MFA

import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import { AuthKernelLive } from "@effect-auth/core/AuthKernel";
import {
  AuthHttpApiConfigLive,
  CoreAuthHttpApiLive,
  MfaHttpApiLive,
} from "@effect-auth/core/HttpApi";
import { PasskeyOptionsLive } from "@effect-auth/core/Passkey";
import { PasswordDefaultLive } from "@effect-auth/core/Password";
import { Layer } from "effect";
import { HttpServer } from "effect/unstable/http";

const FeaturesLive = Layer.mergeAll(
  PasswordDefaultLive(),
  PasskeyOptionsLive
);

const ServicesLive = FeaturesLive.pipe(
  Layer.provideMerge(AuthKernelLive),
  Layer.provideMerge(AppAuthRuntimeLive)
);

const HttpConfigLive = AuthHttpApiConfigLive({
  originCheck: { allowedOrigins: ["https://app.example.com"] },
});

export const AuthLive = Layer.mergeAll(
  CoreAuthHttpApiLive,
  MfaHttpApiLive
).pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(Layer.mergeAll(ServicesLive, AppRateLimitLive)),
  Layer.provide(HttpConfigLive),
  Layer.provide(HttpServer.layerServices)
);

import { createAuthClient } from "@effect-auth/core/Client";

const auth = createAuthClient({
  requestInit: { credentials: "include" },
});

const result = await auth.password.signIn({
  identity: { scope: { type: "global" }, kind: "email", value: email },
  password,
});

if (result.type === "requires_mfa") {
  const options = await auth.mfa.options({ flowId: result.flowId });

  if (options.factors.some((factor) => factor.type === "totp")) {
    await auth.mfa.totp.verify({ flowId: result.flowId, code });
  }
}

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  mfaOptionsEndpoint,
  passkeyMfaStartEndpoint,
  passkeyMfaVerifyEndpoint,
  recoveryCodeMfaVerifyForFlowEndpoint,
  totpMfaVerifyForFlowEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppMfaHttpApiGroup extends HttpApiGroup.make("mfa")
  .add(
    mfaOptionsEndpoint,
    totpMfaVerifyForFlowEndpoint,
    recoveryCodeMfaVerifyForFlowEndpoint,
    passkeyMfaStartEndpoint,
    passkeyMfaVerifyEndpoint
  )
  .prefix("/auth/mfa")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppMfaHttpApiGroup) {}

import {
  MfaHttpOperations,
  MfaHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppMfaHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "mfa",
  Effect.fn("app.auth.mfa")(function* (handlers) {
    const mfa = yield* MfaHttpOperations;

    return handlers
      .handle("options", mfa.options)
      .handle("verifyTotpForFlow", mfa.verifyTotpForFlow)
      .handle("verifyRecoveryCodeForFlow", mfa.verifyRecoveryCodeForFlow)
      .handle("startPasskey", mfa.startPasskey)
      .handle("verifyPasskey", mfa.verifyPasskey);
  })
).pipe(Layer.provide(MfaHttpOperationsLive));

import { AuthFlow, AuthFlowState } from "@effect-auth/core/AuthFlow";
import type { AuthFlowId } from "@effect-auth/core/Identifiers";
import { TotpFactorManagement } from "@effect-auth/core/Totp";
import { Data, Effect, Redacted } from "effect";

class InvalidMfaFactor extends Data.TaggedError("InvalidMfaFactor")<{}> {}

export const completeTotpMfa = (input: {
  readonly flowId: AuthFlowId;
  readonly code: string;
}) =>
  Effect.gen(function* () {
    const state = yield* AuthFlowState;
    const pending = yield* state.inspect(input.flowId);
    const totp = yield* TotpFactorManagement;
    const verified = yield* totp.verifyForUser({
      userId: pending.userId,
      code: Redacted.make(input.code),
      window: 1,
      metadata: { purpose: "login-mfa" },
    });

    if (!verified.valid) {
      return yield* new InvalidMfaFactor();
    }

    const authFlow = yield* AuthFlow;
    return yield* authFlow.completeMfa({
      flowId: input.flowId,
      userId: pending.userId,
      method: "totp",
      metadata: { purpose: "login-mfa" },
    });
  });

const result = yield* completeTotpMfa({ flowId, code });

switch (result._tag) {
  case "Authenticated":
    // Commit result.session with your SessionCookie service, then return success.
    return yield* commitAuthenticated(result.session);
  case "RequiresLoginApproval":
    // Return the next continuation. Do not commit an authenticated session yet.
    return yield* returnLoginApproval(result);
  case "PolicyDenied":
    return yield* returnSafePolicyDenial();
}