Skip to main content

Abstract Class: BaseAuthTOTPRouteSQL

Defined in: src/routes/sql/BaseAuthTOTPRouteSQL.ts:8

Extends​

Constructors​

Constructor​

new BaseAuthTOTPRouteSQL(): BaseAuthTOTPRouteSQL

Returns​

BaseAuthTOTPRouteSQL

Inherited from​

BaseAuthTOTPRoute.constructor

Properties​

aliasClass​

protected aliasClass: any = AliasSQL

Defined in: src/routes/sql/BaseAuthTOTPRouteSQL.ts:9

Overrides​

BaseAuthTOTPRoute.aliasClass

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: src/routes/BaseAuthTOTPRoute.ts:42

Inherited from​

BaseAuthTOTPRoute.authMiddleware

defaultScopes​

protected defaultScopes: string[] = []

Defined in: src/routes/BaseAuthTOTPRoute.ts:45

Inherited from​

BaseAuthTOTPRoute.defaultScopes

jwtConfig?​

protected optional jwtConfig?: any

Defined in: src/routes/BaseAuthTOTPRoute.ts:48

Inherited from​

BaseAuthTOTPRoute.jwtConfig

messagingUtils?​

protected optional messagingUtils?: MessagingUtils

Defined in: src/routes/BaseAuthTOTPRoute.ts:51

Inherited from​

BaseAuthTOTPRoute.messagingUtils

rateLimiter?​

protected optional rateLimiter?: RateLimiter

Defined in: src/routes/BaseAuthTOTPRoute.ts:54

Inherited from​

BaseAuthTOTPRoute.rateLimiter

secretClass​

protected secretClass: any = SecretSQL

Defined in: src/routes/sql/BaseAuthTOTPRouteSQL.ts:10

Overrides​

BaseAuthTOTPRoute.secretClass

secretRepo?​

protected optional secretRepo?: RepoUtils<SecretSQL>

Defined in: src/routes/BaseAuthTOTPRoute.ts:56

Inherited from​

BaseAuthTOTPRoute.secretRepo

template​

protected template: string = "login-otp"

Defined in: src/routes/BaseAuthTOTPRoute.ts:59

The name of the messaging template to use for sending notifications.

Inherited from​

BaseAuthTOTPRoute.template

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: src/routes/BaseAuthTOTPRoute.ts:62

Inherited from​

BaseAuthTOTPRoute.tokenUtils

totpConfig​

protected totpConfig: TOTPConfig

Defined in: src/routes/BaseAuthTOTPRoute.ts:71

Only encryption_key is read here — the rest of TOTPConfig (digits/period/algorithm/etc.) is captured onto each TOTPSecret at registration time by BaseSecretRoute, not re-read at login.

Inherited from​

BaseAuthTOTPRoute.totpConfig

userClass​

protected userClass: any = UserSQL

Defined in: src/routes/sql/BaseAuthTOTPRouteSQL.ts:11

Overrides​

BaseAuthTOTPRoute.userClass

userUtils?​

protected optional userUtils?: UserUtils<UserSQL, AliasSQL>

Defined in: src/routes/BaseAuthTOTPRoute.ts:64

Inherited from​

BaseAuthTOTPRoute.userUtils

Methods​

authenticate()​

authenticate(user, req, res): Promise<AuthResult | undefined>

Defined in: src/routes/BaseAuthTOTPRoute.ts:124

Authenticates the user using TOTP and returns a JSON Web Token access token to be used with future API requests.

Parameters​

user​

JWTUser

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<AuthResult | undefined>

Inherited from​

BaseAuthTOTPRoute.authenticate

getSecrets()​

protected getSecrets(uid): Promise<TOTPSecret[]>

Defined in: src/routes/BaseAuthTOTPRoute.ts:132

Parameters​

uid​

string

Returns​

Promise<TOTPSecret[]>

Inherited from​

BaseAuthTOTPRoute.getSecrets

getUser()​

protected getUser(uid): Promise<JWTUser | undefined>

Defined in: src/routes/BaseAuthTOTPRoute.ts:157

Retrieves the user with the given unique id.

Parameters​

uid​

string

The unique id of the user to retrieve.

Returns​

Promise<JWTUser | undefined>

The user if found, otherwise undefined.

Inherited from​

BaseAuthTOTPRoute.getUser

initialize()​

protected initialize(): Promise<void>

Defined in: src/routes/BaseAuthTOTPRoute.ts:77

Called on server startup to initialize the route with any defaults.

Returns​

Promise<void>

Inherited from​

BaseAuthTOTPRoute.initialize

updateSecretTimeStep()​

protected updateSecretTimeStep(uid, timeStep): Promise<void>

Defined in: src/routes/BaseAuthTOTPRoute.ts:178

Persists the given time step as the last one successfully used for the identified TOTP secret, so a captured/replayed token can't be reused within its validity window.

Closes a TOCTOU race between two concurrent requests both holding the same valid code: each independently reads the secret and verifies the submitted token before either one reaches this method, so verification alone can't tell them apart. Re-checking lastTimeStep against a fresh read here - combined with RepoUtils.update()'s existing optimistic-locking version check, which still protects the case where both readers see the same pre-update state - means at most one of the two ever succeeds in claiming this time step; the loser throws instead of silently letting a second session authenticate on an already-used code.

Parameters​

uid​

string

The unique id of the stored secret that was verified.

timeStep​

number

The RFC 6238 time step at which the token was verified.

Returns​

Promise<void>

Inherited from​

BaseAuthTOTPRoute.updateSecretTimeStep