Something went wrong. Try again.
AtAuth
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366/** * MFA Routes * * Handles TOTP setup, verification, and backup code management */
import { Router, Request, Response } from 'express';import type { DatabaseService } from '../services/database.js';import type { MFAService } from '../services/mfa.js';import type { PasskeyService } from '../services/passkey.js';import type { OIDCService } from '../services/oidc/index.js';import { HttpError } from '../utils/errors.js';
export function createMFARouter( db: DatabaseService, mfaService: MFAService, passkeyService: PasskeyService | null, oidcService: OIDCService | null): Router { const router = Router();
/** * POST /auth/mfa/totp/setup * Start TOTP setup - returns secret and QR code */ router.post('/totp/setup', async (req: Request, res: Response) => { try { const { did, handle } = await authenticateRequest(req, db, oidcService);
if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
// Check if TOTP is already enabled if (mfaService.isTOTPEnabled(did)) { throw new HttpError(400, 'already_enabled', 'TOTP is already enabled'); }
const setup = await mfaService.setupTOTP(did, handle || '');
res.json({ success: true, ...setup, }); } catch (error) { handleError(res, error); } });
/** * POST /auth/mfa/totp/verify-setup * Verify TOTP code during setup to enable TOTP */ router.post('/totp/verify-setup', async (req: Request, res: Response) => { try { const { did } = await authenticateRequest(req, db, oidcService);
if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
const { code } = req.body as { code: string };
if (!code) { throw new HttpError(400, 'invalid_request', 'Missing code'); }
const success = mfaService.verifyAndEnableTOTP(did, code);
if (!success) { throw new HttpError(400, 'invalid_code', 'Invalid verification code'); }
// Generate backup codes const backupCodes = mfaService.generateBackupCodes(did);
res.json({ success: true, message: 'TOTP enabled successfully', backup_codes: backupCodes, }); } catch (error) { handleError(res, error); } });
/** * POST /auth/mfa/totp/verify * Verify TOTP code during login * Requires authentication -- DID comes from the authenticated session, not the request body */ router.post('/totp/verify', async (req: Request, res: Response) => { try { const { did: authedDid } = await authenticateRequest(req, db, oidcService); const { code, client_id, scope } = req.body as { code: string; client_id?: string; scope?: string; };
const did = authedDid; if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
if (!code) { throw new HttpError(400, 'invalid_request', 'Missing code'); }
const success = mfaService.verifyTOTP(did, code);
if (!success) { throw new HttpError(401, 'invalid_code', 'Invalid TOTP code'); }
// If OIDC service is available and client_id is provided, issue tokens if (oidcService && client_id) { const client = db.getOIDCClient(client_id); const mapping = db.getUserMapping(did, client_id); if (client) { const tokenResponse = oidcService.tokenService.createTokenResponse({ sub: did, clientId: client_id, scope: scope || 'openid', did, handle: mapping?.handle || '', accessTokenTtl: client.access_token_ttl_seconds, idTokenTtl: client.id_token_ttl_seconds, });
return res.json({ success: true, did, tokens: tokenResponse, }); } }
res.json({ success: true, did, }); } catch (error) { handleError(res, error); } });
/** * POST /auth/mfa/totp/disable * Disable TOTP for the authenticated user */ router.post('/totp/disable', async (req: Request, res: Response) => { try { const { did } = await authenticateRequest(req, db, oidcService);
if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
const { code } = req.body as { code: string };
if (!code) { throw new HttpError(400, 'invalid_request', 'Missing code'); }
// Verify code before disabling const verified = mfaService.verifyTOTP(did, code); if (!verified) { throw new HttpError(401, 'invalid_code', 'Invalid TOTP code'); }
mfaService.disableTOTP(did);
res.json({ success: true, message: 'TOTP disabled successfully', }); } catch (error) { handleError(res, error); } });
/** * POST /auth/mfa/backup-codes * Generate new backup codes (regenerates all codes) */ router.post('/backup-codes', async (req: Request, res: Response) => { try { const { did } = await authenticateRequest(req, db, oidcService);
if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
const { code } = req.body as { code: string };
// Require TOTP verification to regenerate backup codes if (!mfaService.isTOTPEnabled(did)) { throw new HttpError(400, 'totp_not_enabled', 'TOTP must be enabled to generate backup codes'); }
if (!code) { throw new HttpError(400, 'invalid_request', 'Missing TOTP code'); }
const verified = mfaService.verifyTOTP(did, code); if (!verified) { throw new HttpError(401, 'invalid_code', 'Invalid TOTP code'); }
const backupCodes = mfaService.generateBackupCodes(did);
res.json({ success: true, codes: backupCodes, generated_at: new Date().toISOString(), }); } catch (error) { handleError(res, error); } });
/** * POST /auth/mfa/backup-codes/verify * Verify a backup code during login * Requires authentication -- DID comes from the authenticated session, not the request body */ router.post('/backup-codes/verify', async (req: Request, res: Response) => { try { const { did: authedDid } = await authenticateRequest(req, db, oidcService); const { code, client_id, scope } = req.body as { code: string; client_id?: string; scope?: string; };
const did = authedDid; if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
if (!code) { throw new HttpError(400, 'invalid_request', 'Missing code'); }
const success = mfaService.verifyBackupCode(did, code);
if (!success) { throw new HttpError(401, 'invalid_code', 'Invalid backup code'); }
// If OIDC service is available and client_id is provided, issue tokens if (oidcService && client_id) { const client = db.getOIDCClient(client_id); const mapping = db.getUserMapping(did, client_id); if (client) { const tokenResponse = oidcService.tokenService.createTokenResponse({ sub: did, clientId: client_id, scope: scope || 'openid', did, handle: mapping?.handle || '', accessTokenTtl: client.access_token_ttl_seconds, idTokenTtl: client.id_token_ttl_seconds, });
return res.json({ success: true, did, tokens: tokenResponse, }); } }
res.json({ success: true, did, }); } catch (error) { handleError(res, error); } });
/** * GET /auth/mfa/status * Get MFA status for the authenticated user */ router.get('/status', async (req: Request, res: Response) => { try { const { did } = await authenticateRequest(req, db, oidcService);
if (!did) { throw new HttpError(401, 'unauthorized', 'Authentication required'); }
const passkeyCount = passkeyService?.getPasskeyCount(did) ?? 0; const status = mfaService.getMFAStatus(did, passkeyCount);
res.json({ success: true, ...status, }); } catch (error) { handleError(res, error); } });
return router;}
/** * Authenticate request via session cookie or access token */async function authenticateRequest( req: Request, db: DatabaseService, oidcService: OIDCService | null): Promise<{ did?: string; handle?: string }> { // Try to authenticate via access token const authHeader = req.headers.authorization; if (authHeader?.startsWith('Bearer ') && oidcService) { const token = authHeader.slice(7); const claims = oidcService.tokenService.verifyAccessToken(token); if (claims) { const mapping = db.getUserMapping(claims.sub, claims.client_id); return { did: claims.sub, handle: mapping?.handle, }; } }
// Try to authenticate via session header const sessionId = req.headers['x-session-id'] as string; if (sessionId) { const session = db.getSession(sessionId); if (session && new Date(session.expires_at) > new Date()) { return { did: session.did, handle: session.handle, }; } }
return {};}
/** * Handle errors consistently */function handleError(res: Response, error: unknown): void { if (error instanceof HttpError) { res.status(error.statusCode).json({ error: error.code, message: error.message, }); return; }
console.error('[MFA] Error:', error); res.status(500).json({ error: 'server_error', message: 'Internal server error', });}