Method verify2faApp

server/controllers/UserController.js:639–672

(userId, { token, password })

  }

  async verify2faApp(userId, { token, password }) {
    const user = await this.findById(userId);
    if (!user) {
      return new Promise((resolve, reject) => reject(new Error(404)));
    }

    // check if the password is correct
    const isCorrect = await bcrypt.compare(password, user.password);
    if (!isCorrect) {
      return new Promise((resolve, reject) => reject(new Error(401)));
    }

    const user2FA = await db.User2fa.findOne({ where: { user_id: userId } });
    if (!user2FA) {
      return new Promise((resolve, reject) => reject({ error: "2FA not setup." }));
    }

    const totp = new TOTP({
      secret: user2FA.secret
    });

    const delta = totp.validate({ token, window: 1 });
    if (delta !== null) {
      const backupCodes = [];
      for (let i = 0; i < 10; i++) {
        backupCodes.push(nanoid(8));
      }
      // Mark 2FA as enabled and add backup codes
      await user2FA.update({ isEnabled: true, backup: JSON.stringify(backupCodes) });
      return new Promise((resolve) => resolve(backupCodes));
    } else {
      return new Promise((resolve, reject) => reject({ error: "Invalid token." }));
    }
  }

  get2faMethods(userId) {
    return db.User2fa.findAll({