wtclaude
60ebacff2c
Add opt-in "Trust this device" so a browser/app skips the TOTP step (never the password) for 30 days, single-use bcrypt recovery codes as a 2FA-lockout fallback, and admin trusted-device/MFA-reset management — backend, web UI, OpenAPI spec, and tests. - Schema: trusted_devices (sha256 token hash, looked up by unique index) and recovery_codes (bcrypt, single-use). Both additive/idempotent. - Session service: trust-token mint/hash/resolve + cap helpers; new rg_trust httpOnly cookie (survives logout, revoked on untrust/password change/reset/ TOTP disable). JWTs stay stateless — trust is a server-side row, not a claim. - Web + mobile login accept a trusted-device token / recovery code; login/totp gains trustDevice + recoveryCode. Cap of 10/user with NO silent pruning — an over-cap trust returns 409/trustLimitReached and the client prompts to revoke. - Self-service /auth/me/trusted-devices* + recovery-codes*; admin /admin/users/:id/trusted-devices* + /mfa/reset. All actions audit-logged. - Client: "Trust this device" + recovery-code login options, one-time recovery code display, Trusted Devices + Recovery Codes account panels, a TOTP-styled revoke-to-continue cap modal, and admin per-user security controls. - OpenAPI regenerated; 33 new server tests (all suites green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
2.3 KiB
JavaScript
47 lines
2.3 KiB
JavaScript
// ── Shared trusted-device establishment ────────────────────────────────────
|
|
//
|
|
// One place that mints + persists a trusted device, enforces the per-user cap
|
|
// (no silent pruning), and audit-logs it. Reused by every path that can create a
|
|
// trust: web /auth/login/totp, mobile /auth/mobile/login, and the authenticated
|
|
// self-service POST /auth/me/trusted-devices (the "revoke one, then retry" path
|
|
// after a cap-reached prompt).
|
|
//
|
|
// The caller decides how the returned trust token reaches the client: the web
|
|
// paths set the httpOnly rg_trust cookie (setTrustCookie); native paths return the
|
|
// token in the JSON body for EncryptedSharedPreferences. This helper never touches
|
|
// res, so it stays surface-agnostic.
|
|
|
|
const trustedDevices = require('../../../model/trustedDevices/trustedDevices.model')
|
|
const activity = require('../../../model/activity/activity.model')
|
|
const sessionService = require('../../../auth/session.service')
|
|
|
|
const log = require('../../../utils/logger')('trusted-device')
|
|
|
|
// Attempt to trust the current device for `user`. Returns:
|
|
// { ok: true, trustToken } — trusted; caller delivers the token
|
|
// { ok: false, capReached: true, devices } — at the cap; caller prompts to revoke
|
|
// `platform` is 'web' | 'mobile'; `deviceName` is the optional friendly label.
|
|
async function establishTrust(req, user, { platform = 'web', deviceName = null } = {}) {
|
|
if (await sessionService.trustDeviceCapReached(user.id)) {
|
|
const devices = await trustedDevices.listActiveForUser(user.id)
|
|
log.info('trust refused — device cap reached', { userId: user.id, platform })
|
|
return { ok: false, capReached: true, devices }
|
|
}
|
|
const meta = sessionService.sessionMeta(req)
|
|
const out = sessionService.mintTrustToken(meta)
|
|
await trustedDevices.store({
|
|
userId: user.id,
|
|
tokenHash: out.trustHash,
|
|
platform,
|
|
deviceName,
|
|
deviceHash: out.deviceHash,
|
|
userAgent: out.userAgent,
|
|
expiresAt: out.expiresAt,
|
|
})
|
|
await activity.log({ req, userId: user.id, action: 'account.trusted_device.add', detail: { platform } })
|
|
log.info('device trusted', { userId: user.id, platform })
|
|
return { ok: true, trustToken: out.trustToken }
|
|
}
|
|
|
|
module.exports = { establishTrust }
|