mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-12-25 20:58:50 +01:00
* 🔒 feat: add Two-Factor Authentication (2FA) with backup codes & QR support (#5684) * working version for generating TOTP and authenticate. * better looking UI * refactored + better TOTP logic * fixed issue with UI * fixed issue: remove initial setup when closing window before completion. * added: onKeyDown for verify and disable * refactored some code and cleaned it up a bit. * refactored some code and cleaned it up a bit. * refactored some code and cleaned it up a bit. * refactored some code and cleaned it up a bit. * fixed issue after updating to new main branch * updated example * refactored controllers * removed `passport-totp` not used. * update the generateBackupCodes function to generate 10 codes by default: * update the backup codes to an object. * fixed issue with backup codes not working * be able to disable 2FA with backup codes. * removed new env. replaced with JWT_SECRET * ✨ style: improved a11y and style for TwoFactorAuthentication * 🔒 fix: small types checks * ✨ feat: improve 2FA UI components * fix: remove unnecessary console log * add option to disable 2FA with backup codes * - add option to refresh backup codes - (optional) maybe show the user which backup codes have already been used? * removed text to be able to merge the main. * removed eng tx to be able to merge * fix: migrated lang to new format. * feat: rewrote whole 2FA UI + refactored 2FA backend * chore: resolving conflicts * chore: resolving conflicts * fix: missing packages, because of resolving conflicts. * fix: UI issue and improved a11y * fix: 2FA backup code not working * fix: update localization keys for UI consistency * fix: update button label to use localized text * fix: refactor backup codes regeneration and update localization keys * fix: remove outdated translation for shared links management * fix: remove outdated 2FA code prompts from translation.json * fix: add cursor styles for backup codes item based on usage state * fix: resolve conflict issue * fix: resolve conflict issue * fix: resolve conflict issue * fix: missing packages in package-lock.json * fix: add disabled opacity to the verify button in TwoFactorScreen * ⚙ fix: update 2FA logic to rely on backup codes instead of TOTP status * ⚙️ fix: Simplify user retrieval in 2FA logic by removing unnecessary TOTP secret query * ⚙️ test: Add unit tests for TwoFactorAuthController and twoFactorControllers * ⚙️ fix: Ensure backup codes are validated as an array before usage in 2FA components * ⚙️ fix: Update module path mappings in tests to use relative paths * ⚙️ fix: Update moduleNameMapper in jest.config.js to remove the caret from path mapping * ⚙️ refactor: Simplify import paths in TwoFactorAuthController and twoFactorControllers test files * ⚙️ test: Mock twoFactorService methods in twoFactorControllers tests * ⚙️ refactor: Comment out unused imports and mock setups in test files for two-factor authentication * ⚙️ refactor: removed files * refactor: Exclude totpSecret from user data retrieval in AuthController, LoginController, and jwtStrategy * refactor: Consolidate backup code verification to apply DRY and remove default array in user schema * refactor: Enhance two-factor authentication ux/flow with improved error handling and loading state management, prevent redirect to /login --------- Co-authored-by: Marco Beretta <81851188+berry-13@users.noreply.github.com> Co-authored-by: Danny Avila <danny@librechat.ai>
163 lines
4.8 KiB
TypeScript
163 lines
4.8 KiB
TypeScript
/* eslint-disable @typescript-eslint/no-explicit-any */
|
|
import axios, { AxiosError, AxiosRequestConfig } from 'axios';
|
|
import * as endpoints from './api-endpoints';
|
|
import { setTokenHeader } from './headers-helpers';
|
|
import type * as t from './types';
|
|
|
|
async function _get<T>(url: string, options?: AxiosRequestConfig): Promise<T> {
|
|
const response = await axios.get(url, { ...options });
|
|
return response.data;
|
|
}
|
|
|
|
async function _getResponse<T>(url: string, options?: AxiosRequestConfig): Promise<T> {
|
|
return await axios.get(url, { ...options });
|
|
}
|
|
|
|
async function _post(url: string, data?: any) {
|
|
