wtclaude
60ebacff2c
Add opt-in "Trust this device" so a browser/app skips the TOTP step (never the password) for 30 days, single-use bcrypt recovery codes as a 2FA-lockout fallback, and admin trusted-device/MFA-reset management — backend, web UI, OpenAPI spec, and tests. - Schema: trusted_devices (sha256 token hash, looked up by unique index) and recovery_codes (bcrypt, single-use). Both additive/idempotent. - Session service: trust-token mint/hash/resolve + cap helpers; new rg_trust httpOnly cookie (survives logout, revoked on untrust/password change/reset/ TOTP disable). JWTs stay stateless — trust is a server-side row, not a claim. - Web + mobile login accept a trusted-device token / recovery code; login/totp gains trustDevice + recoveryCode. Cap of 10/user with NO silent pruning — an over-cap trust returns 409/trustLimitReached and the client prompts to revoke. - Self-service /auth/me/trusted-devices* + recovery-codes*; admin /admin/users/:id/trusted-devices* + /mfa/reset. All actions audit-logged. - Client: "Trust this device" + recovery-code login options, one-time recovery code display, Trusted Devices + Recovery Codes account panels, a TOTP-styled revoke-to-continue cap modal, and admin per-user security controls. - OpenAPI regenerated; 33 new server tests (all suites green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
84 lines
5.7 KiB
JavaScript
84 lines
5.7 KiB
JavaScript
const express = require('express')
|
|
const { body } = require('express-validator')
|
|
|
|
const { login, refresh, logout } = require('./mobile.controller')
|
|
const { requireAuth } = require('../../../auth/session.middleware')
|
|
const { loginLimiter, mobileRefreshLimiter } = require('../../../middleware/rateLimit')
|
|
const { slowLogin, backoffGuard } = require('../../../middleware/loginProtection')
|
|
const validate = require('../../../middleware/validate')
|
|
const mobileSsoRouter = require('./mobileSso.routes')
|
|
|
|
const mobileRouter = express.Router()
|
|
|
|
// Native SSO authorization bridge (M9) — /auth/mobile/sso/{start,exchange}.
|
|
// Additive alongside the credential login below; reuses the website SSO flow and
|
|
// terminates in the same bearer tokens.
|
|
mobileRouter.use('/sso', mobileSsoRouter)
|
|
|
|
// Mobile login is a credential surface too, so it sits behind the SAME guards as
|
|
// web login (cheapest rejection first): per-IP backoff → progressive slowdown →
|
|
// hard rate cap.
|
|
const loginGuards = [backoffGuard, slowLogin, loginLimiter]
|
|
|
|
// POST /auth/mobile/login — { username, password, code? }
|
|
mobileRouter.post(
|
|
'/login',
|
|
// #swagger.tags = ['Auth · Mobile']
|
|
// #swagger.summary = 'Native login → access + refresh tokens'
|
|
// #swagger.description = 'Bearer-token login for native clients. Single-request 2FA: if the account has TOTP on and no/invalid code is supplied, returns 401 { totpRequired: true } and the client retries with a code (or a single-use recoveryCode). A previously trusted device may present the X-Trust-Token header to skip the code entirely. Set trustDevice to remember this device (the response then carries trustToken to store); if the trusted-device limit is reached the tokens are still issued and the response carries { trustLimitReached, devices }.'
|
|
/* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/MobileLoginRequest" } } } } */
|
|
/* #swagger.responses[200] = { description: 'Access + refresh tokens (optionally with trustToken / a trusted-device-limit prompt)', content: { "application/json": { schema: { $ref: "#/components/schemas/MobileTokenResponse" } } } } */
|
|
/* #swagger.responses[400] = { description: 'Validation error', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
|
|
/* #swagger.responses[401] = { description: 'Invalid credentials, or a TOTP code is required', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
/* #swagger.responses[429] = { description: 'Too many attempts (rate limited / backoff)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
...loginGuards,
|
|
body('username').isString().trim().notEmpty(),
|
|
body('password').isString().notEmpty(),
|
|
// Optional TOTP code (single-request 2FA); only checked when the account has 2FA on.
|
|
body('code').optional().isString().trim().isLength({ min: 6, max: 8 }),
|
|
// Optional single-use recovery code, an alternative second factor.
|
|
body('recoveryCode').optional({ values: 'falsy' }).isString().trim().isLength({ min: 8, max: 32 }),
|
|
// Optional opt-in to remember this device (skip TOTP on future logins).
|
|
body('trustDevice').optional().isBoolean(),
|
|
// Optional friendly device label for the Active Devices / Trusted Devices lists.
|
|
body('device_name').optional({ values: 'falsy' }).isString().trim().isLength({ max: 100 }),
|
|
validate,
|
|
login,
|
|
)
|
|
|
|
// POST /auth/mobile/refresh — { refreshToken }
|
|
mobileRouter.post(
|
|
'/refresh',
|
|
// #swagger.tags = ['Auth · Mobile']
|
|
// #swagger.summary = 'Rotate a refresh token for a fresh token pair'
|
|
// #swagger.description = 'Refresh tokens are single-use: the presented token is revoked and a new access + refresh pair is issued. Reusing a rotated token fails with 401.'
|
|
/* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/MobileRefreshRequest" } } } } */
|
|
/* #swagger.responses[200] = { description: 'New access + refresh tokens', content: { "application/json": { schema: { $ref: "#/components/schemas/MobileTokenResponse" } } } } */
|
|
/* #swagger.responses[400] = { description: 'Validation error', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
|
|
/* #swagger.responses[401] = { description: 'Invalid or expired session', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
/* #swagger.responses[429] = { description: 'Too many refresh attempts', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
mobileRefreshLimiter,
|
|
body('refreshToken').isString().notEmpty(),
|
|
validate,
|
|
refresh,
|
|
)
|
|
|
|
// POST /auth/mobile/logout — { refreshToken?, all? } — requires a valid bearer.
|
|
mobileRouter.post(
|
|
'/logout',
|
|
// #swagger.tags = ['Auth · Mobile']
|
|
// #swagger.summary = 'Revoke the current (or all) refresh tokens'
|
|
// #swagger.description = 'Requires a valid bearer access token. Revokes the given refresh token, or every session for the user when { all: true }. Idempotent.'
|
|
// #swagger.security = [{ "bearerAuth": [] }]
|
|
/* #swagger.requestBody = { content: { "application/json": { schema: { $ref: "#/components/schemas/MobileLogoutRequest" } } } } */
|
|
/* #swagger.responses[200] = { description: 'Logged out', content: { "application/json": { schema: { $ref: "#/components/schemas/Message" } } } } */
|
|
/* #swagger.responses[401] = { description: 'Missing or invalid bearer token', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
requireAuth,
|
|
body('refreshToken').optional().isString(),
|
|
body('all').optional().isBoolean(),
|
|
validate,
|
|
logout,
|
|
)
|
|
|
|
module.exports = mobileRouter
|