joshuaandClaude Opus 5.5
c3012cb3f6
Admins and supervisors without 2FA are sent a code at their next login, and verifying it turns 2FA on. They can change the channel but not turn it off. Older sessions without 2FA are rejected with TWO_FACTOR_REQUIRED, and promoting a user ends their sessions so they enrol at next login. The requirement is skipped when no email or WhatsApp channel can deliver a code, and TWO_FACTOR_REQUIRED_ROLES=false switches it off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
704 B
JavaScript
26 lines
704 B
JavaScript
const jwt = require('jsonwebtoken');
|
|
const bcrypt = require('bcryptjs');
|
|
|
|
// `extra` adds claims, e.g. { setup: true } for the first-run setup wizard's token.
|
|
const generateToken = (userId, role, tokenVersion = 0, extra = {}) => {
|
|
return jwt.sign(
|
|
{ ...extra, id: userId, role, tokenVersion },
|
|
process.env.JWT_SECRET,
|
|
{ expiresIn: '30d' }
|
|
);
|
|
};
|
|
|
|
const hashPassword = async (password) => {
|
|
const salt = await bcrypt.genSalt(10);
|
|
return await bcrypt.hash(password, salt);
|
|
};
|
|
|
|
const comparePassword = async (enteredPassword, storedPassword) => {
|
|
return await bcrypt.compare(enteredPassword, storedPassword);
|
|
};
|
|
|
|
module.exports = {
|
|
generateToken,
|
|
hashPassword,
|
|
comparePassword,
|
|
}; |