{:nimble_totp, "~> 0.1.0"},

      {:eqrcode, "~> 0.1.10"},

# Configure TOTP issuer, this is the name that will show up in user

# authenticator apps.

config :my_app, :totp, issuer: "MyApp"

  ## TOTP authentication

  @doc """

  Returns a new TOTP secret.

  """

  def totp_secret(), do: NimbleTOTP.secret()

  @doc """

  Returns true if a user has TOTP authentication enabled.

  """

  def totp_enabled?(user), do: user.totp_secret != nil

  @doc """

  Returns true if the TOTP requirements for a user are met. Requires that the user

  was loaded via a session token query.

  """

  def totp_verified?(user, opts \\ []) do

    cond do

      not totp_enabled?(user) ->

        true

      user.totp_verified_at == nil ->

        false

      true ->

        since = Keyword.get(opts, :since, 24)

        now = DateTime.utc_now()

        DateTime.diff(now, user.totp_verified_at, :hour) < since

    end

  end

  @doc """

  Returns a data URI to render the QR code for a given TOTP secret.

  """

  def totp_data_uri(user, totp_secret) when is_binary(totp_secret) do

    config = Application.fetch_env!(:my_app, :totp)

    data =

      NimbleTOTP.otpauth_uri(user.email, totp_secret, issuer: Keyword.fetch!(config, :issuer))

    encoded =

      data

      |> EQRCode.encode()

      |> EQRCode.png()

      |> Base.encode64()

    "data:image/png;base64," <> encoded

  end

  @doc """

  Enables TOTP for a user given a session token, a new TOTP secret, and a valid verification code.

  """

  def enable_user_totp(user, token, totp_secret, verification_code) do

    Repo.transaction(fn ->

      case verify_session_totp(token, totp_secret, verification_code) do

        :ok ->

          user

          |> Ecto.Changeset.change(totp_secret: totp_secret)

          |> Repo.update!()

        {:error, reason} ->

          Repo.rollback(reason)

      end

    end)

  end

  @doc """

  Disables TOTP for a user. Assumes that TOTP has already been verified.

  """

  def disable_user_totp(user) do

    Repo.transaction(fn ->

      Repo.update_all(

        from(UserToken, where: [user_id: ^user.id, context: "session"]),

        set: [totp_verified_at: nil]

      )

      user

      |> Ecto.Changeset.change(totp_secret: nil)

      |> Repo.update!()

    end)

  end

  @doc """

  Verifies TOTP for a user session given a TOTP secret and a valid verification code.

  """

  def verify_session_totp(token, totp_secret, verification_code) when is_binary(token) do

    since = DateTime.add(DateTime.utc_now(), -30, :second)

    if NimbleTOTP.valid?(totp_secret, verification_code, since: since) do

      Repo.update_all(

        UserToken.by_token_and_context_query(token, "session"),

        set: [totp_verified_at: DateTime.truncate(DateTime.utc_now(), :second)]

      )

      :ok

    else

      {:error, :invalid_code}

    end

  end

    field :totp_secret, :binary, redact: true

    field :totp_verified_at, :utc_datetime, virtual: true

    field :totp_verified_at, :utc_datetime

        select: user,

        select_merge: %{totp_verified_at: token.totp_verified_at}

      <div>

        <div :if={@totp_state == :disabled} class="mt-11">

          <.button phx-click="enable_totp">Enable Two-Factor Authentication</.button>

        </div>

        <div :if={@totp_state == :enabled} class="mt-11">

          <.button phx-click="disable_totp">Disable Two-Factor Authentication</.button>

        </div>

        <.simple_form

          :if={@totp_state == :verifying}

          for={@totp_form}

          id="totp_form"

          phx-submit="verify_totp"

        >

          <img

            src={Accounts.totp_data_uri(@current_user, @totp_secret)}

            class="h-64 inline-block border border-zinc-300 rounded-lg"

          />

          <.input field={@totp_form[:code]} label="Verification code" required />

          <:actions>

            <.button phx-disable-with="Verifying...">Verify & Enable</.button>

          </:actions>

        </.simple_form>

      </div>

  def mount(_params, %{"user_token" => user_token}, socket) do

      |> assign(:user_token, user_token)

      |> assign(:totp_form, to_form(%{}, as: :totp))

      |> assign(:totp_state, if(Accounts.totp_enabled?(user), do: :enabled, else: :disabled))

