Skip to main content

Abstract Class: BaseAuthMFARouteMongo

Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:8

Extends

Constructors

Constructor

new BaseAuthMFARouteMongo(): BaseAuthMFARouteMongo

Returns

BaseAuthMFARouteMongo

Inherited from

BaseAuthMFARoute.constructor

Properties

aliasClass

protected aliasClass: any = AliasMongo

Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:9

Overrides

BaseAuthMFARoute.aliasClass


aliasRepo?

protected optional aliasRepo?: RepoUtils<AliasMongo>

Defined in: src/routes/BaseAuthMFARoute.ts:50

Inherited from

BaseAuthMFARoute.aliasRepo


authMiddleware?

protected optional authMiddleware?: AuthMiddleware

Defined in: src/routes/BaseAuthMFARoute.ts:53

Inherited from

BaseAuthMFARoute.authMiddleware


defaultScopes

protected defaultScopes: string[] = []

Defined in: src/routes/BaseAuthMFARoute.ts:56

Inherited from

BaseAuthMFARoute.defaultScopes


fido2Config

protected fido2Config: PasskeyConfig

Defined in: src/routes/BaseAuthMFARoute.ts:64

The relying party configuration to use for the FIDO2 secondary authentication method. See BaseAuthFIDO2Route/BaseSecretRoute.fido2Config for the primary-auth/registration counterparts of this configuration.

Inherited from

BaseAuthMFARoute.fido2Config


jwtConfig?

protected optional jwtConfig?: any

Defined in: src/routes/BaseAuthMFARoute.ts:71

Inherited from

BaseAuthMFARoute.jwtConfig


logger

protected logger: any

Defined in: src/routes/BaseAuthMFARoute.ts:74

Inherited from

BaseAuthMFARoute.logger


messagingUtils?

protected optional messagingUtils?: MessagingUtils

Defined in: src/routes/BaseAuthMFARoute.ts:77

Inherited from

BaseAuthMFARoute.messagingUtils


rateLimiter?

protected optional rateLimiter?: RateLimiter

Defined in: src/routes/BaseAuthMFARoute.ts:80

Inherited from

BaseAuthMFARoute.rateLimiter


secretClass

protected secretClass: any = SecretMongo

Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:10

Overrides

BaseAuthMFARoute.secretClass


secretRepo?

protected optional secretRepo?: RepoUtils<SecretMongo>

Defined in: src/routes/BaseAuthMFARoute.ts:82

Inherited from

BaseAuthMFARoute.secretRepo


template

protected template: string = "login-otp"

Defined in: src/routes/BaseAuthMFARoute.ts:85

The name of the messaging template to use for sending notifications.

Inherited from

BaseAuthMFARoute.template


tokenUtils?

protected optional tokenUtils?: TokenUtils

Defined in: src/routes/BaseAuthMFARoute.ts:88

Inherited from

BaseAuthMFARoute.tokenUtils


totpConfig

protected totpConfig: TOTPConfig

Defined in: src/routes/BaseAuthMFARoute.ts:95

Only encryption_key is read here — the rest of TOTPConfig (digits/period/algorithm/etc.) is captured onto each TOTPSecret at registration time by BaseSecretRoute, not re-read at login.

Inherited from

BaseAuthMFARoute.totpConfig


userClass

protected userClass: any = UserMongo

Defined in: src/routes/mongo/BaseAuthMFARouteMongo.ts:11

Overrides

BaseAuthMFARoute.userClass


userRepo?

protected optional userRepo?: RepoUtils<UserMongo>

Defined in: src/routes/BaseAuthMFARoute.ts:97

Inherited from

BaseAuthMFARoute.userRepo


userUtils?

protected optional userUtils?: UserUtils<UserMongo, AliasMongo>

Defined in: src/routes/BaseAuthMFARoute.ts:99

Inherited from

BaseAuthMFARoute.userUtils

Methods

authenticate()

authenticate(user, req, res): Promise<AuthResult | undefined>

Defined in: src/routes/BaseAuthMFARoute.ts:173

Authenticates the user using HTTP MFA and returns a JSON Web Token access token to be used with future API requests.

Parameters

user

JWTUser

req

HttpRequest

res

HttpResponse

Returns

Promise<AuthResult | undefined>

Inherited from

BaseAuthMFARoute.authenticate


consumeRecoveryCode()

protected consumeRecoveryCode(uid, codeIndex): Promise<void>

Defined in: src/routes/BaseAuthMFARoute.ts:498

Persists that the recovery code at codeIndex within the identified recovery-codes secret has been consumed, so it can never be verified again. Called once, only after MFAStrategy.verifyRecoveryCode() has already matched the submitted code against that entry's hash.

Closes the same TOCTOU race described on updateSecretTimeStep() above: two concurrent requests submitting the identical still-unused recovery code both pass verifyRecoveryCode()'s in-memory hash check before either reaches here. Re-checking usedAt against a fresh read - combined with the existing optimistic-locking version check on the write - means only the first to actually persist the consumption wins; the loser throws rather than silently authenticating a second session on a code that's already been spent.

Parameters

uid

string

The unique id of the recovery-codes secret the matched entry belongs to.

codeIndex

number

The index, within that secret's codes array, of the entry that was matched.

Returns

Promise<void>

Inherited from

BaseAuthMFARoute.consumeRecoveryCode


convertAliasToMethod()

protected convertAliasToMethod(alias, obfuscate?): MFAMethod | undefined

Defined in: src/routes/BaseAuthMFARoute.ts:181

Parameters

alias

Alias

obfuscate?

boolean

Returns

MFAMethod | undefined

Inherited from

BaseAuthMFARoute.convertAliasToMethod


convertSecretToMethod()

protected convertSecretToMethod(secret, redact?): MFAMethod | undefined

Defined in: src/routes/BaseAuthMFARoute.ts:226

Converts a Secret into the MFAMethod shape MFAStrategy understands.

