| 1 | import { useState } from "react"; |
| 2 | import { Form, Link, redirect } from "react-router"; |
| 3 | |
| 4 | import type { Route } from "./+types/login-two-factor"; |
| 5 | import { AuthCard } from "../components/auth-card"; |
| 6 | import { ErrorText, Field, Input, SubmitButton } from "../components/ui"; |
| 7 | import { Button } from "../components/ui/button"; |
| 8 | import { PENDING_COOKIE, TWO_FACTOR_COOKIE, cookie, readCookie } from "../lib/github"; |
| 9 | import { githubSignIn } from "../lib/github.server"; |
| 10 | import { page } from "../lib/meta"; |
| 11 | import { otpInputProps } from "../lib/otp"; |
| 12 | import { identity } from "../lib/services.server"; |
| 13 | import { assertSameOrigin, clientOf, getViewer, nextPath, startSession } from "../lib/session.server"; |
| 14 | |
| 15 | export function meta(args: Route.MetaArgs) { |
| 16 | return page(args, { title: "Two-factor authentication · g1t" }); |
| 17 | } |
| 18 | |
| 19 | /** Only reached with a sign-in waiting for its code; anyone else signs in first. */ |
| 20 | export async function loader({ request, context }: Route.LoaderArgs) { |
| 21 | if (getViewer(context)) throw redirect(nextPath(request)); |
| 22 | if (!readCookie(request.headers.get("cookie"), TWO_FACTOR_COOKIE)) { |
| 23 | const next = nextPath(request); |
| 24 | throw redirect(next === "/" ? "/login" : `/login?next=${encodeURIComponent(next)}`); |
| 25 | } |
| 26 | return { next: nextPath(request) }; |
| 27 | } |
| 28 | |
| 29 | export async function action({ request }: Route.ActionArgs) { |
| 30 | assertSameOrigin(request); |
| 31 | const cookies = request.headers.get("cookie"); |
| 32 | const challenge = readCookie(cookies, TWO_FACTOR_COOKIE); |
| 33 | if (!challenge) return { error: "This sign-in has expired. Sign in again.", expired: true }; |
| 34 | const form = await request.formData(); |
| 35 | const result = await identity.twoFactorSignIn(challenge, String(form.get("code") ?? ""), clientOf(request)); |
| 36 | if (!result.ok) { |
| 37 | const expired = result.error.message.includes("expired"); |
| 38 | return { error: result.error.message, expired }; |
| 39 | } |
| 40 | const headers = new Headers({ "set-cookie": startSession(result.value.sessionToken) }); |
| 41 | headers.append("set-cookie", cookie(TWO_FACTOR_COOKIE, "", 0)); |
| 42 | // A GitHub sign-in waiting to be linked links now, as after a password. |
| 43 | const pending = readCookie(cookies, PENDING_COOKIE); |
| 44 | if (pending) { |
| 45 | await githubSignIn.claim(pending, result.value.user).catch(() => null); |
| 46 | headers.append("set-cookie", cookie(PENDING_COOKIE, "", 0)); |
| 47 | } |
| 48 | throw redirect(nextPath(request), { headers }); |
| 49 | } |
| 50 | |
| 51 | export default function LoginTwoFactor({ actionData }: Route.ComponentProps) { |
| 52 | const [recovery, setRecovery] = useState(false); |
| 53 | return ( |
| 54 | <AuthCard |
| 55 | title="Two-factor authentication" |
| 56 | subtitle="Enter the code from your authenticator app" |
| 57 | footer={ |
| 58 | <Link to="/login" className="text-fg underline underline-offset-4"> |
| 59 | Sign in again |
| 60 | </Link> |
| 61 | } |
| 62 | > |
| 63 | <Form id="two-factor-sign-in" method="post" className="space-y-4"> |
| 64 | <Field label={recovery ? "Recovery code" : "Authentication code"} htmlFor="totp-code"> |
| 65 | {/* Either kind is accepted whichever is chosen, so a pasted recovery code is never cut; the choice sets the keyboard. */} |
| 66 | <Input {...otpInputProps({ id: "totp-code", recovery: true })} inputMode={recovery ? "text" : "numeric"} placeholder={recovery ? "k7m2q-9xw4d" : "123 456"} required autoFocus /> |
| 67 | </Field> |
| 68 | {/* A phone shows digits for an app's code; a recovery code needs letters. */} |
| 69 | <Button type="button" variant="link" onClick={() => setRecovery(!recovery)}> |
| 70 | {recovery ? "Use an authenticator code" : "Use a recovery code"} |
| 71 | </Button> |
| 72 | <ErrorText>{actionData?.error}</ErrorText> |
| 73 | <div className="pt-2 *:w-full"> |
| 74 | <SubmitButton pending="Checking…">Verify</SubmitButton> |
| 75 | </div> |
| 76 | </Form> |
| 77 | </AuthCard> |
| 78 | ); |
| 79 | } |