  ## TOTP settings

  def handle_event("enable_totp", _params, socket) do

    socket =

      socket

      |> assign(:totp_state, :verifying)

      |> assign(:totp_secret, Accounts.totp_secret())

    {:noreply, socket}

  end

  def handle_event("disable_totp", _params, socket) do

    {:ok, user} = Accounts.disable_user_totp(socket.assigns.current_user)

    socket =

      socket

      |> assign(:current_user, user)

      |> assign(:totp_state, :disabled)

      |> put_flash(:info, "Disabled two-factor authentication.")

    {:noreply, socket}

  end

  def handle_event("verify_totp", %{"totp" => %{"code" => code}}, socket) do

    user = socket.assigns.current_user

    user_token = socket.assigns.user_token

    totp_secret = socket.assigns.totp_secret

    case Accounts.enable_user_totp(user, user_token, totp_secret, code) do

      {:ok, user} ->

        socket =

          socket

          |> assign(:current_user, user)

          |> assign(:totp_state, :enabled)

          |> put_flash(:info, "Enabled two-factor authentication.")

        {:noreply, socket}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Invalid two-factor verification code.")}

    end

  end

defmodule MyAppWeb.UserVerifyTotpLive do

  use MyAppWeb, :live_view

  alias MyApp.Accounts

  def render(assigns) do

    ~H"""

    <div class="mx-auto max-w-sm">

      <.header class="text-center">

        Two-factor auth required

        <:subtitle>

          Sign in to your verification app to find the code.

        </:subtitle>

      </.header>

      <.simple_form for={@totp_form} id="verify_totp" phx-submit="verify_totp">

        <.input field={@totp_form[:code]} label="Verification code" required />

        <:actions>

          <.button phx-disable-with="Verifying..." class="w-full">

            Verify

          </.button>

        </:actions>

      </.simple_form>

    </div>

    """

  end

  def mount(_params, %{"user_token" => user_token} = session, socket) do

    socket =

      socket

      |> assign(:user_token, user_token)

      |> assign(:return_to, session["user_return_to"] || ~p"/")

      |> assign(:totp_form, to_form(%{}, as: :totp))

    {:ok, socket}

  end

  def handle_event("verify_totp", %{"totp" => %{"code" => code}}, socket) do

    user = socket.assigns.current_user

    user_token = socket.assigns.user_token

    case Accounts.verify_session_totp(user_token, user.totp_secret, code) do

      :ok ->

        {:noreply, push_redirect(socket, to: socket.assigns.return_to)}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Invalid two-factor verification code.")}

    end

  end

end

      live "/users/verify-totp", UserVerifyTotpLive, :verify

    end

  end

  scope "/", MyAppWeb do

    pipe_through [:browser, :require_authenticated_user, :require_verified_totp]

    live_session :require_verified_totp_user,

      on_mount: [

        {MyAppWeb.UserAuth, :ensure_authenticated},

        {MyAppWeb.UserAuth, :ensure_verified_totp}

      ] do

    * `:ensure_verified_totp` - Redirects to the verify TOTP page if the

      user assigned to the current session requires TOTP.

  def on_mount(:ensure_verified_totp, _params, _session, socket) do

    if Accounts.totp_verified?(socket.assigns.current_user) do

      {:cont, socket}

    else

      {:halt, Phoenix.LiveView.redirect(socket, to: ~p"/users/verify-totp")}

    end

  end

  @doc """

  Used for routes that require that TOTP has been verified.

  """

  def require_verified_totp(conn, _opts) do

    if Accounts.totp_verified?(conn.assigns.current_user) do

      conn

    else

      conn

      |> maybe_store_return_to()

      |> redirect(to: ~p"/users/verify-totp")

      |> halt()

    end

  end

defmodule MyApp.Repo.Migrations.AlterAuthTablesAddTotp do

  use Ecto.Migration

  def change do

    alter table(:users) do

      add :totp_secret, :binary, null: true

    end

    alter table(:users_tokens) do

      add :totp_verified_at, :utc_datetime, null: true

    end

  end

end