (/^\d{6}$/.test(digits)) {
+    const rows = (await owner.query<{ id: number; name: string; secret_enc: string; last_step: string | null }>(
+      `select id, name, secret_enc, last_step from ${st.factors} where ${st.key} = $1 and kind = 'totp'`, [who])).rows;
+    for (const f of rows) {
+      let secret: Buffer;
+      try {
+        secret = unbase32(decryptSecret(f.secret_enc));
+      } catch {
+        continue; // the instance key changed: recovery codes still work
+      }
+      const step = matchTotp(secret, digits, f.last_step === null ? null : Number(f.last_step));
+      // the update only wins once per step, also with two requests at the same time
+      if (step !== null && (await owner.query(`update ${st.factors} set last_step = $2, last_used_at = now() where id = $1 and (last_step is null or last_step < $2)`, [f.id, step])).rowCount)
+        return { kind: 'totp', name: f.name };
+    }
+    return null;
+  }
+  if (normaliseCode(code).length !== 10) return null;
+  const used = await owner.query(
+    `update ${st.codes} set used_at = now() where ${st.key} = $1 and code_hash = $2 and confirmed and used_at is null`,
+    [who, hashCode(code)]);
+  return used.rowCount ? { kind: 'recovery' } : null;
+}
+
 // ---------------------------------------------------------------- the developer's factors
 
 export interface Factor { id: number; kind: 'totp' | 'passkey'; name: string; created_at: string; last_used_at: string | null; rp_id: string | null }
@@ -103,22 +172,13 @@ export async function factorsOf(username: string, db: Pick<pg.ClientBase, 'query
 }
 
 /** Recovery codes left (confirmed, unused). */
-export async function codesLeft(username: string): Promise<number> {
-  return (await owner.one<{ n: number }>('select count(*)::int as n from meta.developer_recovery_code where username = $1 and confirmed and used_at is null', [username]))!.n;
-}
+export const codesLeft = (username: string) => storeCodesLeft(DEVELOPERS, username);
 
 /** Whether the developer has a working second factor (an authenticator app; recovery codes back it up). */
-export async function hasFactor(username: string): Promise<boolean> {
-  return !!(await owner.one('select 1 as ok from meta.developer_factor where username = $1', [username]));
-}
+export const hasFactor = (username: string) => storeHasFactor(DEVELOPERS, username);
 
 /** Add an authenticator app (after the developer confirmed a code from it). */
-export async function addTotp(username: string, name: string, secret: string, step: number) {
-  await owner.query(
-    `insert into meta.developer_factor (username, kind, name, secret_enc, last_step, last_used_at) values ($1, 'totp', $2, $3, $4, now())`,
-    [username, name.trim().slice(0, 60) || 'Authenticator', encryptSecret(secret), step],
-  );
-}
+export const addTotp = (username: string, name: string, secret: string, step: number) => storeAddTotp(DEVELOPERS, username, name, secret, step);
 
 // ---------------------------------------------------------------- passkeys (sprint 127)
 
@@ -211,48 +271,12 @@ export async function forgetBrowsers(username: string) {
 }
 
 /** New recovery codes (the old ones stop working); shown once, counted only when confirmed. */
-export async function newRecoveryCodes(username: string): Promise<string[]> {
-  const codes = Array.from({ length: RECOVERY_CODES }, newRecoveryCode);
-  await owner.tx(async (c) => {
-    await c.query('delete from meta.developer_recovery_code where username = $1', [username]);
-    for (const code of codes) await c.query('insert into meta.developer_recovery_code (username, code_hash) values ($1, $2)', [username, hashCode(code)]);
-  });
-  return codes;
-}
+export const newRecoveryCodes = (username: string) => storeNewCodes(DEVELOPERS, username);
 
-export async function confirmRecoveryCodes(username: string) {
-  await owner.query('update meta.developer_recovery_code set confirmed = true where username = $1 and used_at is null', [username]);
-}
+export const confirmRecoveryCodes = (username: string) => storeConfirmCodes(DEVELOPERS, username);
 
