ogrechkoandClaude Sonnet 5
1a31f72dd8
2FA was previously local-accounts-only, gated on the assumption that LDAP already has its own MFA story — that's not actually guaranteed (depends on what's behind the directory), so app-level TOTP is now available for LDAP accounts too, as a second factor independent of whatever the directory does or doesn't enforce. The login route's LDAP branch now checks user.totpEnabled the same way the local branch already did, routing through the same login-challenge flow before minting a session. This forced a change to disabling 2FA: it used to require the current password, but an LDAP-provisioned user has passwordHash: null — there's no password to check. Disable now requires a live TOTP code or a recovery code instead (same "prove you still hold the factor" idea, just checking the right thing), which works identically for local and LDAP accounts. Verified: re-ran the full local-account Playwright flow with the new code-based disable (still passes end-to-end). For the LDAP path — no real LDAP server available to log in through — flipped a throwaway test account to authSource="ldap"/passwordHash=null directly in the DB and exercised the setup/confirm/disable logic functions directly (same technique used earlier in this session for testing mail ingestion without a live IMAP server): setup no longer rejects it, confirm and disable both work correctly with no password present. Test account fully deleted after. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GteWhnWKTmnXcsd5jx6H7u
30 lines
1.2 KiB
TypeScript
30 lines
1.2 KiB
TypeScript
export const runtime = "nodejs";
|
|
|
|
import { NextResponse } from "next/server";
|
|
import { eq } from "drizzle-orm";
|
|
import { requireSession } from "@/lib/auth/require";
|
|
import { db } from "@/lib/db/client";
|
|
import { users } from "@/lib/db/schema";
|
|
import { generateTotpSecret, encryptTotpSecret, buildTotpQrCode } from "@/lib/auth/totp";
|
|
|
|
/**
|
|
* Starts (or restarts) 2FA setup — generates a fresh secret and stores it
|
|
* encrypted, but leaves totpEnabled false until /confirm proves the user
|
|
* actually scanned it (see users.totpEnabled comment in schema.ts). Safe to
|
|
* call again if the user abandons setup partway — it just overwrites the
|
|
* unconfirmed secret with a new one.
|
|
*/
|
|
export async function POST() {
|
|
const { session, response } = await requireSession();
|
|
if (!session) return response;
|
|
|
|
const user = await db.query.users.findFirst({ where: eq(users.id, session.user.id) });
|
|
if (!user) return NextResponse.json({ error: "User not found" }, { status: 404 });
|
|
|
|
const secret = generateTotpSecret();
|
|
await db.update(users).set({ totpSecret: encryptTotpSecret(secret), totpEnabled: false }).where(eq(users.id, user.id));
|
|
|
|
const qrDataUrl = await buildTotpQrCode(secret, user.email);
|
|
return NextResponse.json({ secret, qrDataUrl });
|
|
}
|