Abstract Class: BaseAuthMFARouteMongo
Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:8
Extends
Constructors
Constructor
new BaseAuthMFARouteMongo():
BaseAuthMFARouteMongo
Returns
BaseAuthMFARouteMongo
Inherited from
Properties
aliasClass
protectedaliasClass:any=AliasMongo
Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:9
Overrides
aliasRepo?
protectedoptionalaliasRepo?:RepoUtils<AliasMongo>
Defined in: src/routes/BaseAuthMFARoute.ts:50
Inherited from
authMiddleware?
protectedoptionalauthMiddleware?:AuthMiddleware
Defined in: src/routes/BaseAuthMFARoute.ts:53
Inherited from
BaseAuthMFARoute.authMiddleware
defaultScopes
protecteddefaultScopes:string[] =[]
Defined in: src/routes/BaseAuthMFARoute.ts:56
Inherited from
BaseAuthMFARoute.defaultScopes
fido2Config
protectedfido2Config:PasskeyConfig
Defined in: src/routes/BaseAuthMFARoute.ts:64
The relying party configuration to use for the FIDO2 secondary authentication method. See
BaseAuthFIDO2Route/BaseSecretRoute.fido2Config for the primary-auth/registration
counterparts of this configuration.
Inherited from
jwtConfig?
protectedoptionaljwtConfig?:any
Defined in: src/routes/BaseAuthMFARoute.ts:71
Inherited from
logger
protectedlogger:any
Defined in: src/routes/BaseAuthMFARoute.ts:74
Inherited from
messagingUtils?
protectedoptionalmessagingUtils?:MessagingUtils
Defined in: src/routes/BaseAuthMFARoute.ts:77
Inherited from
BaseAuthMFARoute.messagingUtils
rateLimiter?
protectedoptionalrateLimiter?:RateLimiter
Defined in: src/routes/BaseAuthMFARoute.ts:80
Inherited from
secretClass
protectedsecretClass:any=SecretMongo
Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:10
Overrides
secretRepo?
protectedoptionalsecretRepo?:RepoUtils<SecretMongo>
Defined in: src/routes/BaseAuthMFARoute.ts:82
Inherited from
template
protectedtemplate:string="login-otp"
Defined in: src/routes/BaseAuthMFARoute.ts:85
The name of the messaging template to use for sending notifications.
Inherited from
tokenUtils?
protectedoptionaltokenUtils?:TokenUtils
Defined in: src/routes/BaseAuthMFARoute.ts:88
Inherited from
totpConfig
protectedtotpConfig:TOTPConfig
Defined in: src/routes/BaseAuthMFARoute.ts:95
Only encryption_key is read here — the rest of TOTPConfig (digits/period/algorithm/etc.) is
captured onto each TOTPSecret at registration time by BaseSecretRoute, not re-read at login.
Inherited from
userClass
protecteduserClass:any=UserMongo
Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:11
Overrides
userRepo?
protectedoptionaluserRepo?:RepoUtils<UserMongo>
Defined in: src/routes/BaseAuthMFARoute.ts:97
Inherited from
userUtils?
protectedoptionaluserUtils?:UserUtils<UserMongo,AliasMongo>
Defined in: src/routes/BaseAuthMFARoute.ts:99
Inherited from
Methods
authenticate()
authenticate(
user,req,res):Promise<AuthResult|undefined>
Defined in: src/routes/BaseAuthMFARoute.ts:173
Authenticates the user using HTTP MFA and returns a JSON Web Token access token to be used with future API requests.
Parameters
user
JWTUser
req
HttpRequest
res
HttpResponse
Returns
Promise<AuthResult | undefined>
Inherited from
consumeRecoveryCode()
protectedconsumeRecoveryCode(uid,codeIndex):Promise<void>
Defined in: src/routes/BaseAuthMFARoute.ts:498
Persists that the recovery code at codeIndex within the identified recovery-codes secret has been
consumed, so it can never be verified again. Called once, only after MFAStrategy.verifyRecoveryCode()
has already matched the submitted code against that entry's hash.
Closes the same TOCTOU race described on updateSecretTimeStep() above: two concurrent requests
submitting the identical still-unused recovery code both pass verifyRecoveryCode()'s in-memory hash
check before either reaches here. Re-checking usedAt against a fresh read - combined with the
existing optimistic-locking version check on the write - means only the first to actually persist
the consumption wins; the loser throws rather than silently authenticating a second session on a code
that's already been spent.
Parameters
uid
string
The unique id of the recovery-codes secret the matched entry belongs to.
codeIndex
number
The index, within that secret's codes array, of the entry that was matched.
Returns
Promise<void>
Inherited from
BaseAuthMFARoute.consumeRecoveryCode
convertAliasToMethod()
protectedconvertAliasToMethod(alias,obfuscate?):MFAMethod|undefined
Defined in: src/routes/BaseAuthMFARoute.ts:181
Parameters
alias
obfuscate?
boolean
Returns
MFAMethod | undefined
Inherited from
BaseAuthMFARoute.convertAliasToMethod
convertSecretToMethod()
protectedconvertSecretToMethod(secret,redact?):MFAMethod|undefined
Defined in: src/routes/BaseAuthMFARoute.ts:226
Converts a Secret into the MFAMethod shape MFAStrategy understands.
