- {backupCodes.map((code, i) => (
+ {backupCodes.map((value, i) => (
- {code}
+ {value}
copyBackupCode(code, i)}
+ onClick={() => copyBackupCode(value, i)}
>
{copiedIndex === i ? (
- Done
+ Done
)}
-
- {/* Disable MFA Dialog */}
-
{
- if (!open) resetState();
- }}
- >
-
-
- Disable Two-Factor Authentication
-
- Enter your password to confirm disabling MFA. This will remove the
- extra security layer from your account.
-
-
-
-
- Password
-
- {error && (
-
- {error}
-
- )}
-
-
- Cancel
-
-
- {isLoading ? "Disabling..." : "Disable MFA"}
-
-
-
-
);
}
diff --git a/src/lib/__tests__/auth-two-factor-audit.test.ts b/src/lib/__tests__/auth-two-factor-audit.test.ts
new file mode 100644
index 00000000..3781d6bc
--- /dev/null
+++ b/src/lib/__tests__/auth-two-factor-audit.test.ts
@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/audit-log", () => ({
+ createAuditLog: vi.fn(),
+ AUDIT_ACTIONS: { LOGIN: "login", UPDATE: "update" },
+ AUDIT_ENTITIES: { USER: "user" },
+}));
+
+import { createAuditLog } from "@/lib/audit-log";
+import {
+ classifyTwoFactorCall,
+ auditTwoFactorEvent,
+} from "@/lib/auth-two-factor-audit";
+
+const call = (
+ overrides: Partial
[0]>,
+) => ({
+ path: "/two-factor/verify-totp",
+ failed: false,
+ hadSession: false,
+ userId: "user-1",
+ ...overrides,
+});
+
+describe("classifyTwoFactorCall", () => {
+ it("ignores failed calls and calls without a user", () => {
+ expect(classifyTwoFactorCall(call({ failed: true }))).toBeNull();
+ expect(classifyTwoFactorCall(call({ userId: null }))).toBeNull();
+ });
+
+ it("treats verify-totp with a session as enrolment, without as login", () => {
+ expect(classifyTwoFactorCall(call({ hadSession: true }))).toEqual({
+ kind: "enabled",
+ userId: "user-1",
+ });
+ expect(classifyTwoFactorCall(call({}))).toEqual({
+ kind: "login",
+ userId: "user-1",
+ method: "totp",
+ });
+ });
+
+ it("classifies backup-code logins, disable and regeneration", () => {
+ expect(
+ classifyTwoFactorCall(call({ path: "/two-factor/verify-backup-code" })),
+ ).toEqual({ kind: "login", userId: "user-1", method: "backup_code" });
+ expect(
+ classifyTwoFactorCall(
+ call({ path: "/two-factor/disable", hadSession: true }),
+ ),
+ ).toEqual({
+ kind: "disabled",
+ userId: "user-1",
+ });
+ expect(
+ classifyTwoFactorCall(
+ call({ path: "/two-factor/generate-backup-codes", hadSession: true }),
+ ),
+ ).toEqual({ kind: "backup_codes_regenerated", userId: "user-1" });
+ });
+
+ it("ignores unrelated two-factor endpoints", () => {
+ expect(
+ classifyTwoFactorCall(
+ call({ path: "/two-factor/enable", hadSession: true }),
+ ),
+ ).toBeNull();
+ expect(
+ classifyTwoFactorCall(
+ call({ path: "/two-factor/get-totp-uri", hadSession: true }),
+ ),
+ ).toBeNull();
+ });
+});
+
+describe("auditTwoFactorEvent", () => {
+ beforeEach(() => vi.clearAllMocks());
+
+ it("records logins with the method used", async () => {
+ await auditTwoFactorEvent({
+ kind: "login",
+ userId: "user-1",
+ method: "totp",
+ });
+ expect(createAuditLog).toHaveBeenCalledWith(
+ expect.objectContaining({
+ userId: "user-1",
+ action: "login",
+ details: { method: "totp" },
+ }),
+ );
+ });
+
+ it("records enrolment changes as user updates with a reason", async () => {
