Method verifyTOTPFactor

internal/api/mfa.go:594–727

(w http.ResponseWriter, r *http.Request, params *VerifyFactorParams)

}

func (a *API) verifyTOTPFactor(w http.ResponseWriter, r *http.Request, params *VerifyFactorParams) error {
	var err error
	ctx := r.Context()
	user := getUser(ctx)
	factor := getFactor(ctx)
	config := a.config
	db := a.db.WithContext(ctx)

	challenge, err := a.validateChallenge(r, db, factor, params.ChallengeID)
	if err != nil {
		return err
	}

	secret, shouldReEncrypt, err := factor.GetSecret(config.Security.DBEncryption.DecryptionKeys, config.Security.DBEncryption.Encrypt, config.Security.DBEncryption.EncryptionKeyID)
	if err != nil {
		return apierrors.NewInternalServerError("Database error verifying MFA TOTP secret").WithInternalError(err)
	}

	valid, verr := totp.ValidateCustom(params.Code, secret, time.Now().UTC(), totp.ValidateOpts{
		Period:    30,
		Skew:      1,
		Digits:    otp.DigitsSix,
		Algorithm: otp.AlgorithmSHA1,
	})

	if config.Hook.MFAVerificationAttempt.Enabled {
		input := v0hooks.NewMFAVerificationAttemptInput(
			r,
			user.ID,
			factor.ID,
			factor.FactorType,
			valid,
		)

		output := v0hooks.MFAVerificationAttemptOutput{}
		err := a.hooksMgr.InvokeHook(nil, r, input, &output)
		if err != nil {
			return err
		}

		if output.Decision == v0hooks.HookRejection {
			if err := models.Logout(db, user.ID); err != nil {
				return err
			}

			if output.Message == "" {
				output.Message = v0hooks.DefaultMFAHookRejectionMessage
			}

			return apierrors.NewForbiddenError(apierrors.ErrorCodeMFAVerificationRejected, "%s", output.Message)
		}
	}
	if !valid {
		if shouldReEncrypt && config.Security.DBEncryption.Encrypt {
			if err := factor.SetSecret(secret, true, config.Security.DBEncryption.EncryptionKeyID, config.Security.DBEncryption.EncryptionKey); err != nil {
				return err
			}