Parameters

secret

SecretMongo

The secret to convert.

redact?

boolean

Set to true when the result will be sent to the (not-yet-authenticated-for-phase-3) client, e.g. via getMethods()'s res.json({uid, methods}) in phase 1 — this replaces RECOVERY_CODES' data (which would otherwise be its raw array of code hashes) with just a remaining count. Left false for internal lookups (getMethod()) that need the real data to actually verify a submission against. FIDO2/TOTP data is passed through unredacted either way — a FIDO2 credential's public key and a TOTP secret aren't attacker-usable read out of context the way a recovery code's hash array structurally is, and the client already possesses/generated both.

Returns

MFAMethod | undefined

Inherited from

BaseAuthMFARoute.convertSecretToMethod


getCredentialById()

protected getCredentialById(credentialId): Promise<StoredPasskeyCredential | undefined>

Defined in: src/routes/BaseAuthMFARoute.ts:264

Retrieves a previously-registered FIDO2 credential by its ID, for verifying a FIDO2 secondary authentication challenge response.

Parameters

credentialId

string

The unique id of the FIDO2 credential to retrieve.

Returns

Promise<StoredPasskeyCredential | undefined>

Inherited from

BaseAuthMFARoute.getCredentialById


getMethod()

protected getMethod(id, userUid): Promise<MFAMethod | undefined>

Defined in: src/routes/BaseAuthMFARoute.ts:288

Retrieves the user's secondary authentication method for a given id. Only returns a method that actually belongs to uid — this is what stops one user's 2FA challenge from being triggered/consumed using another user's authentication method.

Parameters

id

string

The unique id of the secondary auth method to retrieve.

userUid

string

The unique id of the user the method must belong to.

Returns

Promise<MFAMethod | undefined>

Inherited from

BaseAuthMFARoute.getMethod


getMethods()

protected getMethods(uid): Promise<MFAMethod[]>

Defined in: src/routes/BaseAuthMFARoute.ts:321

Retrieves the list of secondary authentication methods for the user with the given id. This list is sent to the user and so should be obfuscated where reasonable so as to limit discovery when a password has been compromised.

Parameters

uid

string

The unique identifier of the user.

Returns

Promise<MFAMethod[]>

Inherited from

BaseAuthMFARoute.getMethods


getUser()

protected getUser(uid): Promise<JWTUser | undefined>

Defined in: src/routes/BaseAuthMFARoute.ts:373

Retrieves the user with the given unique id.

Parameters

uid

string

The unique id of the user to retrieve.

Returns

Promise<JWTUser | undefined>

The user if found, otherwise undefined.

Inherited from

BaseAuthMFARoute.getUser


initialize()

protected initialize(): Promise<void>

Defined in: src/routes/BaseAuthMFARoute.ts:105

Called on server startup to initialize the route with any defaults.

Returns

Promise<void>

Inherited from

BaseAuthMFARoute.initialize


notifyContact()

protected notifyContact(contact, totp): Promise<void>

Defined in: src/routes/BaseAuthMFARoute.ts:380

Parameters

contact

OTPContact

totp

string

Returns

Promise<void>

Inherited from

BaseAuthMFARoute.notifyContact


obfuscateAlias()

protected obfuscateAlias(alias, type): string

Defined in: src/routes/BaseAuthMFARoute.ts:401

Obfuscates the given alias and returns the obfuscated value.

Parameters

alias

string

type

AliasType

Returns

string

Inherited from

BaseAuthMFARoute.obfuscateAlias


updateCredentialCounter()

protected updateCredentialCounter(credentialId, newCounter): Promise<void>

Defined in: src/routes/BaseAuthMFARoute.ts:426

Persists the updated signature counter for the given FIDO2 credential after a successful MFA challenge. Called on every successful FIDO2 secondary authentication to guard against cloned authenticators.

Parameters

credentialId

string

The unique id of the credential to update.

newCounter

number

The new signature counter value to persist.

Returns

Promise<void>

Inherited from

BaseAuthMFARoute.updateCredentialCounter


updateSecretTimeStep()

protected updateSecretTimeStep(uid, timeStep): Promise<void>

Defined in: src/routes/BaseAuthMFARoute.ts:460

Persists the given time step as the last one successfully used for the identified TOTP secret, so a captured/replayed token can't be reused within its validity window.

Closes a TOCTOU race between two concurrent phase-3 requests both holding the same valid code: each independently verifies the submitted token before either one reaches this method, so verification alone can't tell them apart. Re-checking lastTimeStep against a fresh read here - combined with RepoUtils.update()'s existing optimistic-locking version check, which still protects the case where both readers see the same pre-update state - means at most one of the two ever succeeds in claiming this time step; the loser throws instead of silently letting a second session authenticate on an already-used code.

Parameters

uid

string

The unique id of the stored secret that was verified.

timeStep

number

The RFC 6238 time step at which the token was verified.

Returns

Promise<void>

Inherited from

BaseAuthMFARoute.updateSecretTimeStep


verify()

protected verify(name, password): Promise<JWTUser | undefined>

Defined in: src/routes/BaseAuthMFARoute.ts:522

Parameters

name

string

password

string

Returns

Promise<JWTUser | undefined>

Inherited from

BaseAuthMFARoute.verify