Multi Factor Authentication

1import {
2  generateTOTPSecret,
3  verifyTOTP,
4  generateBackupCodes,
5  verifyBackupCode,
6  hashBackupCode
7} from "@/lib/auth/mfa";
8
9// Generate a new TOTP secret for user setup
10const { secret, qrCodeUrl, otpAuthUrl } = await generateTOTPSecret(
11  "user@example.com",
12  "YourApp" // issuer name
13);
14
15// Verify a 6-digit code from authenticator app
16const isValid = verifyTOTP(userCode, secret);
17
18// Generate 10 backup codes (XXXX-XXXX format)
19const backupCodes = generateBackupCodes(10);
20
21// Hash backup codes before storing in database
22const hashedCodes = await Promise.all(
23  backupCodes.map(code => hashBackupCode(code))
24);
25
26// Verify a backup code (also handles marking it as used)
27const { valid, remainingCodes } = await verifyBackupCode(
28  submittedCode,
29  user.mfaBackupCodes
30);

1// Check if user has 2FA enabled
2const user = await prisma.user.findUnique({
3  where: { id: session.user.id },
4  select: {
5    mfaEnabled: true,
6    mfaSecret: true,
7  },
8});
9
10if (user.mfaEnabled) {
11  // User has 2FA enabled
12  // Require verification before sensitive actions
13}
14
15// For sensitive operations, you might want to require
16// re-verification even for logged-in users:
17export async function deleteAccount(userId: string, mfaCode: string) {
18  const user = await prisma.user.findUnique({
19    where: { id: userId },
20  });
21
22  if (user.mfaEnabled) {
23    const isValid = verifyTOTP(mfaCode, decrypt(user.mfaSecret));
24    if (!isValid) {
25      throw new Error("Invalid 2FA code");
26    }
27  }
28
29  // Proceed with deletion
30}