Skip to main content

Abstract Class: BaseAuthTOTPRoute<U, A, S>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:33

Extended by​

Type Parameters​

U​

U extends User

A​

A extends Alias

S​

S extends Secret

Constructors​

Constructor​

new BaseAuthTOTPRoute<U, A, S>(): BaseAuthTOTPRoute<U, A, S>

Returns​

BaseAuthTOTPRoute<U, A, S>

Properties​

aliasClass​

abstract protected aliasClass: any

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:34

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:42

defaultScopes​

protected defaultScopes: string[] = []

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:45

jwtConfig?​

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:48

messagingUtils?​

protected optional messagingUtils?: MessagingUtils

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:51

rateLimiter?​

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:54

secretClass​

abstract protected secretClass: any

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:35

secretRepo?​

protected optional secretRepo?: RepoUtils<S>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:56

template​

protected template: string = "login-otp"

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:59

The name of the messaging template to use for sending notifications.

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:62

totpConfig​

protected totpConfig: TOTPConfig

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:71

Only encryption_key is read here — the rest of TOTPConfig (digits/period/algorithm/etc.) is captured onto each TOTPSecret at registration time by BaseSecretRoute, not re-read at login.

userClass​

abstract protected userClass: any

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:36

userUtils?​

protected optional userUtils?: UserUtils<U, A>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:64

Methods​

authenticate()​

authenticate(user, req, res): Promise<AuthResult | undefined>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:124

Authenticates the user using TOTP and returns a JSON Web Token access token to be used with future API requests.

Parameters​

user​

JWTUser

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<AuthResult | undefined>

getSecrets()​

protected getSecrets(uid): Promise<TOTPSecret[]>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:132

Parameters​

uid​

string

Returns​

Promise<TOTPSecret[]>

getUser()​

protected getUser(uid): Promise<JWTUser | undefined>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:157

Retrieves the user with the given unique id.

Parameters​

uid​

string

The unique id of the user to retrieve.

Returns​

Promise<JWTUser | undefined>

The user if found, otherwise undefined.

initialize()​

protected initialize(): Promise<void>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:77

Called on server startup to initialize the route with any defaults.

Returns​

Promise<void>

updateSecretTimeStep()​

protected updateSecretTimeStep(uid, timeStep): Promise<void>

Defined in: auth/src/routes/BaseAuthTOTPRoute.ts:178

Persists the given time step as the last one successfully used for the identified TOTP secret, so a captured/replayed token can't be reused within its validity window.

Closes a TOCTOU race between two concurrent requests both holding the same valid code: each independently reads the secret and verifies the submitted token before either one reaches this method, so verification alone can't tell them apart. Re-checking lastTimeStep against a fresh read here - combined with RepoUtils.update()'s existing optimistic-locking version check, which still protects the case where both readers see the same pre-update state - means at most one of the two ever succeeds in claiming this time step; the loser throws instead of silently letting a second session authenticate on an already-used code.

Parameters​

uid​

string

The unique id of the stored secret that was verified.

timeStep​

number

The RFC 6238 time step at which the token was verified.

Returns​

Promise<void>