+ await auditTwoFactorEvent({ kind: "disabled", userId: "user-1" });
+ expect(createAuditLog).toHaveBeenCalledWith(
+ expect.objectContaining({
+ action: "update",
+ entityId: "user-1",
+ details: { reason: "MFA disabled" },
+ }),
+ );
+ });
+});
diff --git a/src/lib/__tests__/encryption.test.ts b/src/lib/__tests__/encryption.test.ts
index 17e96453..37faf0f7 100644
--- a/src/lib/__tests__/encryption.test.ts
+++ b/src/lib/__tests__/encryption.test.ts
@@ -88,14 +88,6 @@ describe("encryption without ENCRYPTION_KEY (passthrough)", () => {
const { decrypt } = await freshImport();
expect(decrypt("hello")).toBe("hello");
});
-
- it("encryptArray / decryptArray return the original array", async () => {
- const { encryptArray, decryptArray } = await freshImport();
- const input = ["a", "b", "c"];
- const encrypted = encryptArray(input);
- expect(encrypted).toEqual(input);
- expect(decryptArray(encrypted)).toEqual(input);
- });
});
// ---------------------------------------------------------------------------
@@ -131,19 +123,6 @@ describe("encryption with ENCRYPTION_KEY set", () => {
expect(a).not.toBe(b);
});
- it("encryptArray / decryptArray round-trip an array of strings", async () => {
- const { encryptArray, decryptArray, isEncrypted } = await freshImport();
- const original = ["alpha", "bravo", "charlie"];
- const encrypted = encryptArray(original);
-
- // Every element should look encrypted
- for (const el of encrypted) {
- expect(isEncrypted(el)).toBe(true);
- }
-
- expect(decryptArray(encrypted)).toEqual(original);
- });
-
it("decrypt passes through a non-encrypted string without error", async () => {
const { decrypt } = await freshImport();
expect(decrypt("plain-legacy-value")).toBe("plain-legacy-value");
diff --git a/src/lib/__tests__/mfa.test.ts b/src/lib/__tests__/mfa.test.ts
deleted file mode 100644
index c87d501a..00000000
--- a/src/lib/__tests__/mfa.test.ts
+++ /dev/null
@@ -1,140 +0,0 @@
-import { describe, it, expect } from "vitest";
-import {
- generateMfaSecret,
- generateMfaUri,
- verifyMfaToken,
- generateBackupCodes,
- verifyBackupCode,
-} from "@/lib/mfa";
-
-describe("generateMfaSecret", () => {
- it("returns a non-empty string", () => {
- const secret = generateMfaSecret();
- expect(typeof secret).toBe("string");
- expect(secret.length).toBeGreaterThan(0);
- });
-
- it("generates unique secrets on successive calls", () => {
- const secrets = new Set(
- Array.from({ length: 20 }, () => generateMfaSecret()),
- );
- expect(secrets.size).toBe(20);
- });
-});
-
-describe("generateMfaUri", () => {
- it("returns a valid otpauth:// URI", () => {
- const secret = generateMfaSecret();
- const uri = generateMfaUri(secret, "user@example.com");
- expect(uri).toMatch(/^otpauth:\/\/totp\//);
- });
-
- it("includes the email in the URI", () => {
- const secret = generateMfaSecret();
- const uri = generateMfaUri(secret, "alice@example.com");
- expect(uri).toContain("alice");
- });
-
- it("includes the issuer parameter as AssetTracker", () => {
- const secret = generateMfaSecret();
- const uri = generateMfaUri(secret, "user@example.com");
- expect(uri).toContain("issuer=AssetTracker");
- });
-
- it("includes the secret parameter", () => {
- const secret = generateMfaSecret();
