Add MFA support

app/routing/middleware/auth/DMZOnly.middleware.js

@@ -0,0 +1,17 @@
+const Middleware = require('libflitter/middleware/Middleware')
+class DMZOnly extends Middleware {
+
+    async test(req, res, next, args = {}){
+
+        if ( req.is_auth ) return next()
+        else {
+            // If not signed in, save the target url so we can redirect back here after auth
+            req.session.auth.flow = req.originalUrl
+            return res.redirect('/auth/login')
+        }
+
+    }
+
+}
+
+module.exports = DMZOnly

app/routing/middleware/auth/UserOnly.middleware.js

@@ -7,8 +7,25 @@
  */
 const Middleware = require('flitter-auth/middleware/UserOnly')
 class UserOnly extends Middleware {
+    static get services() {
+        return [...super.services, 'output']
+    }
 
-    
+    async test(req, res, next, args = {}){
+
+        if ( req.is_auth && !req.session.auth.in_dmz ) return next()
+        else if ( req.is_auth ) { // Need an MFA challenge
+            if ( !req.session.auth.flow ) req.session.auth.flow = req.originalUrl
+            return res.redirect('/auth/mfa/challenge')
+        }
+        else {
+            // If not signed in, save the target url so we can redirect back here after auth
+            req.session.auth.flow = req.originalUrl
+            this.output.debug('Set auth flow: '+req.originalUrl)
+            return res.redirect('/auth/login')
+        }
+
+    }
     
 }
 

app/routing/routers/api/v1/auth.routes.js

@@ -12,6 +12,9 @@ const auth_routes = {
     post: {
         '/validate/username': ['controller::api:v1:Auth.validate_username'],
         '/attempt': [ 'controller::api:v1:Auth.attempt' ],
+        '/mfa/generate': ['middleware::auth:UserOnly', 'controller::api:v1:Auth.generate_mfa_key'],
+        '/mfa/attempt': ['middleware::auth:DMZOnly', 'controller::api:v1:Auth.attempt_mfa'],
+        '/mfa/enable': ['middleware::auth:UserOnly', 'controller::api:v1:Auth.enable_mfa'],
     },
 }
 

app/routing/routers/auth/forms.routes.js

@@ -5,7 +5,7 @@
  * The general structure is as follows:
  *
  *      /auth/{provider name}/{action}
-
+ *
  * Individual providers may be interacted with individually, therefore:
  *
  *      /auth/flitter/register
@@ -49,7 +49,7 @@ const index = {
         
         '/:provider/logout': [
             'middleware::auth:ProviderRoute',
-            'middleware::auth:UserOnly',
+            'middleware::auth:DMZOnly',
             'controller::auth:Forms.logout_provider_clean_session',
 
             // Note, this separation is between when the auth action has happened properly
@@ -60,7 +60,7 @@ const index = {
         ],
         '/logout': [
             'middleware::auth:ProviderRoute',
-            'middleware::auth:UserOnly',
+            'middleware::auth:DMZOnly',
             'controller::auth:Forms.logout_provider_clean_session',
             'controller::auth:Forms.logout_provider_present_success',
         ],
@@ -94,16 +94,15 @@ const index = {
             'controller::auth:Forms.login_provider_authenticate_user',
             'controller::auth:Forms.login_provider_present_success',
         ],
-
         '/:provider/logout': [
             'middleware::auth:ProviderRoute',
-            'middleware::auth:UserOnly',
+            'middleware::auth:DMZOnly',
             'controller::auth:Forms.logout_provider_clean_session',
             'controller::auth:Forms.logout_provider_present_success',
         ],
         '/logout': [
             'middleware::auth:ProviderRoute',
-            'middleware::auth:UserOnly',
+            'middleware::auth:DMZOnly',
             'controller::auth:Forms.logout_provider_clean_session',
             'controller::auth:Forms.logout_provider_present_success',
         ],

app/routing/routers/auth/mfa.routes.js

@@ -0,0 +1,24 @@
+const mfa_routes = {
+    prefix: '/auth/mfa',
+
+    middleware: [
+
+    ],
+
+    get: {
+        '/setup': [
+            'middleware::auth:UserOnly',
+            'controller::auth:MFA.setup',
+        ],
+        '/challenge': [
+            'middleware::auth:DMZOnly',
+            'controller::auth:MFA.challenge',
+        ],
+    },
+
+    post: {
+
+    },
+}
+
+module.exports = exports = mfa_routes