{:nimble_totp, "~> 0.1.0"},

      {:eqrcode, "~> 0.1.10"},

# Configure TOTP issuer, this is the name that will show up in user

# authenticator apps.

config :my_app, :totp, issuer: "MyApp"

  ## TOTP authentication

  @doc """

  Returns a new TOTP secret.

  """

  def totp_secret(), do: NimbleTOTP.secret()

  @doc """

  Returns true if a user has TOTP authentication enabled.

  """

  def totp_enabled?(user), do: user.totp_secret != nil

  @doc """

  Returns true if the TOTP requirements for a user are met. Requires that the user

  was loaded via a session token query.

  """

  def totp_verified?(user, opts \\ []) do

    cond do

      not totp_enabled?(user) ->

        true

      user.totp_verified_at == nil ->

        false

      true ->

        since = Keyword.get(opts, :since, 24)

        now = DateTime.utc_now()

        DateTime.diff(now, user.totp_verified_at, :hour) < since

    end

  end

  @doc """

  Returns a data URI to render the QR code for a given TOTP secret.

  """

  def totp_data_uri(user, totp_secret) when is_binary(totp_secret) do

    config = Application.fetch_env!(:my_app, :totp)

    data =

      NimbleTOTP.otpauth_uri(user.email, totp_secret, issuer: Keyword.fetch!(config, :issuer))

    encoded =

      data

      |> EQRCode.encode()

      |> EQRCode.png()

      |> Base.encode64()

    "data:image/png;base64," <> encoded

  end

  @doc """

  Enables TOTP for a user given a session token, a new TOTP secret, and a valid verification code.

  """

  def enable_user_totp(user, token, totp_secret, verification_code) do

    Repo.transaction(fn ->

      case verify_session_totp(token, totp_secret, verification_code) do

        :ok ->

          user

          |> Ecto.Changeset.change(totp_secret: totp_secret)

          |> Repo.update!()

        {:error, reason} ->

          Repo.rollback(reason)

      end

    end)

  end

  @doc """

  Disables TOTP for a user. Assumes that TOTP has already been verified.

  """

  def disable_user_totp(user) do

    Repo.transaction(fn ->

      Repo.update_all(

        from(UserToken, where: [user_id: ^user.id, context: "session"]),

        set: [totp_verified_at: nil]

      )

      user

      |> Ecto.Changeset.change(totp_secret: nil)

      |> Repo.update!()

    end)

  end

  @doc """

  Verifies TOTP for a user session given a TOTP secret and a valid verification code.

  """

  def verify_session_totp(token, totp_secret, verification_code) when is_binary(token) do

    since = DateTime.add(DateTime.utc_now(), -30, :second)

    if NimbleTOTP.valid?(totp_secret, verification_code, since: since) do

      Repo.update_all(

        UserToken.by_token_and_context_query(token, "session"),

        set: [totp_verified_at: DateTime.truncate(DateTime.utc_now(), :second)]

      )

      :ok

    else

      {:error, :invalid_code}

    end

  end

    field :totp_secret, :binary, redact: true

    field :totp_verified_at, :utc_datetime, virtual: true

    field :totp_verified_at, :utc_datetime

        select:

          {%{

             user

             | authenticated_at: token.authenticated_at,

               totp_verified_at: token.totp_verified_at

           }, token.inserted_at}

  def by_token_and_context_query(token, context) do

      <div class="divider" />

      <.button :if={@totp_state == :disabled} phx-click="enable_totp">

        Enable Two-Factor Authentication

      </.button>

      <.button :if={@totp_state == :enabled} phx-click="disable_totp">

        Disable Two-Factor Authentication

      </.button>

      <.form

        :if={@totp_state == :verifying}

        for={@totp_form}

        id="totp_form"

        phx-submit="verify_totp"

      >

        <img

          src={Accounts.totp_data_uri(@current_scope.user, @totp_secret)}

          class="mb-4 h-64 inline-block border border-zinc-300 rounded-lg"

        />

        <.input field={@totp_form[:code]} label="Verification code" required />

        <.button phx-disable-with="Verifying...">Verify & Enable</.button>

      </.form>

  def mount(_params, %{"user_token" => user_token}, socket) do

      |> assign(:user_token, user_token)

      |> assign(:totp_form, to_form(%{}, as: :totp))

      |> assign(:totp_state, if(Accounts.totp_enabled?(user), do: :enabled, else: :disabled))

