Method validate2FaLogin

server/controllers/UserController.js:320–359

(userId, methodId, token)

  }

  async validate2FaLogin(userId, methodId, token) {
    const user2FA = await db.User2fa.findByPk(methodId);

    if (`${user2FA.user_id}` !== `${userId}`) {
      return new Promise((resolve, reject) => reject({ error: "User mismatch" }));
    }

    if (!user2FA) {
      return new Promise((resolve, reject) => reject({ error: "2FA method does not exist" }));
    }

    const totp = new TOTP({
      secret: user2FA.secret
    });

    const delta = totp.validate({ token, window: 1 });
    if (delta !== null) {
      const foundUser = await db.User.findOne({ where: { id: user2FA.user_id } });
      return foundUser;
    }

    // Avoid triggering the model getter when backup is null (getter decrypts the value)
    if (user2FA.getDataValue("backup")) {
      try {
        const backupCodes = JSON.parse(user2FA.backup);
        if (backupCodes.includes(token)) {
          const foundUser = await db.User.findOne({ where: { id: user2FA.user_id } });
          if (foundUser) {
            const newBackupCodes = backupCodes.filter((code) => code !== token);
            await user2FA.update({ backup: JSON.stringify(newBackupCodes) });
            return foundUser;
          }
        }
      } catch (e) {
        // do nothing
      }
    }

    return new Promise((resolve, reject) => reject(new Error(401)));
  }

  findAll() {
    return db.User.findAll({