MFA Client-Side API

async function getMFAMethods(accessToken) {
  const response = await fetch('https://api.rcoinx.com/api/auth/mfa/methods', {
    method: 'GET',
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json'
    }
  });
  
  const data = await response.json();
  return data.data; // Array of MFA methods
}

async function getUserMFAStatus(accessToken) {
  const response = await fetch('https://api.rcoinx.com/api/auth/mfa/user', {
    method: 'GET',
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json'
    }
  });
  
  const data = await response.json();
  return data.data;
}

async function verifyMFACode(accessToken, sessionToken, methodKey, code) {
  const response = await fetch('https://api.rcoinx.com/api/auth/mfa/sessions/verify', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      session_token: sessionToken,
      method_key: methodKey,
      code: code
    })
  });
  
  const data = await response.json();
  return data.data;
}

async function setupTOTP(accessToken) {
  const response = await fetch('https://api.rcoinx.com/api/auth/mfa/totp/setup', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json'
    }
  });
  
  const data = await response.json();
  return data.data;
}

// Display QR code using a QR code library
function displayQRCode(otpauthURL) {
  const canvas = document.getElementById('qr-code');
  QRCode.toCanvas(canvas, otpauthURL, function (error) {
    if (error) console.error(error);
  });
}

class MFAService {
  constructor(apiBaseUrl, accessToken) {
    this.apiBaseUrl = apiBaseUrl;
    this.accessToken = accessToken;
  }
  
  async request(endpoint, options = {}) {
    const url = `${this.apiBaseUrl}${endpoint}`;
    const headers = {
      'Authorization': `Bearer ${this.accessToken}`,
      'Content-Type': 'application/json',
      ...options.headers
    };
    
    const response = await fetch(url, {
      ...options,
      headers
    });
    
    if (!response.ok) {
      const error = await response.json();
      throw new Error(error.message || 'Request failed');
    }
    
    return response.json();
  }
  
  async setupTOTP() {
    try {
      // Step 1: Setup TOTP and get QR code
      const setupResponse = await this.request('/totp/setup', {
        method: 'POST'
      });
      
      const { otpauth_url } = setupResponse.data;
      
      // Step 2: Display QR code to user
      this.displayQRCode(otpauth_url);
      
      // Step 3: Wait for user to scan and enter code
      const code = await this.promptUserForCode();
      
      // Step 4: Verify and enable TOTP
      const verifyResponse = await this.request('/totp/verify', {
        method: 'POST',
        body: JSON.stringify({ code })
      });
      
      if (verifyResponse.data.enabled) {
        // Step 5: Enable MFA method
        await this.request('/enable', {
          method: 'POST',
          body: JSON.stringify({ method_key: 'totp' })
        });
        
        return { success: true, message: 'TOTP MFA enabled successfully' };
      }
      
      throw new Error('TOTP verification failed');
    } catch (error) {
      console.error('TOTP setup error:', error);
      throw error;
    }
  }
  
  displayQRCode(otpauthURL) {
    const canvas = document.getElementById('qr-code-canvas');
    QRCode.toCanvas(canvas, otpauthURL, (error) => {
      if (error) {
        console.error('QR code generation failed:', error);
      }
    });
  }
  
  async promptUserForCode() {
    return new Promise((resolve) => {
      const code = prompt('Enter the 6-digit code from your authenticator app:');
      resolve(code);
    });
  }
}

class ActionMFAService {
  constructor(apiBaseUrl, accessToken) {
    this.apiBaseUrl = apiBaseUrl;
    this.accessToken = accessToken;
  }
  
  async performActionWithMFA(actionKey, actionData) {
    try {
      // Step 1: Check if MFA is required
      const requirement = await this.checkMFARequirement(actionKey);
      
      if (!requirement.requires_mfa) {
        // No MFA required, proceed with action
        return await this.executeAction(actionKey, actionData);
      }
      
      // Step 2: Create MFA session
      const session = await this.createMFASession(actionKey);
      
      // Step 3: Verify MFA codes
      const verificationComplete = await this.verifyMFAForSession(
        session.session_token,
        requirement.allowed_methods
      );
      
      if (!verificationComplete) {
        throw new Error('MFA verification incomplete');
      }
      
      // Step 4: Execute action with session token
      return await this.executeAction(actionKey, actionData, session.session_token);
      
    } catch (error) {
      console.error('Action MFA error:', error);
      throw error;
    }
  }
  
  async checkMFARequirement(actionKey) {
    const response = await this.request('/check-requirement', {
      method: 'POST',
      body: JSON.stringify({ action_key: actionKey })
    });
    return response.data;
  }
  
  async createMFASession(actionKey) {
    const response = await this.request('/sessions', {
      method: 'POST',
      body: JSON.stringify({ action_key: actionKey })
    });
    return response.data;
  }
  
  async verifyMFAForSession(sessionToken, allowedMethods) {
    // For each required method, get code from user and verify
    for (const method of allowedMethods) {
      let code;
      
      if (method === 'sms' || method === 'email') {
        // Request code to be sent
        await this.request('/send-code', {
          method: 'POST',
          body: JSON.stringify({ method_key: method })
        });
        
