Step-up Authentication

import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import { AuthKernelLive } from "@effect-auth/core/AuthKernel";
import {
  AuthHttpApiConfigLive,
  CoreAuthHttpApiLive,
  StepUpHttpApiLive,
} from "@effect-auth/core/HttpApi";
import { PasskeyOptionsLive } from "@effect-auth/core/Passkey";
import { PasswordDefaultLive } from "@effect-auth/core/Password";
import { Layer } from "effect";
import { HttpServer } from "effect/unstable/http";

const ServicesLive = Layer.mergeAll(
  PasswordDefaultLive(),
  PasskeyOptionsLive
).pipe(
  Layer.provideMerge(AuthKernelLive),
  Layer.provideMerge(AppAuthRuntimeLive)
);

export const AuthLive = Layer.mergeAll(
  CoreAuthHttpApiLive,
  StepUpHttpApiLive
).pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(Layer.mergeAll(ServicesLive, AppRateLimitLive)),
  Layer.provide(
    AuthHttpApiConfigLive({
      originCheck: { allowedOrigins: ["https://app.example.com"] },
    })
  ),
  Layer.provide(HttpServer.layerServices)
);

import { createAuthClient } from "@effect-auth/core/Client";

const auth = createAuthClient({
  requestInit: { credentials: "include" },
});

async function confirmPayout() {
  const response = await fetch("/api/payouts/confirm", {
    method: "POST",
    credentials: "include",
  });

  if (response.status !== 403) return response;

  const error = await response.json();
  if (error.code !== "step_up_required") return response;

  const { factors } = await auth.stepUp.options();
  if (factors.some((factor) => factor.type === "passkey")) {
    await auth.stepUp.passkey.verify();
  } else {
    await auth.stepUp.password.verify({ password });
  }

  return fetch("/api/payouts/confirm", {
    method: "POST",
    credentials: "include",
  });
}

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  stepUpOptionsEndpoint,
  stepUpPasskeyStartEndpoint,
  stepUpPasskeyVerifyEndpoint,
  stepUpPasswordVerifyEndpoint,
  stepUpRecoveryCodeVerifyEndpoint,
  stepUpTotpVerifyEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppStepUpHttpApiGroup extends HttpApiGroup.make("stepUp")
  .add(
    stepUpOptionsEndpoint,
    stepUpTotpVerifyEndpoint,
    stepUpPasswordVerifyEndpoint,
    stepUpRecoveryCodeVerifyEndpoint,
    stepUpPasskeyStartEndpoint,
    stepUpPasskeyVerifyEndpoint
  )
  .prefix("/auth/step-up")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppStepUpHttpApiGroup) {}

import {
  StepUpHttpOperations,
  StepUpHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppStepUpHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "stepUp",
  Effect.fn("app.auth.step_up")(function* (handlers) {
    const stepUp = yield* StepUpHttpOperations;

    return handlers
      .handle("options", stepUp.options)
      .handle("verifyTotp", stepUp.verifyTotp)
      .handle("verifyPassword", stepUp.verifyPassword)
      .handle("verifyRecoveryCode", stepUp.verifyRecoveryCode)
      .handle("startPasskey", stepUp.startPasskey)
      .handle("verifyPasskey", stepUp.verifyPasskey);
  })
).pipe(Layer.provide(StepUpHttpOperationsLive));

import * as StepUp from "@effect-auth/core/StepUp";
import { Duration, Effect } from "effect";

const payoutPolicy = StepUp.session({
  require: StepUp.every(
    StepUp.aal("aal2", { maxAge: Duration.minutes(5) }),
    StepUp.oneOf(
      StepUp.amr("totp", { maxAge: Duration.minutes(5) }),
      StepUp.amr("passkey", { maxAge: Duration.minutes(5) })
    )
  ),
  noSessionRequirements: ["email_verification"],
});

export const confirmPayout = Effect.gen(function* () {
  yield* StepUp.requirePolicy(payoutPolicy);
  return yield* payouts.confirm(payoutId);
});

import * as StepUp from "@effect-auth/core/StepUp";
import { Effect } from "effect";

export const confirmPayoutHandler = confirmPayout.pipe(
  Effect.catchTag("StepUpRequired", (required) =>
    Effect.succeed({
      status: 403 as const,
      body: {
        code: "step_up_required" as const,
        // Prefer the options endpoint for factor discovery.
      },
    }).pipe(
      Effect.annotateLogs({
        stepUpFailures: required.failures.map((failure) => failure.reason),
      })
    )
  )
);

const policy = StepUp.adaptive([
  StepUp.available(
    "passkey",
    StepUp.session({ require: StepUp.amr("passkey") })
  ),
  StepUp.available(
    "aal2-capable",
    StepUp.session({ require: StepUp.aal("aal2") })
  ),
  StepUp.deny("no-acceptable-step-up-factor"),
]);

const guard = StepUp.requireAdaptivePolicy(policy);