Parameters
secret
The secret to convert.
redact?
boolean
Set to true when the result will be sent to the (not-yet-authenticated-for-phase-3)
client, e.g. via getMethods()'s res.json({uid, methods}) in phase 1 — this replaces
RECOVERY_CODES' data (which would otherwise be its raw array of code hashes) with just a
remaining count. Left false for internal lookups (getMethod()) that need the real data to
actually verify a submission against. FIDO2/TOTP data is passed through unredacted either way — a
FIDO2 credential's public key and a TOTP secret aren't attacker-usable read out of context the way a
recovery code's hash array structurally is, and the client already possesses/generated both.
Returns
MFAMethod | undefined
Inherited from
BaseAuthMFARoute.convertSecretToMethod
getCredentialById()
protectedgetCredentialById(credentialId):Promise<StoredPasskeyCredential|undefined>
Defined in: src/routes/BaseAuthMFARoute.ts:264
Retrieves a previously-registered FIDO2 credential by its ID, for verifying a FIDO2 secondary authentication challenge response.
Parameters
credentialId
string
The unique id of the FIDO2 credential to retrieve.
Returns
Promise<StoredPasskeyCredential | undefined>
Inherited from
BaseAuthMFARoute.getCredentialById
getMethod()
protectedgetMethod(id,userUid):Promise<MFAMethod|undefined>
Defined in: src/routes/BaseAuthMFARoute.ts:288
Retrieves the user's secondary authentication method for a given id. Only returns a method that actually
belongs to uid — this is what stops one user's 2FA challenge from being triggered/consumed using
another user's authentication method.
Parameters
id
string
The unique id of the secondary auth method to retrieve.
userUid
string
The unique id of the user the method must belong to.
Returns
Promise<MFAMethod | undefined>
Inherited from
getMethods()
protectedgetMethods(uid):Promise<MFAMethod[]>
Defined in: src/routes/BaseAuthMFARoute.ts:321
Retrieves the list of secondary authentication methods for the user with the given id. This list is sent to the user and so should be obfuscated where reasonable so as to limit discovery when a password has been compromised.
Parameters
uid
string
The unique identifier of the user.
Returns
Promise<MFAMethod[]>
Inherited from
getUser()
protectedgetUser(uid):Promise<JWTUser|undefined>
Defined in: src/routes/BaseAuthMFARoute.ts:373
Retrieves the user with the given unique id.
Parameters
uid
string
The unique id of the user to retrieve.
Returns
Promise<JWTUser | undefined>
The user if found, otherwise undefined.
Inherited from
initialize()
protectedinitialize():Promise<void>
Defined in: src/routes/BaseAuthMFARoute.ts:105
Called on server startup to initialize the route with any defaults.
Returns
Promise<void>
Inherited from
notifyContact()
protectednotifyContact(contact,totp):Promise<void>
Defined in: src/routes/BaseAuthMFARoute.ts:380
Parameters
contact
totp
string
Returns
Promise<void>
Inherited from
BaseAuthMFARoute.notifyContact
obfuscateAlias()
protectedobfuscateAlias(alias,type):string
Defined in: src/routes/BaseAuthMFARoute.ts:401
Obfuscates the given alias and returns the obfuscated value.
Parameters
alias
string
type
Returns
string
Inherited from
BaseAuthMFARoute.obfuscateAlias
updateCredentialCounter()
protectedupdateCredentialCounter(credentialId,newCounter):Promise<void>
Defined in: src/routes/BaseAuthMFARoute.ts:426
Persists the updated signature counter for the given FIDO2 credential after a successful MFA challenge. Called on every successful FIDO2 secondary authentication to guard against cloned authenticators.
Parameters
credentialId
string
The unique id of the credential to update.
newCounter
number
The new signature counter value to persist.
Returns
Promise<void>
Inherited from
BaseAuthMFARoute.updateCredentialCounter
updateSecretTimeStep()
protectedupdateSecretTimeStep(uid,timeStep):Promise<void>
Defined in: src/routes/BaseAuthMFARoute.ts:460
Persists the given time step as the last one successfully used for the identified TOTP secret, so a captured/replayed token can't be reused within its validity window.
Closes a TOCTOU race between two concurrent phase-3 requests both holding the same valid code: each
independently verifies the submitted token before either one reaches this method, so verification
alone can't tell them apart. Re-checking lastTimeStep against a fresh read here - combined with
RepoUtils.update()'s existing optimistic-locking version check, which still protects the case
where both readers see the same pre-update state - means at most one of the two ever succeeds in
claiming this time step; the loser throws instead of silently letting a second session authenticate
on an already-used code.
Parameters
uid
string
The unique id of the stored secret that was verified.
timeStep
number
The RFC 6238 time step at which the token was verified.
Returns
Promise<void>
Inherited from
BaseAuthMFARoute.updateSecretTimeStep
verify()
protectedverify(name,password):Promise<JWTUser|undefined>
Defined in: src/routes/BaseAuthMFARoute.ts:522
Parameters
name
string
password
string
Returns
Promise<JWTUser | undefined>