acc93de708
Uses better-auth's built-in twoFactor plugin rather than hand-rolling TOTP — adds the two_factors table and users.twoFactorEnabled, wires the server/client plugins (allowPasswordless: true so OAuth-only accounts aren't locked out of managing 2FA), and adds a custom rate limit for the verify endpoints (5/min — far stricter than the default 100/10s, since a 6-digit code has a much smaller keyspace than a password). New Settings → Security section walks through enable (password confirm -> QR + backup codes -> confirm a live code before it's actually turned on, per the plugin's default flow) and disable. New /verify-2fa page handles the post-password mid-login step, with a backup-code fallback. Verified live end-to-end: enable, confirm, forced re-auth on next sign-in, TOTP accepted, backup code accepted (single-use), disable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
169 lines
5.3 KiB
TypeScript
169 lines
5.3 KiB
TypeScript
"use client";
|
|
|
|
import { useState } from "react";
|
|
import { toast } from "sonner";
|
|
import { Button, buttonVariants } from "@/components/ui/button";
|
|
import { Input } from "@/components/ui/input";
|
|
import { Label } from "@/components/ui/label";
|
|
import { useTranslations } from "next-intl";
|
|
import { authClient } from "@/lib/auth/client";
|
|
import { TwoFactorSettings } from "@/components/settings/two-factor-settings";
|
|
|
|
export function SecurityForm({
|
|
currentEmail,
|
|
twoFactorEnabled,
|
|
hasPassword,
|
|
}: {
|
|
currentEmail: string;
|
|
twoFactorEnabled: boolean;
|
|
hasPassword: boolean;
|
|
}) {
|
|
const t = useTranslations("settingsForm");
|
|
|
|
const [newEmail, setNewEmail] = useState("");
|
|
const [sendingEmail, setSendingEmail] = useState(false);
|
|
|
|
const [currentPassword, setCurrentPassword] = useState("");
|
|
const [newPassword, setNewPassword] = useState("");
|
|
const [confirmPassword, setConfirmPassword] = useState("");
|
|
const [changingPassword, setChangingPassword] = useState(false);
|
|
|
|
async function handleChangeEmail(e: React.FormEvent) {
|
|
e.preventDefault();
|
|
if (!newEmail.trim()) return;
|
|
setSendingEmail(true);
|
|
try {
|
|
const { error } = await authClient.changeEmail({
|
|
newEmail: newEmail.trim(),
|
|
callbackURL: "/settings",
|
|
});
|
|
if (error) {
|
|
toast.error(error.message ?? t("emailChangeFailed"));
|
|
} else {
|
|
toast.success(t("emailChangeSent"));
|
|
setNewEmail("");
|
|
}
|
|
} finally {
|
|
setSendingEmail(false);
|
|
}
|
|
}
|
|
|
|
async function handleChangePassword(e: React.FormEvent) {
|
|
e.preventDefault();
|
|
if (newPassword !== confirmPassword) {
|
|
toast.error(t("passwordMismatch"));
|
|
return;
|
|
}
|
|
setChangingPassword(true);
|
|
try {
|
|
const { error } = await authClient.changePassword({
|
|
currentPassword,
|
|
newPassword,
|
|
revokeOtherSessions: false,
|
|
});
|
|
if (error) {
|
|
toast.error(error.message ?? t("passwordChangeFailed"));
|
|
} else {
|
|
toast.success(t("passwordChanged"));
|
|
setCurrentPassword("");
|
|
setNewPassword("");
|
|
setConfirmPassword("");
|
|
}
|
|
} finally {
|
|
setChangingPassword(false);
|
|
}
|
|
}
|
|
|
|
return (
|
|
<div className="space-y-6">
|
|
<section className="rounded-xl border p-6 space-y-4">
|
|
<div>
|
|
<h2 className="font-semibold text-lg">{t("changeEmail")}</h2>
|
|
<p className="text-sm text-muted-foreground mt-1">{t("changeEmailDescription")}</p>
|
|
</div>
|
|
<form onSubmit={handleChangeEmail} className="space-y-3">
|
|
<div className="space-y-2">
|
|
<Label htmlFor="new-email">{t("newEmail")}</Label>
|
|
<Input
|
|
id="new-email"
|
|
type="email"
|
|
value={newEmail}
|
|
onChange={(e) => setNewEmail(e.target.value)}
|
|
placeholder={currentEmail}
|
|
required
|
|
/>
|
|
</div>
|
|
<Button type="submit" disabled={sendingEmail || !newEmail.trim()}>
|
|
{sendingEmail ? t("sendingVerification") : t("sendVerification")}
|
|
</Button>
|
|
</form>
|
|
</section>
|
|
|
|
<section className="rounded-xl border p-6 space-y-4">
|
|
<div>
|
|
<h2 className="font-semibold text-lg">{t("changePassword")}</h2>
|
|
</div>
|
|
<form onSubmit={handleChangePassword} className="space-y-3">
|
|
<div className="space-y-2">
|
|
<Label htmlFor="current-password">{t("currentPassword")}</Label>
|
|
<Input
|
|
id="current-password"
|
|
type="password"
|
|
value={currentPassword}
|
|
onChange={(e) => setCurrentPassword(e.target.value)}
|
|
autoComplete="current-password"
|
|
required
|
|
/>
|
|
</div>
|
|
<div className="space-y-2">
|
|
<Label htmlFor="new-password">{t("newPassword")}</Label>
|
|
<Input
|
|
id="new-password"
|
|
type="password"
|
|
value={newPassword}
|
|
onChange={(e) => setNewPassword(e.target.value)}
|
|
autoComplete="new-password"
|
|
minLength={8}
|
|
required
|
|
/>
|
|
</div>
|
|
<div className="space-y-2">
|
|
<Label htmlFor="confirm-password">{t("confirmPassword")}</Label>
|
|
<Input
|
|
id="confirm-password"
|
|
type="password"
|
|
value={confirmPassword}
|
|
onChange={(e) => setConfirmPassword(e.target.value)}
|
|
autoComplete="new-password"
|
|
minLength={8}
|
|
required
|
|
/>
|
|
</div>
|
|
<Button
|
|
type="submit"
|
|
disabled={changingPassword || !currentPassword || !newPassword || !confirmPassword}
|
|
>
|
|
{changingPassword ? t("changingPassword") : t("changePasswordButton")}
|
|
</Button>
|
|
</form>
|
|
</section>
|
|
|
|
<TwoFactorSettings initialEnabled={twoFactorEnabled} hasPassword={hasPassword} />
|
|
|
|
<section className="rounded-xl border p-6 space-y-4">
|
|
<div>
|
|
<h2 className="font-semibold text-lg">{t("downloadData")}</h2>
|
|
<p className="text-sm text-muted-foreground mt-1">{t("downloadDataDescription")}</p>
|
|
</div>
|
|
<a
|
|
href="/api/v1/users/me/export"
|
|
download
|
|
className={buttonVariants({ variant: "outline" })}
|
|
>
|
|
{t("downloadDataButton")}
|
|
</a>
|
|
</section>
|
|
</div>
|
|
);
|
|
}
|