wtclaude
60ebacff2c
Add opt-in "Trust this device" so a browser/app skips the TOTP step (never the password) for 30 days, single-use bcrypt recovery codes as a 2FA-lockout fallback, and admin trusted-device/MFA-reset management — backend, web UI, OpenAPI spec, and tests. - Schema: trusted_devices (sha256 token hash, looked up by unique index) and recovery_codes (bcrypt, single-use). Both additive/idempotent. - Session service: trust-token mint/hash/resolve + cap helpers; new rg_trust httpOnly cookie (survives logout, revoked on untrust/password change/reset/ TOTP disable). JWTs stay stateless — trust is a server-side row, not a claim. - Web + mobile login accept a trusted-device token / recovery code; login/totp gains trustDevice + recoveryCode. Cap of 10/user with NO silent pruning — an over-cap trust returns 409/trustLimitReached and the client prompts to revoke. - Self-service /auth/me/trusted-devices* + recovery-codes*; admin /admin/users/:id/trusted-devices* + /mfa/reset. All actions audit-logged. - Client: "Trust this device" + recovery-code login options, one-time recovery code display, Trusted Devices + Recovery Codes account panels, a TOTP-styled revoke-to-continue cap modal, and admin per-user security controls. - OpenAPI regenerated; 33 new server tests (all suites green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
70 lines
2.5 KiB
JavaScript
70 lines
2.5 KiB
JavaScript
// Trusted-device store. Thin logic layer over trustedDevices.db — mirrors the
|
|
// mobileSessions model split (.db = SQL, .model = the API the rest of the app
|
|
// calls). The opaque trust token lives client-side; only its sha256 hash is
|
|
// persisted (hashing is done by the session service so caller + store agree, the
|
|
// same seam as mobile refresh tokens).
|
|
|
|
const db = require('./trustedDevices.db')
|
|
|
|
// Max active trusted devices per user. Enforced by assertUnderCap (no silent
|
|
// pruning — an over-cap trust attempt is refused so the client can prompt the user
|
|
// to revoke one first). See docs/website/TRUSTED_DEVICES_MFA.md §5.
|
|
const MAX_TRUSTED_DEVICES = Number(process.env.MAX_TRUSTED_DEVICES) || 10
|
|
|
|
// Persist a newly trusted device (by token hash). Returns the row id.
|
|
async function store({ userId, tokenHash, platform, deviceName, deviceHash, userAgent, expiresAt }) {
|
|
return db.insert({ userId, tokenHash, platform, deviceName, deviceHash, userAgent, expiresAt })
|
|
}
|
|
|
|
// Return the stored row for a still-valid (unrevoked, unexpired) trust token, else
|
|
// null. Used by the login path to decide whether the TOTP step can be skipped.
|
|
async function findValidByHash(tokenHash) {
|
|
return db.findValidByHash(tokenHash)
|
|
}
|
|
|
|
// Stamp last_used_at when a device's trust is honored at login.
|
|
async function touchLastUsed(id) {
|
|
return db.touchLastUsed(id)
|
|
}
|
|
|
|
// List a user's active trusted devices (self-service list + admin per-user view).
|
|
async function listActiveForUser(userId) {
|
|
return db.listActiveForUser(userId)
|
|
}
|
|
|
|
// True if the user is at/over the trusted-device cap. Callers refuse the insert and
|
|
// signal the client to revoke one first, rather than pruning silently.
|
|
async function isAtCap(userId) {
|
|
const n = await db.countActiveForUser(userId)
|
|
return n >= MAX_TRUSTED_DEVICES
|
|
}
|
|
|
|
// Revoke one of a user's trusted devices by row id (ownership-scoped). Returns rows
|
|
// changed (0 if it wasn't theirs / already gone — treat idempotently).
|
|
async function revokeByIdForUser(id, userId) {
|
|
return db.revokeByIdForUser(id, userId)
|
|
}
|
|
|
|
// Revoke all of a user's trusted devices ("untrust everywhere" + the invalidation
|
|
// hook on password change/reset / TOTP disable). Returns rows changed.
|
|
async function revokeAllForUser(userId) {
|
|
return db.revokeAllForUser(userId)
|
|
}
|
|
|
|
// Drop expired/revoked rows.
|
|
async function pruneExpired() {
|
|
return db.pruneExpired()
|
|
}
|
|
|
|
module.exports = {
|
|
MAX_TRUSTED_DEVICES,
|
|
store,
|
|
findValidByHash,
|
|
touchLastUsed,
|
|
listActiveForUser,
|
|
isAtCap,
|
|
revokeByIdForUser,
|
|
revokeAllForUser,
|
|
pruneExpired,
|
|
}
|