SAML; Dashboard

app/controllers/api/v1/Auth.controller.js

@@ -54,12 +54,34 @@ class AuthController extends Controller {
             destination = req.session.auth.flow
         }
 
-        // TODO remember-device feature
         if ( user.mfa_enabled && !req.session.mfa_remember ) {
             req.session.auth.in_dmz = true
             destination = '/auth/mfa/challenge'
         }
 
+        if ( req.session?.auth?.message )
+            delete req.session.auth.message
+
+        // If we're doing a trust flow, check the grant
+        if ( req.body.grant_code && req.trust.has_flow() ) {
+            if ( req.trust.check_grant(req.body.grant_code) ) {
+                req.trust.grant(req.trust.flow_scope())
+
+                // Trust re-verification is granted,
+                // but the user might still need to verify MFA
+                const next = req.trust.end()
+                if ( req.session.auth.in_dmz ) {
+                    req.session.auth.flow = next
+                } else {
+                    destination = next
+                }
+            } else {
+                return res.status(401)
+                    .message(`Unable to grant trust. Grant token is invalid.`)
+                    .api()
+            }
+        }
+
         return res.api({
             success: true,
             session_created: !!req.body.create_session,
@@ -124,15 +146,43 @@ class AuthController extends Controller {
                 .api()
 
         req.user.mfa_enabled = true
+        req.user.mfa_enable_date = new Date
         req.user.save()
 
-        // TODO invalidate existing tokens and other logins
+        // invalidate existing tokens and other logins
         const flitter = await this.auth.get_provider('flitter')
         await flitter.logout(req)
+        await req.user.kickout()
 
         return res.api({success: true, mfa_enabled: req.user.mfa_enabled})
     }
 
+    async disable_mfa(req, res, next) {
+        if ( !req.user.mfa_enabled )
+            return res.status(400)
+                .message('The user does not have MFA enabled.')
+                .api()
+
+        req.user.mfa_enabled = false
+        delete req.user.mfa_enable_date
+        delete req.user.mfa_token
+        req.user.app_passwords = []
+        await req.user.save()
+
+        // invalidate existing login tokens and logins
+        const flitter = await this.auth.get_provider('flitter')
+        await flitter.logout(req)
+        await req.user.kickout()
+
+        return res.api({success: true, mfa_enabled: req.user.mfa_enabled})
+    }
+
+    async get_mfa_enable_date(req, res, next) {
+        if ( !req.user.mfa_enabled )
+            return res.api({ mfa_enabled: false })
+
+        return res.api({ mfa_enabled: true, mfa_enable_date: req.user.mfa_enable_date })
+    }
 }
 
 module.exports = exports = AuthController