- const uri = generateMfaUri(secret, "user@example.com");
- expect(uri).toContain(`secret=${secret}`);
- });
-});
-
-describe("verifyMfaToken", () => {
- it("accepts a valid TOTP token generated from the same secret", async () => {
- const { generateSync, generateSecret } = await import("otplib");
- const secret = generateSecret();
- const token = generateSync({ secret });
- const result = verifyMfaToken(secret, token);
- expect(result).toBe(true);
- });
-
- it("rejects an invalid token", () => {
- const secret = generateMfaSecret();
- expect(verifyMfaToken(secret, "000000")).toBe(false);
- });
-
- it("throws on empty token", () => {
- const secret = generateMfaSecret();
- expect(() => verifyMfaToken(secret, "")).toThrow();
- });
-});
-
-describe("generateBackupCodes", () => {
- it("generates 8 codes by default", () => {
- const codes = generateBackupCodes();
- expect(codes).toHaveLength(8);
- });
-
- it("generates a custom number of codes", () => {
- expect(generateBackupCodes(4)).toHaveLength(4);
- expect(generateBackupCodes(12)).toHaveLength(12);
- });
-
- it("generates codes in uppercase hex format (8 chars each)", () => {
- const codes = generateBackupCodes();
- for (const code of codes) {
- expect(code).toMatch(/^[0-9A-F]{8}$/);
- }
- });
-
- it("generates unique codes within a single batch", () => {
- const codes = generateBackupCodes(50);
- const unique = new Set(codes);
- expect(unique.size).toBe(50);
- });
-});
-
-describe("verifyBackupCode", () => {
- it("validates a correct backup code", () => {
- const codes = generateBackupCodes();
- const target = codes[0];
- const result = verifyBackupCode(codes, target);
- expect(result.valid).toBe(true);
- expect(result.remainingCodes).not.toContain(target);
- expect(result.remainingCodes).toHaveLength(codes.length - 1);
- });
-
- it("rejects an invalid backup code", () => {
- const codes = generateBackupCodes();
- const result = verifyBackupCode(codes, "ZZZZZZZZ");
- expect(result.valid).toBe(false);
- expect(result.remainingCodes).toEqual(codes);
- });
-
- it("is case-insensitive", () => {
- const codes = generateBackupCodes();
- const target = codes[2];
- const result = verifyBackupCode(codes, target.toLowerCase());
- expect(result.valid).toBe(true);
- });
-
- it("strips dashes from input before matching", () => {
- const codes = generateBackupCodes();
- const target = codes[0];
- const dashedCode = target.slice(0, 4) + "-" + target.slice(4);
- const result = verifyBackupCode(codes, dashedCode);
- expect(result.valid).toBe(true);
- });
-
- it("handles empty codes array", () => {
- const result = verifyBackupCode([], "ABCDEF12");
- expect(result.valid).toBe(false);
- expect(result.remainingCodes).toEqual([]);
- });
-
- it("removes only the matched code, leaving others intact", () => {
- const codes = ["AAAA1111", "BBBB2222", "CCCC3333"];
- const result = verifyBackupCode(codes, "BBBB2222");
- expect(result.valid).toBe(true);
- expect(result.remainingCodes).toEqual(["AAAA1111", "CCCC3333"]);
- });
-});
diff --git a/src/lib/auth-client.ts b/src/lib/auth-client.ts
index 124428a1..75dfbb3a 100644
--- a/src/lib/auth-client.ts
+++ b/src/lib/auth-client.ts
@@ -30,7 +30,6 @@ export interface SessionUser {
departmentId?: string;
authProvider?: string;
