Function post

pages/mfa-verify.tsx:63–159

({ request, match, session, isRunningLocally }: RequestHandlerParams)

}

async function post({ request, match, session, isRunningLocally }: RequestHandlerParams) {
  const isMultiFactorAuthEnabled = await AppConfig.isMultiFactorAuthEnabled();

  if (!isMultiFactorAuthEnabled) {
    return new Response('Redirect', { status: 303, headers: { 'Location': '/login' } });
  }

  const searchParams = new URL(request.url).searchParams;
  const redirectUrl = searchParams.get('redirect') || '/';

  const { user } = (await MultiFactorAuthModel.getDataFromRequest(request)) || {};

  if (!user) {
    return new Response('Redirect', { status: 303, headers: { 'Location': '/login' } });
  }

  const hasMultiFactorAuthEnabled = isMultiFactorAuthEnabledForUser(user);

  if (!hasMultiFactorAuthEnabled) {
    return new Response('Redirect', { status: 303, headers: { 'Location': '/login' } });
  }

  const enabledMethods = getEnabledMultiFactorAuthMethodsFromUser(user);
  const availableMethods = enabledMethods.map((method) => method.type);

  try {
    const formData = await request.formData();
    const code = getFormDataField(formData, 'code');
    const token = getFormDataField(formData, 'token');

    if (!code && !token) {
      throw new Error('Authentication code/token is required');
    }

    let isValid = false;
    let updateUser = false;

    for (const method of enabledMethods) {
      // Passkey verification is handled in a separate process
      if (method.type === 'passkey') {
        continue;
      }

      if (method.type === 'totp') {
        const verification = await TOTPModel.verifyMethodToken(method.metadata, token);
        if (verification.isValid) {
          isValid = true;

          if (verification.remainingCodes && method.type === 'totp' && method.metadata.totp) {
            method.metadata.totp.hashed_backup_codes = verification.remainingCodes;
            updateUser = true;
          }
          break;
        }
      }

      if (method.type === 'email') {
        const verification = await EmailModel.verifyCode(method.id, code, user);