Function post

pages/api/auth/multi-factor/enable.ts:20–141

({ request, user }: RequestHandlerParams)

}

async function post({ request, user }: RequestHandlerParams) {
  const isMultiFactorAuthEnabled = await AppConfig.isMultiFactorAuthEnabled();

  if (!isMultiFactorAuthEnabled) {
    const responseBody: ResponseBody = {
      success: false,
      error: 'Multi-factor authentication is not enabled on this server',
    };

    return new Response(JSON.stringify(responseBody), { status: 403 });
  }

  const body = await request.clone().json() as RequestBody;
  const { methodId, code } = body;

  if (!methodId || !code) {
    const responseBody: ResponseBody = {
      success: false,
      error: 'Method ID and verification code are required',
    };

    return new Response(JSON.stringify(responseBody), { status: 400 });
  }

  const method = getMultiFactorAuthMethodByIdFromUser(user!, methodId);
  if (!method) {
    const responseBody: ResponseBody = {
      success: false,
      error: 'Multi-factor authentication method not found',
    };

    return new Response(JSON.stringify(responseBody), { status: 404 });
  }

  if (method.enabled) {
    const responseBody: ResponseBody = {
      success: false,
      error: 'Multi-factor authentication method is already enabled',
    };

    return new Response(JSON.stringify(responseBody), { status: 400 });
  }

  if (method.type === 'totp') {
    const hashedSecret = method.metadata.totp?.hashed_secret;
    if (!hashedSecret) {
      const responseBody: ResponseBody = {
        success: false,
        error: 'TOTP secret not found',
      };

      return new Response(JSON.stringify(responseBody), { status: 400 });
    }

    try {
      const secret = await TOTPModel.decryptTOTPSecret(hashedSecret);
      const isValid = TOTPModel.verifyTOTP(secret, code);
      if (!isValid) {