aa6c1b5094
- Auth: TOTP params from config, JWT error logging, audit log failure logging, replaced_by_hash validation on token rotation - Invoices: remove dead VAT code, consistent PDF permissions, WebP magic-byte detection, deduped exchange-rate fetches - Orders/Offers: multipart limit from config, use paginated() helper, payment method from DB in PDF - Projects: verify project exists before creating note - Attendance: action_type enum validation, consistent local-time shift_date construction, holiday attendance in work fund, trips.view permission on last-km query - Users: paginated() helper usage, remove duplicate dashboard keys, parallel currency conversion, single hashToken implementation - Frontend: memoized customInput, reliable print onload, modal prop standardization (isOpen), ConfirmModal type icons, id===0 key fallback, Login useCallback, CompanySettings ConfirmModal, Attendance timeout cleanup, Dashboard memoization, beforeunload dirty-state warnings on Invoice/Offer/Order detail - Schema: invoice_alert_log timestamp, config/env comment on Date.prototype.toJSON override - Utils: exchange-rate inflight dedup Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
30 lines
953 B
TypeScript
30 lines
953 B
TypeScript
import * as OTPAuthLib from "otpauth";
|
|
import { decrypt } from "./encryption";
|
|
import { config } from "../config/env";
|
|
|
|
export const OTPAuth = {
|
|
verify(
|
|
encryptedSecret: string,
|
|
code: string,
|
|
): { valid: boolean; counter: number | null } {
|
|
try {
|
|
const secret = decrypt(encryptedSecret);
|
|
const totp = new OTPAuthLib.TOTP({
|
|
secret: OTPAuthLib.Secret.fromBase32(secret),
|
|
algorithm: config.totp.algorithm,
|
|
digits: config.totp.digits,
|
|
period: config.totp.period,
|
|
});
|
|
const delta = totp.validate({ token: code, window: 1 });
|
|
if (delta === null) {
|
|
return { valid: false, counter: null };
|
|
}
|
|
const currentCounter = Math.floor(Date.now() / 1000 / config.totp.period);
|
|
return { valid: true, counter: currentCounter + delta };
|
|
} catch (err) {
|
|
console.error("TOTP verification error:", err);
|
|
return { valid: false, counter: null };
|
|
}
|
|
},
|
|
};
|