Method setup2faApp

server/controllers/UserController.js:612–637

(userId)

  }

  async setup2faApp(userId) {
    const user = await this.findById(userId);
    if (!user) {
      return new Promise((resolve, reject) => reject(new Error(404)));
    }

    const secret = new TOTP().secret.base32;

    // Save secret to DB
    await db.User2fa.create({
      user_id: userId,
      secret,
      method: "app",
      isEnabled: false, // Enabled after verification only
    });

    // Generate QR Code URL
    const qrCodeURL = this.generateQrCodeUrl(user.email, secret);

    // Generate QR code
    try {
      return await QRCode.toDataURL(qrCodeURL);
    } catch (e) {
      return new Promise((resolve, reject) => reject(e));
    }
  }

  async verify2faApp(userId, { token, password }) {
    const user = await this.findById(userId);