feat(settings): Security section to manage 2FA in-app - #23
Merged
Conversation
Lets a signed-in user set up, manage, and (when not mandatory) turn off two-factor without going through the at-login challenge. Needed for the flag-off-first rollout: you can now enrol from Settings before enforcing. Backend (session-authenticated, distinct from the challenge-token enroll/verify): - POST /auth/2fa/setup - provision a pending secret + otpauth URI - POST /auth/2fa/activate - confirm a code, enable, return recovery codes - POST /auth/2fa/disable - turn off (blocked while PB_REQUIRE_2FA; needs a code) - POST /auth/2fa/recovery-codes - regenerate (needs a code) Disable/regenerate require a live TOTP (recovery codes not accepted) so a hijacked session can't weaken the account; all share the per-account lockout. Frontend: - lib/auth/api.ts: get2faStatus/setup2fa/activate2fa/disable2fa/regenerate. - New Settings "Security" tab (SecuritySection): status, QR-less enrollment (otpauth deep link + manual key), one-time recovery codes, regenerate, and turn-off (hidden when 2FA is required). Gates: ruff, mypy (132 files), red-team eval (0), 12 2FA tests (5 new) + auth tests; web typecheck/lint/build + 132 web tests all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Security tab to Settings so a signed-in user can set up and manage two-factor authentication without going through the at-login challenge. This is what the flag-off-first rollout needs - you can now enrol from Settings before turning on
PB_REQUIRE_2FA.Backend (session-authenticated)
Distinct from the at-login
enroll/verify(which use a challenge token); these use the normal session bearer:POST /auth/2fa/setup- provision a pending secret +otpauth://URIPOST /auth/2fa/activate- confirm a code, enable, return one-time recovery codesPOST /auth/2fa/disable- turn off; blocked whilePB_REQUIRE_2FAis on, and requires a current codePOST /auth/2fa/recovery-codes- regenerate recovery codes (requires a current code)Disable and regenerate require a live TOTP (recovery codes are not accepted there) so a hijacked session can't weaken the account. All share the per-account lockout.
Frontend
lib/auth/api.ts:get2faStatus/setup2fa/activate2fa/disable2fa/regenerateRecoveryCodes.SecuritySection.tsx): on/off status, QR-less enrollment (authenticator deep link + copyable manual key), one-time recovery-codes display, regenerate, and turn-off (hidden when 2FA is mandatory).Verification
test_2fa.pytests (5 new for the session endpoints) + auth tests pass.Depends on the 2FA backend from #22 (already merged).
🤖 Generated with Claude Code