  ## TOTP settings

  def handle_event("enable_totp", _params, socket) do

    socket =

      socket

      |> assign(:totp_state, :verifying)

      |> assign(:totp_secret, Accounts.totp_secret())

    {:noreply, socket}

  end

  def handle_event("disable_totp", _params, socket) do

    {:ok, user} = Accounts.disable_user_totp(socket.assigns.current_scope.user)

    socket =

      socket

      |> assign(:current_scope, %{socket.assigns.current_scope | user: user})

      |> assign(:totp_state, :disabled)

      |> put_flash(:info, "Disabled two-factor authentication.")

    {:noreply, socket}

  end

  def handle_event("verify_totp", %{"totp" => %{"code" => code}}, socket) do

    user = socket.assigns.current_scope.user

    user_token = socket.assigns.user_token

    totp_secret = socket.assigns.totp_secret

    case Accounts.enable_user_totp(user, user_token, totp_secret, code) do

      {:ok, user} ->

        socket =

          socket

          |> assign(:current_scope, %{socket.assigns.current_scope | user: user})

          |> assign(:totp_state, :enabled)

          |> put_flash(:info, "Enabled two-factor authentication.")

        {:noreply, socket}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Invalid two-factor verification code.")}

    end

  end

defmodule MyAppWeb.UserLive.TotpVerify do

  use MyAppWeb, :live_view

  alias MyApp.Accounts

  def render(assigns) do

    ~H"""

    <Layouts.app flash={@flash} current_scope={@current_scope}>

      <div class="mx-auto max-w-sm">

        <div class="text-center">

          <.header>

            Two-factor auth required

            <:subtitle>

              Sign in to your verification app to find the code.

            </:subtitle>

          </.header>

        </div>

        <.form for={@form} id="verify_totp_form" phx-submit="save">

          <.input

            field={@form[:code]}

            label="Verification code"

            autocomplete="off"

            required

            phx-mounted={JS.focus()}

          />

          <.button phx-disable-with="Verifying..." class="btn btn-primary w-full">

            Verify

          </.button>

        </.form>

      </div>

    </Layouts.app>

    """

  end

  def mount(_params, %{"user_token" => user_token} = session, socket) do

    socket =

      socket

      |> assign(:user_token, user_token)

      |> assign(:return_to, session["user_return_to"] || ~p"/")

      |> assign(:form, to_form(%{}, as: "totp"))

    {:ok, socket}

  end

  def handle_event("save", %{"totp" => %{"code" => code}}, socket) do

    user = socket.assigns.current_scope.user

    user_token = socket.assigns.user_token

    case Accounts.verify_session_totp(user_token, user.totp_secret, code) do

      :ok ->

        {:noreply, push_navigate(socket, to: socket.assigns.return_to)}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Invalid two-factor verification code.")}

    end

  end

end

      live "/users/verify-totp", UserLive.TotpVerify, :verify

    end

  end

  scope "/", MyAppWeb do

    pipe_through [:browser, :require_authenticated_user, :require_verified_totp]

    live_session :require_verified_totp_user,

      on_mount: [

        {MyAppWeb.UserAuth, :require_authenticated},

        {MyAppWeb.UserAuth, :require_verified_totp}

      ] do

  @doc """

  Used for routes that require that TOTP has been verified.

  """

  def require_verified_totp(conn, _opts) do

    if Accounts.totp_verified?(conn.assigns.current_scope.user) do

      conn

    else

      conn

      |> maybe_store_return_to()

      |> redirect(to: ~p"/users/verify-totp")

      |> halt()

    end

  end

    * `:require_verified_totp` - Redirects to the verify TOTP page if the

      user assigned to the current session requires TOTP.

  def on_mount(:require_verified_totp, _params, _session, socket) do

    if Accounts.totp_verified?(socket.assigns.current_scope.user) do

      {:cont, socket}

    else

      {:halt, Phoenix.LiveView.redirect(socket, to: ~p"/users/verify-totp")}

    end

  end

defmodule MyApp.Repo.Migrations.AlterAuthTablesAddTotp do

  use Ecto.Migration

  def change do

    alter table(:users) do

      add :totp_secret, :binary, null: true

    end

    alter table(:users_tokens) do

      add :totp_verified_at, :utc_datetime, null: true

    end

  end

end