isActive?: boolean;
- mfaEnabled?: boolean;
}
export const authClient = createAuthClient({
diff --git a/src/lib/auth-server.ts b/src/lib/auth-server.ts
index b196f006..f551ae9e 100644
--- a/src/lib/auth-server.ts
+++ b/src/lib/auth-server.ts
@@ -13,7 +13,7 @@ import {
microsoftEntraId,
} from "better-auth/plugins/generic-oauth";
import { nextCookies } from "better-auth/next-js";
-import { createAuthMiddleware } from "better-auth/api";
+import { createAuthMiddleware, APIError } from "better-auth/api";
import prisma from "@/lib/prisma";
import bcrypt from "bcryptjs";
import { logger } from "@/lib/logger";
@@ -23,6 +23,10 @@ import {
recordSuccessfulLogin,
} from "@/lib/account-lockout";
import { createAuditLog, AUDIT_ACTIONS, AUDIT_ENTITIES } from "@/lib/audit-log";
+import {
+ classifyTwoFactorCall,
+ auditTwoFactorEvent,
+} from "@/lib/auth-two-factor-audit";
import { checkRateLimit } from "@/lib/rate-limit";
import { parseDeviceName, parseBrowser } from "@/lib/session-tracking";
import {
@@ -112,6 +116,57 @@ const vercelOrigins = [
.filter(Boolean)
.map((h) => `https://${h}`);
+type AuthHookContext = Parameters<
+ Parameters[0]
+>[0];
+
+/** Stamp device info on the session that was just created for a login. */
+async function enrichLatestSession(userId: string, userAgent: string | null) {
+ const deviceName = `${parseDeviceName(userAgent)} - ${parseBrowser(userAgent)}`;
+ try {
+ const latestSession = await prisma.sessions.findFirst({
+ where: { userId },
+ orderBy: { createdAt: "desc" },
+ });
+ if (latestSession) {
+ await prisma.sessions.update({
+ where: { id: latestSession.id },
+ data: { deviceName, lastActive: new Date(), isCurrent: true },
+ });
+ }
+ } catch {
+ // Non-critical — don't break login
+ }
+}
+
+/**
+ * Audit two-factor enrolment, removal and logins. The plugin's verify endpoints
+ * serve both enrolment (request carries a session cookie) and login (request
+ * carries only the two-factor cookie), so the cookie decides which it was.
+ */
+async function handleTwoFactorAfterHook(ctx: AuthHookContext) {
+ const returned = ctx.context.returned as
+ { user?: { id?: string } } | APIError | undefined;
+ const failed = returned instanceof APIError;
+ const returnedUserId = !failed ? returned?.user?.id : undefined;
+ const event = classifyTwoFactorCall({
+ path: ctx.path,
+ failed,
+ hadSession: Boolean(
+ ctx.getCookie(ctx.context.authCookies.sessionToken.name),
+ ),
+ userId: ctx.context.session?.user?.id ?? returnedUserId ?? null,
+ });
+ if (!event) return;
+ await auditTwoFactorEvent(event);
+ if (event.kind === "login") {
+ await enrichLatestSession(
+ event.userId,
+ ctx.headers?.get("user-agent") || null,
+ );
+ }
+}
+
export const auth = betterAuth({
appName: "AssetTracker",
baseURL: process.env.BETTER_AUTH_URL || vercelOrigins[0],
@@ -190,11 +245,6 @@ export const auth = betterAuth({
required: false,
defaultValue: true,
},
- mfaEnabled: {
- type: "boolean",
- required: false,
- defaultValue: false,
- },
password: {
type: "string",
required: false,
@@ -246,6 +296,10 @@ export const auth = betterAuth({
plugins: [
twoFactor({
issuer: "AssetTracker",
+ // LDAP/SSO users have no credential account; local users still confirm
+ // enrolment changes with their password.
