Support two factor authentication in backend

1 files changed, 54 insertions, 0 deletions

diff --git a/server/helpers/otp.ts b/server/helpers/otp.ts
new file mode 100644
index 000000000..a13edc5e2
--- /dev/null
+++ b/server/helpers/otp.ts
@@ -0,0 +1,54 @@
+import { Secret, TOTP } from 'otpauth'
+import { WEBSERVER } from '@server/initializers/constants'
+
+function isOTPValid (options: {
+  secret: string
+  token: string
+}) {
+  const { token, secret } = options
+
+  const totp = new TOTP({
+    ...baseOTPOptions(),
+
+    secret
+  })
+
+  const delta = totp.validate({
+    token,
+    window: 1
+  })
+
+  if (delta === null) return false
+
+  return true
+}
+
+function generateOTPSecret (email: string) {
+  const totp = new TOTP({
+    ...baseOTPOptions(),
+
+    label: email,
+    secret: new Secret()
+  })
+
+  return {
+    secret: totp.secret.base32,
+    uri: totp.toString()
+  }
+}
+
+export {
+  isOTPValid,
+  generateOTPSecret
+}
+
+// ---------------------------------------------------------------------------
+
+function baseOTPOptions () {
+  return {
+    issuer: WEBSERVER.HOST,
+    algorithm: 'SHA1',
+    digits: 6,
+    period: 30
+  }
+}