EpicNext-Cms/src/actions/twofactor.ts

"use server";

import { revalidatePath } from "next/cache";
import { redirect } from "next/navigation";
import { randomBytes } from "node:crypto";
import { LaravelEncrypter } from "@/lib/auth/laravel-encrypter";
import { generateTotpSecret, verifyTotp } from "@/lib/auth/totp";
import { auth } from "@/lib/auth";
import { prisma } from "@/lib/prisma";
import { clientIp, rateLimit } from "@/lib/rate-limit";
import { env } from "@/env";

async function sessionUserId(): Promise<number> {
  const session = await auth();
  if (!session?.user?.id) redirect("/login");
  return Number(session.user.id);
}

function generateRecoveryCodes(): string[] {
  const codes: string[] = [];
  for (let i = 0; i < 8; i++) {
    codes.push(randomBytes(4).toString("hex").toUpperCase().replace(/(.{4})/, "$1-"));
  }
  return codes;
}

/** Verify a TOTP code OR a recovery code. Returns the updated recovery codes (minus used one) if a recovery code was used, or null on failure. */
async function verifyTwoFactorCode(
  userId: number, code: string,
): Promise<{ ok: boolean; updatedRecoveryCodes?: string | null }> {
  const user = await prisma.user.findUnique({
    where: { id: userId },
    select: { twoFactorSecret: true, twoFactorRecoveryCodes: true },
  });
  if (!user?.twoFactorSecret) return { ok: false };

  // Try TOTP first
  try {
    const secret = new LaravelEncrypter(env.APP_KEY as string).decrypt(user.twoFactorSecret);
    if (verifyTotp(code, secret)) return { ok: true };
  } catch { /* fall through to recovery */ }

  // Try recovery codes
  if (user.twoFactorRecoveryCodes) {
    let codes: string[];
    try { codes = JSON.parse(user.twoFactorRecoveryCodes) as string[]; } catch { codes = []; }
    const idx = codes.indexOf(code);
    if (idx !== -1) {
      codes.splice(idx, 1);
      const remaining = codes.length > 0 ? JSON.stringify(codes) : null;
      return { ok: true, updatedRecoveryCodes: remaining };
    }
  }

  return { ok: false };
}

/** Step 1: generate a secret and recovery codes, store encrypted but UNconfirmed. */
export async function beginTwoFactor(): Promise<void> {
  const id = await sessionUserId();
  if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
  const secret = generateTotpSecret();
  const encrypted = new LaravelEncrypter(env.APP_KEY).encrypt(secret);
  const codes = generateRecoveryCodes();
  await prisma.user.update({
    where: { id },
    data: {
      twoFactorSecret: encrypted,
      twoFactorConfirmedAt: null,
      twoFactorRecoveryCodes: JSON.stringify(codes),
    },
  });
  revalidatePath("/settings/2fa");
}

/** Step 2: verify a code against the pending secret, then confirm and show recovery codes. */
export async function confirmTwoFactor(formData: FormData): Promise<void> {
  const id = await sessionUserId();
  if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");

  if (!rateLimit(`2fa-confirm:${id}`, 5, 30_000).ok) redirect("/settings/2fa?error=ratelimit");

  const code = String(formData.get("code") ?? "").trim();

  const { ok } = await verifyTwoFactorCode(id, code);
  if (!ok) redirect("/settings/2fa?error=badcode");

  await prisma.user.update({ where: { id }, data: { twoFactorConfirmedAt: new Date() } });
  redirect("/settings/2fa?enabled=1");
}

export async function disableTwoFactor(formData: FormData): Promise<void> {
  const id = await sessionUserId();
  if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");

  if (!rateLimit(`2fa-disable:${id}`, 5, 30_000).ok) redirect("/settings/2fa?error=ratelimit");

  const code = String(formData.get("code") ?? "").trim();

  const { ok } = await verifyTwoFactorCode(id, code);
  if (!ok) redirect("/settings/2fa?error=badcode");

  await prisma.user.update({
    where: { id },
    data: {
      twoFactorSecret: null,
      twoFactorRecoveryCodes: null,
      twoFactorConfirmedAt: null,
    },
  });
  redirect("/settings/2fa?disabled=1");
}