Recovery Codes

import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import {
  RecoveryCodeHttpConfigLive,
  RecoveryCodesHttpApiLive,
} from "@effect-auth/core/HttpApi";
import {
  RecoveryCodeManagementLive,
  RecoveryCodesLive,
} from "@effect-auth/core/RecoveryCode";
import { Layer } from "effect";
import { HttpServer } from "effect/unstable/http";

const RecoveryCodeDomainLive = Layer.mergeAll(
  RecoveryCodesLive,
  RecoveryCodeManagementLive
).pipe(Layer.provideMerge(AppAuthRuntimeLive));

export const RecoveryCodesHttpApiGroupLive = RecoveryCodesHttpApiLive.pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(RecoveryCodeDomainLive),
  Layer.provide(AppSessionLive),
  Layer.provide(AppRateLimitLive),
  Layer.provide(
    RecoveryCodeHttpConfigLive({ count: 10, length: 16, groupSize: 4 })
  ),
  Layer.provide(HttpServer.layerServices)
);

import { createRecoveryCodeClient } from "@effect-auth/core/Client";

export const recoveryCodes = createRecoveryCodeClient({
  requestInit: { credentials: "include" },
});

const generated = await recoveryCodes.generation.generate({
  metadata: { source: "mfa-setup" },
});

const rotated = await recoveryCodes.generation.regenerate({
  metadata: { source: "settings" },
  revokeReason: "settings_rotation",
});

const { codes } = await recoveryCodes.codes.list();
await recoveryCodes.codes.revoke({ codeId, reason: "user_request" });

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  recoveryCodeGenerateEndpoint,
  recoveryCodeListEndpoint,
  recoveryCodeRegenerateEndpoint,
  recoveryCodeRevokeEndpoint,
  recoveryCodeVerifyEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppRecoveryCodesHttpApiGroup extends HttpApiGroup.make("recoveryCodes")
  .add(
    recoveryCodeGenerateEndpoint,
    recoveryCodeRegenerateEndpoint,
    recoveryCodeVerifyEndpoint,
    recoveryCodeListEndpoint,
    recoveryCodeRevokeEndpoint
  )
  .prefix("/auth/recovery-codes")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppRecoveryCodesHttpApiGroup) {}

import {
  RecoveryCodesHttpOperations,
  RecoveryCodesHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppRecoveryCodesHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "recoveryCodes",
  Effect.fn("app.auth.recovery_codes")(function* (handlers) {
    const recoveryCodes = yield* RecoveryCodesHttpOperations;

    return handlers
      .handle("generateRecoveryCodes", recoveryCodes.generate)
      .handle("regenerateRecoveryCodes", recoveryCodes.regenerate)
      .handle("verifyRecoveryCode", recoveryCodes.verify)
      .handle("listRecoveryCodes", recoveryCodes.list)
      .handle("revokeRecoveryCode", recoveryCodes.revoke);
  })
).pipe(Layer.provide(RecoveryCodesHttpOperationsLive));

import { RecoveryCodeManagement } from "@effect-auth/core/RecoveryCode";
import { CurrentSession } from "@effect-auth/core/Sessions";
import { requireFresh } from "@effect-auth/core/StepUp";
import { Duration, Effect } from "effect";

export const generateRecoveryCodes = Effect.gen(function* () {
  yield* requireFresh(Duration.minutes(10));
  const session = yield* CurrentSession;
  const recoveryCodes = yield* RecoveryCodeManagement;

  return yield* recoveryCodes.generateForUser({
    userId: session.userId,
    count: 10,
    length: 16,
    groupSize: 4,
    metadata: {
      source: "mfa-setup",
      generatedFromSession: session.sessionId,
    },
  });
});

import { RecoveryCodeManagement } from "@effect-auth/core/RecoveryCode";
import { CurrentSession } from "@effect-auth/core/Sessions";
import { requireFresh } from "@effect-auth/core/StepUp";
import {
  StrongFactorRemovalPolicy,
  strongFactor,
} from "@effect-auth/core/StrongFactor";
import { Duration, Effect } from "effect";

export const listRecoveryCodes = Effect.gen(function* () {
  const session = yield* CurrentSession;
  return yield* RecoveryCodeManagement.use((codes) =>
    codes.listForUser({ userId: session.userId }),
  );
});

export const regenerateRecoveryCodes = Effect.gen(function* () {
  yield* requireFresh(Duration.minutes(10));
  const session = yield* CurrentSession;
  return yield* RecoveryCodeManagement.use((codes) =>
    codes.regenerateForUser({
      userId: session.userId,
      count: 10,
      length: 16,
      groupSize: 4,
      revokeReason: "settings_rotation",
      metadata: { source: "settings" },
    }),
  );
});

export const revokeRecoveryCode = (codeId: Parameters<
  RecoveryCodeManagement["revokeForUser"]
>[0]["codeId"]) =>
  Effect.gen(function* () {
    yield* requireFresh(Duration.minutes(10));
    const session = yield* CurrentSession;
    const removal = yield* StrongFactorRemovalPolicy;
    const codes = yield* RecoveryCodeManagement;

    yield* removal.requireCanRemove({
      userId: session.userId,
      factor: strongFactor("recovery-code", codeId),
    });
    yield* codes.revokeForUser({
      userId: session.userId,
      codeId,
      reason: "user_request",
    });
  });