Meteor Two Factor

Simple two factor authentication for accounts-password forked from (https://github.com/dburles/meteor-two-factor) and enhanced with possibility to test verification method

Installation

$ meteor add nodsec:two-factor

Prerequisites

Make sure your project is using Meteor's accounts-password package, if not add it: meteor add accounts-password

Example Application

Simple example application

Usage

Client and server usage examples.

Usage (Client)

Typically you would call this method via your application login form event handler:

1twoFactor.loginWithPassword(user, password, method, error => {
2    if (error) {
3        // Handle the error
4    }
5    // Success!
6});

1{
2  "TWOFACTOR": {
3    "public": {
4      "enabled": true,
5      "force": true
6    }
7  }
8}
9

Settings short explanation

settings.enabled if set to false, 2FA is disabled and method twoFactor.loginWithPassword will log in user without 2FA.
settings.force will always require 2FA verification also, if user have user.twoFactorEnabled set to false,

After calling loginWithPassword if you wish, you can request a new authentication code:

1twoFactor.getNewAuthCode(error => {
2    if (error) {
3        // Handle the error
4    }
5    // Success!
6});

The following method is reactive and represents the state of authentication. Use it to display the interface to enter the authentication code:

1Tracker.autorun(function () {
2    if (twoFactor.isVerifying()) {
3        console.log('Ready to enter authentication code!');
4    }
5});

Capture the authentication code and pass it to the following method to validate the code and log the user in:

1twoFactor.verifyAndLogin(code, error => {
2    if (error) {
3        // Handle the error
4    }
5    // Success!
6});

Usage (Server)

Assign a function to twoFactor.sendCode that sends out the code. The example below sends the user an email:

1twoFactor.loginWithPassword = (options) => {
2    const user = options.user;
3    const method = options.method;
4
5    // Don't hold up the client
6    Meteor.defer(() => {
7        if (options.method === 'email') {
8            // Send code via email
9            Email.send({
10                to: user.email(), // Method attached using dburles:collection-helpers
11                from: 'noreply@example.com',
12                subject: 'Your authentication code',
13                text: `${code} is your authentication code.`
14            });
15        } else if (options.method === 'sms') {
16            // Send code via SMS
17            // ...
18        }
19    });
20};

1twoFactor.sendCode = (user, code) => {
2    // Don't hold up the client
3    Meteor.defer(() => {
4        // Send code via email
5        Email.send({
6            to: user.email(), // Method attached using dburles:collection-helpers
7            from: 'noreply@example.com',
8            subject: 'Your authentication code',
9            text: `${code} is your authentication code.`
10        });
11    });
12};

Optional functions:

1// Optional
2// Conditionally allow regular or two-factor sign in
3twoFactor.validateLoginAttempt = options => {
4    return !!options.user.twoFactorEnabled;
5};

1// Optional
2twoFactor.generateCode = () => {
3    // return a random string
4};

API

The following functions are attached to the twoFactor namespace. This may change somewhat for Meteor 1.3.

API (Client)

loginWithPassword

loginWithPassword(user, password, method, [callback])

Generates an authentication code. Once generated, (by default) a twoFactorCode field is added to the current user document. This function mirrors Meteor.loginWithPassword.

user Either a string interpreted as a username or an email; or an object with a single key: email, username or id. Username or email match in a case insensitive manner.

password The user's password.

method Method (email/sms/...) of to send verification code.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.

getAuthCode

1getNewAuthCode(method, [callback])

Generates and send a new authentication code. Only functional while verifying.

method Method (email/sms/...) of to send verification code.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.

getNewAuthCode

1getNewAuthCode([callback])

Generates and send a new authentication code. Only functional while verifying.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.

verifyAndLogin

1verifyAndLogin(code, [callback])

Verifies authentication code and logs in the user.

code The authentication code.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.

isVerifying

1isVerifying()

Reactive function that indicates the current state between having generated an authentication code and awaiting verification.

API (Server)

sendCode

sendCode(user, code, method)

This function is called after getAuthCode is successful.

user The current user document.

code The generated authentication code.

method The method of the send verification code.

options

twoFactor.options.fieldName = 'customFieldName';

Specify the name of the field on the user document to write the authentication code. Defaults to twoFactorCode.

validateLoginAttempt (Optional)

validateLoginAttempt(options)

If defined, this function is called within an Accounts.validateLoginAttempt callback. Use this to allow regular login under certain conditions.

generateCode (Optional)

If defined, this function is called to generate the random code instead of the default.

License

MIT