+ allowPasswordless: true,
+ backupCodeOptions: { storeBackupCodes: "encrypted" },
}),
...(process.env.MICROSOFT_CLIENT_ID && process.env.MICROSOFT_CLIENT_SECRET
? [
@@ -339,8 +393,7 @@ export const auth = betterAuth({
if (ctx.path !== "/sign-in/email") return;
const body = ctx.body as
- | { email?: string; password?: string }
- | undefined;
+ { email?: string; password?: string } | undefined;
if (!body?.email) return;
const rawIdentifier = body.email;
@@ -485,12 +538,25 @@ export const auth = betterAuth({
}
}),
after: createAuthMiddleware(async (ctx) => {
+ if (ctx.path.startsWith("/two-factor/")) {
+ await handleTwoFactorAfterHook(ctx);
+ return;
+ }
if (ctx.path !== "/sign-in/email") return;
const body = ctx.body as { email?: string } | undefined;
if (!body?.email) return;
const identifier = body.email;
+ // A 2FA user has passed the password step; the login completes (and is
+ // audited) in the /two-factor/verify-* after-hook.
+ const returned = ctx.context.returned as
+ { twoFactorRedirect?: boolean } | undefined;
+ if (returned?.twoFactorRedirect) {
+ await recordSuccessfulLogin(identifier);
+ return;
+ }
+
// Check if login succeeded (session cookie was set)
const setCookie = ctx.context.responseHeaders?.get("set-cookie");
if (setCookie) {
@@ -515,32 +581,12 @@ export const auth = betterAuth({
},
});
- // Enrich the most recent session with device info
const ip =
ctx.headers?.get("x-forwarded-for")?.split(",")[0]?.trim() ||
ctx.headers?.get("x-real-ip") ||
null;
const userAgent = ctx.headers?.get("user-agent") || null;
- const deviceName = `${parseDeviceName(userAgent)} - ${parseBrowser(userAgent)}`;
-
- try {
- const latestSession = await prisma.sessions.findFirst({
- where: { userId: user.userid },
- orderBy: { createdAt: "desc" },
- });
- if (latestSession) {
- await prisma.sessions.update({
- where: { id: latestSession.id },
- data: {
- deviceName,
- lastActive: new Date(),
- isCurrent: true,
- },
- });
- }
- } catch {
- // Non-critical — don't break login
- }
+ await enrichLatestSession(user.userid, userAgent);
try {
recordLoginAttempt(
diff --git a/src/lib/auth-two-factor-audit.ts b/src/lib/auth-two-factor-audit.ts
new file mode 100644
index 00000000..53bbd964
--- /dev/null
+++ b/src/lib/auth-two-factor-audit.ts
@@ -0,0 +1,78 @@
+/**
+ * Audit trail for BetterAuth's two-factor endpoints.
+ *
+ * Enrolment, removal and backup-code regeneration are recorded as USER updates;
+ * a login completed with a TOTP or backup code is recorded as a LOGIN, mirroring
+ * the credentials login audit in `auth-server.ts`.
+ */
+
+import { createAuditLog, AUDIT_ACTIONS, AUDIT_ENTITIES } from "@/lib/audit-log";
+
+export interface TwoFactorCall {
+ path: string;
+ /** The endpoint threw; nothing happened, nothing to audit. */
+ failed: boolean;
+ /** A session cookie accompanied the request: enrolment or management, not a login. */
+ hadSession: boolean;
+ userId: string | null;
+}
+
+export type TwoFactorEvent =
+ | {
+ kind: "enabled" | "disabled" | "backup_codes_regenerated";
+ userId: string;
+ }
+ | { kind: "login"; userId: string; method: "totp" | "backup_code" };
+
+const LOGIN_METHODS: Record = {
+ "/two-factor/verify-totp": "totp",
+ "/two-factor/verify-backup-code": "backup_code",
+};
+
+const UPDATE_REASONS: Record<
+ Exclude,
+ string
+> = {
+ enabled: "MFA enabled",
+ disabled: "MFA disabled",
+ backup_codes_regenerated: "MFA backup codes regenerated",
+};
+
+export function classifyTwoFactorCall(
+ call: TwoFactorCall,
+): TwoFactorEvent | null {
+ if (call.failed || !call.userId) return null;
+ const { path, userId } = call;
+ if (path === "/two-factor/disable") return { kind: "disabled", userId };
+ if (path === "/two-factor/generate-backup-codes") {
+ return { kind: "backup_codes_regenerated", userId };
+ }
+ const method = LOGIN_METHODS[path];
+ if (!method) return null;
+ // verify-totp doubles as the enrolment confirmation when called with a session.