-/**
- * Check a second-factor code at sign-in: an authenticator code (each step once) or a confirmed, unused
- * recovery code (then used up). Returns what matched, or null.
- */
-export async function checkSecondFactor(username: string, code: string): Promise<{ kind: 'totp' | 'recovery'; name?: string } | null> {
-  const digits = code.replace(/\s/g, '');
-  if (/^\d{6}$/.test(digits)) {
-    const rows = (await owner.query<{ id: number; name: string; secret_enc: string; last_step: string | null }>(
-      'select id, name, secret_enc, last_step from meta.developer_factor where username = $1 and kind = $2', [username, 'totp'])).rows;
-    for (const f of rows) {
-      let secret: Buffer;
-      try {
-        secret = unbase32(decryptSecret(f.secret_enc));
-      } catch {
-        continue; // the instance key changed: recovery codes still work
-      }
-      const step = matchTotp(secret, digits, f.last_step === null ? null : Number(f.last_step));
-      // the update only wins once per step, also with two requests at the same time
-      if (step !== null && (await owner.query('update meta.developer_factor set last_step = $2, last_used_at = now() where id = $1 and (last_step is null or last_step < $2)', [f.id, step])).rowCount)
-        return { kind: 'totp', name: f.name };
-    }
-    return null;
-  }
-  if (normaliseCode(code).length !== 10) return null;
-  const used = await owner.query(
-    'update meta.developer_recovery_code set used_at = now() where username = $1 and code_hash = $2 and confirmed and used_at is null',
-    [username, hashCode(code)]);
-  return used.rowCount ? { kind: 'recovery' } : null;
-}
+/** Check a developer's second-factor code at sign-in (see storeCheck). */
+export const checkSecondFactor = (username: string, code: string) => storeCheck(DEVELOPERS, username, code);
 
 // ---------------------------------------------------------------- policy
 

package/src/remember.ts

@@ -56,7 +56,7 @@ export async function useRemember(req: FastifyRequest, reply: FastifyReply, a: R
   );
   if (!row || !row.active) return clear(), null;
   // an expired password needs the password form; access may have been withdrawn
-  if (row.method === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
+  if (row.method.split('+')[0] === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
   const access = await ssoAccess(a.id, row.username, row.groups);
   if (!access.allowed) return clear(), null;
   return { username: row.username, roles: access.roles, groups: row.groups, method: row.method, expiresAt: new Date(row.expires_at) };

package/src/runtime/account.ts

@@ -12,11 +12,13 @@ import { chrome, clientTexts } from './render.ts';
 import { appStyles, choosable, chosenStyleName, styleChoice } from './styles.ts';
 import { loadApp } from '../metadata.ts';
 import { pushSection } from './push.ts';
+import { twoStepSection } from './two-step.ts';
 import { appWithLocale, loadContext, safeNext, txContext, type Req } from './routes.ts';
 
 // "My account": details, own password, and preferences (light/dark and
 // language). APEX has the APIs for this (APEX_UTIL.CHANGE_CURRENT_USER_PW,
-// theme style per user); pgkiln provides the page itself.
+// theme style per user); pgkiln provides the page itself. (sprint 130)
+// Two-step sign-in: authenticator apps and recovery codes (two-step.ts).
 
 /** Keep a signed-in user's style variant for this app (meta.account_style; '' = the base colours). */
 async function saveStyle(appId: number, username: string, style: string) {
@@ -115,6 +117,7 @@ async function accountPage(ctx: PageContext, reply: FastifyReply, error?: string
               <form method="post" action="${ctx.base}/account/devices">${csrf}<button class="btn">${t('account.forget_devices')}</button></form>
             </div></section>`
           : ''}
+        ${await twoStepSection(ctx)}
         ${await pushSection(ctx)}
       </div>
     </div>