        // Wait for user to receive and enter code
        code = await this.promptUserForCode(method);
      } else if (method === 'totp') {
        // User enters code from authenticator app
        code = await this.promptUserForCode(method);
      }
      
      // Verify code
      const verifyResponse = await this.request('/sessions/verify', {
        method: 'POST',
        body: JSON.stringify({
          session_token: sessionToken,
          method_key: method,
          code: code
        })
      });
      
      if (verifyResponse.data.session_is_completed) {
        return true;
      }
    }
    
    return false;
  }
  
  async promptUserForCode(method) {
    return new Promise((resolve) => {
      const methodName = {
        'totp': 'authenticator app',
        'sms': 'SMS',
        'email': 'email'
      }[method] || method;
      
      const code = prompt(`Enter the code from your ${methodName}:`);
      resolve(code);
    });
  }
  
  async executeAction(actionKey, actionData, sessionToken) {
    // Include session token in headers if provided
    const headers = {};
    if (sessionToken) {
      headers['X-MFA-Session-Token'] = sessionToken;
    }
    
    // Make the actual action request
    const response = await fetch(`${this.apiBaseUrl}/actions/${actionKey}`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${this.accessToken}`,
        'Content-Type': 'application/json',
        ...headers
      },
      body: JSON.stringify(actionData)
    });
    
    return response.json();
  }
  
  async request(endpoint, options = {}) {
    const url = `${this.apiBaseUrl}${endpoint}`;
    const headers = {
      'Authorization': `Bearer ${this.accessToken}`,
      'Content-Type': 'application/json',
      ...options.headers
    };
    
    const response = await fetch(url, {
      ...options,
      headers
    });
    
    if (!response.ok) {
      const error = await response.json();
      throw new Error(error.message || 'Request failed');
    }
    
    return response.json();
  }
}

import { useState, useCallback } from 'react';

function useMFA(apiBaseUrl, accessToken) {
  const [mfaStatus, setMFAStatus] = useState(null);
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState(null);
  
  const request = useCallback(async (endpoint, options = {}) => {
    const url = `${apiBaseUrl}${endpoint}`;
    const headers = {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json',
      ...options.headers
    };
    
    const response = await fetch(url, {
      ...options,
      headers
    });
    
    if (!response.ok) {
      const errorData = await response.json();
      throw new Error(errorData.message || 'Request failed');
    }
    
    return response.json();
  }, [apiBaseUrl, accessToken]);
  
  const getMFAStatus = useCallback(async () => {
    setLoading(true);
    setError(null);
    
    try {
      const response = await request('/user');
      setMFAStatus(response.data);
      return response.data;
    } catch (err) {
      setError(err.message);
      throw err;
    } finally {
      setLoading(false);
    }
  }, [request]);
  
  const setupTOTP = useCallback(async () => {
    setLoading(true);
    setError(null);
    
    try {
      const setupResponse = await request('/totp/setup', { method: 'POST' });
      return setupResponse.data;
    } catch (err) {
      setError(err.message);
      throw err;
    } finally {
      setLoading(false);
    }
  }, [request]);
  
  const verifyAndEnableTOTP = useCallback(async (code) => {
    setLoading(true);
    setError(null);
    
    try {
      const verifyResponse = await request('/totp/verify', {
        method: 'POST',
        body: JSON.stringify({ code })
      });
      
      if (verifyResponse.data.enabled) {
        await request('/enable', {
          method: 'POST',
          body: JSON.stringify({ method_key: 'totp' })
        });
        
        await getMFAStatus();
      }
      
      return verifyResponse.data;
    } catch (err) {
      setError(err.message);
      throw err;
    } finally {
      setLoading(false);
    }
  }, [request, getMFAStatus]);
  
  const disableMFA = useCallback(async (methodKey) => {
    setLoading(true);
    setError(null);
    
    try {
      await request('/disable', {
        method: 'POST',
        body: JSON.stringify({ method_key: methodKey })
      });
      
      await getMFAStatus();
    } catch (err) {
      setError(err.message);
      throw err;
    } finally {
      setLoading(false);
    }
  }, [request, getMFAStatus]);
  
  return {
    mfaStatus,
    loading,
    error,
    getMFAStatus,
    setupTOTP,
    verifyAndEnableTOTP,
    disableMFA
  };
}

async function handleMFARequest(endpoint, options) {
  try {
    const response = await fetch(endpoint, options);
    
    if (!response.ok) {
      const errorData = await response.json();
      
      // Handle specific error codes
      switch (response.status) {
        case 401:
          // Token expired, redirect to login
          window.location.href = '/login';
          break;
        case 429:
          // Rate limited, show retry message
          alert('Too many requests. Please try again later.');
          break;
        case 400:
          // Bad request, show validation errors
          alert(`Error: ${errorData.message}`);
          break;
        default:
          alert(`An error occurred: ${errorData.message}`);
      }
      
      throw new Error(errorData.message);
    }
    
    return await response.json();
  } catch (error) {
    console.error('MFA request error:', error);
    throw error;
  }
}