- added backup codes for 2 factor authentication

- npm updates
- coverage validation: elevation ust be positive, depth must be negative
- vinejs-provider.js: get enabled extensions from database, not via validOptions.extnames
- vue components for backup codes: e.g.: PersonalSettings.vue
- validate spaital coverage in leaflet map: draw.component.vue, map.component.vue
- add backup code authentication into Login.vue
- preset to use no preferred reviewer: Release.vue
- 2 new vinejs validation rules: file_scan.ts and file-length.ts

app/Controllers/Http/Api/UserController.ts

@@ -1,11 +1,11 @@
 import type { HttpContext } from '@adonisjs/core/http';
-// import TotpSecret from 'App/Models/TotpSecret';
 import User from '#models/user';
 import TwoFactorAuthProvider from '#app/services/TwoFactorAuthProvider';
 import { StatusCodes } from 'http-status-codes';
 import { InvalidArgumentException } from 'node-exceptions';
 import { TotpState } from '#contracts/enums';
-
+import BackupCodeStorage, { SecureRandom } from '#services/backup_code_storage';
+import BackupCode from '#models/backup_code';
 
 // Here we are generating secret and recovery codes for the user that’s enabling 2FA and storing them to our database.
 export default class UserController {
@@ -28,15 +28,20 @@ export default class UserController {
                 case TotpState.STATE_DISABLED:
                     // user.twoFactorSecret = null;
                     // user.twoFactorRecoveryCodes = null;
-                    user.twoFactorSecret = "";
-                    user.twoFactorRecoveryCodes = [""];
+                    await BackupCode.deleteCodes(user);
+                    user.twoFactorSecret = '';
+                    // user.twoFactorRecoveryCodes = [''];
                     await user.save();
-            
+
                     user.state = TotpState.STATE_DISABLED;
                     await user.save();
 
+                    let storage = new BackupCodeStorage(new SecureRandom());
+                    let backupState = await storage.getBackupCodesState(user);
+
                     return response.status(StatusCodes.OK).json({
                         state: TotpState.STATE_DISABLED,
+                        backupState: backupState,
                     });
                 case TotpState.STATE_CREATED:
                     user.twoFactorSecret = TwoFactorAuthProvider.generateSecret(user);
@@ -56,8 +61,8 @@ export default class UserController {
                     if (!code) {
                         throw new InvalidArgumentException('code is missing');
                     }
-                    const success = await TwoFactorAuthProvider.enable(user, code)
-                   
+                    const success = await TwoFactorAuthProvider.enable(user, code);
+
                     return response.status(StatusCodes.OK).json({
                         state: success ? TotpState.STATE_ENABLED : TotpState.STATE_CREATED,
                     });
@@ -79,4 +84,31 @@ export default class UserController {
     //         recoveryCodes: user.twoFactorRecoveryCodes,
     //     });
     // }
+
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @return JSONResponse
+     */
+    public async createCodes({ auth, response }: HttpContext) {
+        // $user = $this->userSession->getUser();
+        const user = (await User.find(auth.user?.id)) as User;
+
+        // let codes = TwoFactorAuthProvider.generateRecoveryCodes();
+        let storage = new BackupCodeStorage(new SecureRandom());
+        // $codes = $this->storage->createCodes($user);
+        const codes = await storage.createCodes(user);
+
+        let backupState = await storage.getBackupCodesState(user);
+        // return new JSONResponse([
+        // 	'codes' => $codes,
+        // 	'state' => $this->storage->getBackupCodesState($user),
+        // ]);
+        return response.status(StatusCodes.OK).json({
+            codes: codes,
+            // state: success ? TotpState.STATE_ENABLED : TotpState.STATE_CREATED,
+            backupState: backupState, //storage.getBackupCodesState(user),
+        });
+    }
 }