homeio

1import { NextResponse } from "next/server";
2import { z } from "zod";
3
4import {
5  createRequestId,
6  logServerAction,
7  withServerTiming,
8} from "@/lib/server/logging/logger";
9import { requireApiSession } from "@/lib/server/modules/auth/api";
10import {
11  getAuthCookieName,
12  getExpiredSessionCookieOptions,
13} from "@/lib/server/modules/auth/cookies";
14import {
15  TotpServiceError,
16  disableTotp,
17} from "@/lib/server/modules/auth/totp-service";
18
19export const runtime = "nodejs";
20
21// 6-digit TOTP and 10-char backup codes both fit; allow generous whitespace
22// and dashes so users can paste freely.
23const disableSchema = z.object({
24  code: z.string().trim().min(1).max(32),
25});
26
27export async function POST(request: Request) {
28  const requestId = createRequestId();
29  const apiSession = await requireApiSession(request);
30  if (apiSession.response) return apiSession.response;
31
32  let body: unknown;
33  try {
34    body = await request.json();
35  } catch {
36    return NextResponse.json(
37      { error: "Invalid request payload" },
38      { status: 400 },
39    );
40  }
41
42  const parsed = disableSchema.safeParse(body);
43  if (!parsed.success) {
44    return NextResponse.json(
45      { error: "Invalid request payload" },
46      { status: 400 },
47    );
48  }
49
50  try {
51    const data = await withServerTiming(
52      {
53        layer: "api",
54        action: "auth.2fa.disable",
55        requestId,
56      },
57      async () =>
58        disableTotp({
59          userId: apiSession.session.userId,
60          code: parsed.data.code,
61        }),
62    );
63
64    // Service revoked every session row for this user; clear the caller's
65    // cookie too so the browser doesn't keep presenting a token that's now
66    // unbacked. Client must re-authenticate from scratch.
67    const response = NextResponse.json({ data });
68    response.cookies.set(
69      getAuthCookieName(),
70      "",
71      getExpiredSessionCookieOptions(request),
72    );
73    return response;
74  } catch (error) {
75    if (error instanceof TotpServiceError) {
76      logServerAction({
77        level: "warn",
78        layer: "api",
79        action: "auth.2fa.disable",
80        status: "error",
81        requestId,
82        error,
83        meta: { code: error.code },
84      });
85      return NextResponse.json(
86        { error: error.publicMessage, code: error.code },
87        { status: error.statusCode },
88      );
89    }
90
91    logServerAction({
92      level: "error",
93      layer: "api",
94      action: "auth.2fa.disable",
95      status: "error",
96      requestId,
97      error,
98    });
99    return NextResponse.json(
100      { error: "Failed to disable two-factor authentication" },
101      { status: 500 },
102    );
103  }
104}
105