const response = await axios.post(url, JSON.stringify(data), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
return response.data;
|
|
}
|
|
|
|
async function _postMultiPart(url: string, formData: FormData, options?: AxiosRequestConfig) {
|
|
const response = await axios.post(url, formData, {
|
|
...options,
|
|
headers: { 'Content-Type': 'multipart/form-data' },
|
|
});
|
|
return response.data;
|
|
}
|
|
|
|
async function _postTTS(url: string, formData: FormData, options?: AxiosRequestConfig) {
|
|
const response = await axios.post(url, formData, {
|
|
...options,
|
|
headers: { 'Content-Type': 'multipart/form-data' },
|
|
responseType: 'arraybuffer',
|
|
});
|
|
return response.data;
|
|
}
|
|
|
|
async function _put(url: string, data?: any) {
|
|
const response = await axios.put(url, JSON.stringify(data), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
return response.data;
|
|
}
|
|
|
|
async function _delete<T>(url: string): Promise<T> {
|
|
const response = await axios.delete(url);
|
|
return response.data;
|
|
}
|
|
|
|
async function _deleteWithOptions<T>(url: string, options?: AxiosRequestConfig): Promise<T> {
|
|
const response = await axios.delete(url, { ...options });
|
|
return response.data;
|
|
}
|
|
|
|
async function _patch(url: string, data?: any) {
|
|
const response = await axios.patch(url, JSON.stringify(data), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
return response.data;
|
|
}
|
|
|
|
let isRefreshing = false;
|
|
let failedQueue: { resolve: (value?: any) => void; reject: (reason?: any) => void }[] = [];
|
|
|
|
const refreshToken = (retry?: boolean): Promise<t.TRefreshTokenResponse | undefined> =>
|
|
_post(endpoints.refreshToken(retry));
|
|
|
|
const dispatchTokenUpdatedEvent = (token: string) => {
|
|
setTokenHeader(token);
|
|
window.dispatchEvent(new CustomEvent('tokenUpdated', { detail: token }));
|
|
};
|
|
|
|
const processQueue = (error: AxiosError | null, token: string | null = null) => {
|
|
failedQueue.forEach((prom) => {
|
|
if (error) {
|
|
prom.reject(error);
|
|
} else {
|
|
prom.resolve(token);
|
|
}
|
|
});
|
|
failedQueue = [];
|
|
};
|
|
|
|
axios.interceptors.response.use(
|
|
(response) => response,
|
|
async (error) => {
|
|
const originalRequest = error.config;
|
|
if (!error.response) {
|
|
return Promise.reject(error);
|
|
}
|
|
|
|
if (originalRequest.url?.includes('/api/auth/2fa') === true) {
|
|
return Promise.reject(error);
|
|
}
|
|
if (originalRequest.url?.includes('/api/auth/logout') === true) {
|
|
return Promise.reject(error);
|
|
}
|
|
|
|
if (error.response.status === 401 && !originalRequest._retry) {
|
|
console.warn('401 error, refreshing token');
|
|
originalRequest._retry = true;
|
|
|
|
if (isRefreshing) {
|
|
try {
|
|
const token = await new Promise((resolve, reject) => {
|
|
failedQueue.push({ resolve, reject });
|
|
});
|
|
originalRequest.headers['Authorization'] = 'Bearer ' + token;
|
|
return await axios(originalRequest);
|
|
} catch (err) {
|
|
return Promise.reject(err);
|
|
}
|
|
}
|
|
|
|
isRefreshing = true;
|
|
|
|
try {
|
|
const response = await refreshToken(
|
|
// Handle edge case where we get a blank screen if the initial 401 error is from a refresh token request
|
|
originalRequest.url?.includes('api/auth/refresh') === true ? true : false,
|
|
);
|
|
|
|
const token = response?.token ?? '';
|
|
|
|
if (token) {
|
|
originalRequest.headers['Authorization'] = 'Bearer ' + token;
|
|
dispatchTokenUpdatedEvent(token);
|
|
processQueue(null, token);
|
|
return await axios(originalRequest);
|
|
} else if (window.location.href.includes('share/')) {
|
|
console.log(
|
|
`Refresh token failed from shared link, attempting request to ${originalRequest.url}`,
|
|
);
|
|
} else {
|
|
window.location.href = '/login';
|
|
}
|
|
} catch (err) {
|
|
processQueue(err as AxiosError, null);
|
|
return Promise.reject(err);
|
|
} finally {
|
|
isRefreshing = false;
|
|
}
|
|
}
|
|
|
|
return Promise.reject(error);
|
|
},
|
|
);
|
|
|
|
export default {
|
|
get: _get,
|
|
getResponse: _getResponse,
|
|
post: _post,
|
|
postMultiPart: _postMultiPart,
|
|
postTTS: _postTTS,
|
|
put: _put,
|
|
delete: _delete,
|
|
deleteWithOptions: _deleteWithOptions,
|
|
patch: _patch,
|
|
refreshToken,
|
|
dispatchTokenUpdatedEvent,
|
|
};
|