+ if (call.hadSession)
+ return method === "totp" ? { kind: "enabled", userId } : null;
+ return { kind: "login", userId, method };
+}
+
+export async function auditTwoFactorEvent(
+ event: TwoFactorEvent,
+): Promise {
+ if (event.kind === "login") {
+ await createAuditLog({
+ userId: event.userId,
+ action: AUDIT_ACTIONS.LOGIN,
+ entity: AUDIT_ENTITIES.USER,
+ entityId: event.userId,
+ details: { method: event.method },
+ });
+ return;
+ }
+ await createAuditLog({
+ userId: event.userId,
+ action: AUDIT_ACTIONS.UPDATE,
+ entity: AUDIT_ENTITIES.USER,
+ entityId: event.userId,
+ details: { reason: UPDATE_REASONS[event.kind] },
+ });
+}
diff --git a/src/lib/encryption.ts b/src/lib/encryption.ts
index d68b3619..6f84ca8b 100644
--- a/src/lib/encryption.ts
+++ b/src/lib/encryption.ts
@@ -146,23 +146,6 @@ export function isEncrypted(value: string): boolean {
);
}
-/**
- * Encrypt an array of strings (e.g. backup codes).
- * Each element is encrypted individually so the array structure is preserved.
- * If ENCRYPTION_KEY is not set, returns the array unchanged.
- */
-export function encryptArray(values: string[]): string[] {
- return values.map(encrypt);
-}
-
-/**
- * Decrypt an array of strings previously encrypted with `encryptArray()`.
- * Handles mixed arrays where some elements may be unencrypted (legacy data).
- */
-export function decryptArray(values: string[]): string[] {
- return values.map(decrypt);
-}
-
/**
* Produce a one-way SHA-256 hash of a value.
*
diff --git a/src/lib/mfa.ts b/src/lib/mfa.ts
deleted file mode 100644
index 09df4cdd..00000000
--- a/src/lib/mfa.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import * as otplib from "otplib";
-import crypto from "crypto";
-
-export function generateMfaSecret(): string {
- return otplib.generateSecret();
-}
-
-export function generateMfaUri(secret: string, email: string): string {
- return otplib.generateURI({
- issuer: "AssetTracker",
- label: email,
- secret,
- strategy: "totp",
- });
-}
-
-export function verifyMfaToken(secret: string, token: string): boolean {
- const result = otplib.verifySync({ token, secret });
- return result.valid;
-}
-
-export function generateBackupCodes(count = 8): string[] {
- return Array.from({ length: count }, () =>
- crypto.randomBytes(4).toString("hex").toUpperCase(),
- );
-}
-
-export function verifyBackupCode(
- codes: string[],
- code: string,
-): { valid: boolean; remainingCodes: string[] } {
- const normalizedCode = code.toUpperCase().replace(/-/g, "");
- const index = codes.indexOf(normalizedCode);
- if (index === -1) return { valid: false, remainingCodes: codes };
- const remainingCodes = [...codes];
- remainingCodes.splice(index, 1);
- return { valid: true, remainingCodes };
-}
diff --git a/vercel.json b/vercel.json
index e1d5a199..077a860d 100644
--- a/vercel.json
+++ b/vercel.json
@@ -1,6 +1,6 @@
{
"$schema": "https://openapi.vercel.sh/vercel.json",
- "buildCommand": "node prisma/set-schema.mjs && prisma generate && prisma migrate deploy && next build",
+ "buildCommand": "node prisma/set-schema.mjs && prisma generate && if [ \"$VERCEL_ENV\" = \"production\" ]; then prisma migrate deploy; fi && next build",
"installCommand": "bun install",
"crons": [
{