package/src/runtime/routes.ts

@@ -48,6 +48,8 @@ import { resolveLocale, THEME_COOKIE, themeCookieOptions, translateApp, translat
 import { chrome, dialogClosePage, languagePicker, renderPage } from './render.ts';
 import { LOGIN_ERROR, LOGIN_USER, safeNext, signInForm } from './signin.ts';
 import { passwordResetRoutes } from './password-reset.ts';
+import { passwordSignIn, twoStepRoutes } from './two-step.ts';
+import { carriesSecondStep } from '../account-mfa.ts';
 import { devbarOf, devbarRoutes, sessionDebugLevel } from './devbar.ts';
 import { availabilityRefusal } from './availability.ts';
 import { feedbackRoutes } from './feedback.ts';
@@ -229,7 +231,8 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // the session ended, but the browser was remembered: sign in again silently (a new token each time)
   if (app.authentication === 'app_users' && !session.username) {
     const remembered = await useRemember(req, reply, app);
-    if (remembered)
+    // (sprint 130) one made before the application asked this user for a second step doesn't stand in for it
+    if (remembered && (await carriesSecondStep(app, remembered.username, remembered.roles, remembered.method)))
       session = await signIn(req, reply, app, session, remembered.username, {
         extraRoles: remembered.roles, groups: remembered.groups, method: remembered.method,
         remember: true, rememberUntil: remembered.expiresAt, detail: 'remember me',
@@ -238,7 +241,7 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // (067) another application of the session sharing group was signed in to: sign in here too
   if (!session.username && sharingGroup(app)) {
     const shared = await useShared(req, reply, app);
-    if (shared)
+    if (shared && (await carriesSecondStep(app, shared.username, shared.roles, shared.method)))
       session = await signIn(req, reply, app, session, shared.username, {
         extraRoles: shared.roles, groups: shared.groups, method: shared.method, shared: shared.hash, detail: 'shared sign-in',
       });
@@ -619,6 +622,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
   fileRoutes(app, loadContext, txContext, forbidden);
   // (087) "Forgot password?"
   passwordResetRoutes(app);
+  twoStepRoutes(app);
   // (079) the developer toolbar's session state viewer and actions
   devbarRoutes(app, loadContext);
   // (084) users' feedback
@@ -1272,7 +1276,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
           logActivity({ appId: a.id, username: account, event: 'login_failed', ip, detail: `ldap:${d.name}: no access` });
           return fail(locale.t('login.no_access', { user: account, app: a.name }), 403);
         }
-        return completeLogin(req, reply, a, session, account, {
+        return passwordSignIn(req, reply, a, session, account, {
           next, remember, extraRoles: access.roles, groups: user.groups, method: `ldap:${d.name}`, detail: `ldap:${d.name}`,
         });
       }
@@ -1283,7 +1287,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       logActivity({ appId: a.id, username: r.username, event: 'password_expired', ip });
       return reply.type('text/html').send(expiredPage(a, locale, session, r.username, safeNext(a, next)));
     }
-    return completeLogin(req, reply, a, session, r.username, { next, remember });
+    return passwordSignIn(req, reply, a, session, r.username, { next, remember });
   });
 
   app.post('/a/:alias/password', async (req: Req, reply) => {
@@ -1309,7 +1313,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
     }
     logActivity({ appId: a.id, username, event: 'password_changed', ip });
     const canonical = (await runtime.one<{ username: string }>('select username from meta.account where lower(username) = lower($1)', [username]))!.username;
-    return completeLogin(req, reply, a, session, canonical, { next });
+    return passwordSignIn(req, reply, a, session, canonical, { next });
   });
 
   // ---------------------------------------------------------------- single sign-on (OpenID Connect)
@@ -1374,7 +1378,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       return simplePage(reply, 403, locale.t('login.no_access_title'), locale.t('login.no_access', { user: result.username, app: a.name }), `/a/${a.alias}/login`, locale);
     }
     const session = await getSession(req, reply, a.id, `/a/${a.alias}`);
-    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, detail: `sso:${p.name}` });
+    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, method: `sso:${p.name}`, detail: `sso:${p.name}` });
   };
 
   // SAML: the IdP posts the response cross-site, where SameSite=Lax cookies aren't sent; post it on