alias MyApp.Accounts.UserBackupCode

          generate_backup_codes(user)

      Repo.delete_all(from(UserBackupCode, where: [user_id: ^user.id]))

      verify_session_for_totp(token)

  defp verify_session_for_totp(token) do

    Repo.update_all(

      UserToken.by_token_and_context_query(token, "session"),

      set: [totp_verified_at: DateTime.truncate(DateTime.utc_now(), :second)]

    )

    :ok

  end

  ## TOTP backup codes

  @doc """

  Lists all backup codes for a user.

  """

  def list_backup_codes(user) do

    user

    |> UserBackupCode.backup_codes_query()

    |> Repo.all()

    |> Enum.map(& &1.code)

  end

  @doc """

  Generate a set of backup codes for a user.

  """

  def generate_backup_codes(user, count \\ 8) do

    Enum.each(1..count, fn _ ->

      user

      |> UserBackupCode.build_backup_code()

      |> Repo.insert!()

    end)

  end

  @doc """

  Consume a backup code for a user, verifies their session if the code is valid.

  """

  def consume_backup_code(user, token, backup_code) do

    query = UserBackupCode.consume_backup_code_query(user, backup_code)

    case Repo.delete_all(query) do

      {1, _results} ->

        verify_session_for_totp(token)

      {0, _results} ->

        {:error, :invalid_code}

    end

  end

    has_many :backup_codes, MyApp.Accounts.UserBackupCode

defmodule MyApp.Accounts.UserBackupCode do

  use Ecto.Schema

  import Ecto.Query

  alias MyApp.Accounts.UserBackupCode

  # A rand_size of 6 will generate 12-character hex codes.

  # Codes are scoped to signed-in users, this means they safely can

  # be less random than a globally scoped secret.

  @rand_size 6

  @primary_key false

  @foreign_key_type :binary_id

  schema "users_backup_codes" do

    field :code, :string, primary_key: true

    belongs_to :user, MyApp.Accounts.User, primary_key: true

    timestamps(updated_at: false)

  end

  @doc """

  Generates a backup code to be stored for a user.

  """

  def build_backup_code(user) do

    code_string = Base.encode16(:rand.bytes(@rand_size), case: :lower)

    %UserBackupCode{code: code_string, user: user}

  end

  @doc """

  Returns a query for consuming a particular code for a user.

  """

  def consume_backup_code_query(user, backup_code) do

    from UserBackupCode, where: [user_id: ^user.id, code: ^backup_code]

  end

end

        <.modal :if={@totp_backup_codes} id="backup_codes" show>

          <.header>

            Your backup codes

            <:subtitle>Save these codes in case you lose your authenticator device:</:subtitle>

          </.header>

          <div class="mt-4 border-t grid grid-cols-4 gap-y-4 py-4">

            <div :for={code <- @totp_backup_codes}>

              <span class="text-sm font-mono"><%= code %></span>

            </div>

          </div>

        </.modal>

      |> assign(:totp_backup_codes, nil)

          |> assign(:totp_backup_codes, Accounts.list_backup_codes(user))

defmodule MyAppWeb.UserTotpBackupLive do

  use MyAppWeb, :live_view

  alias MyApp.Accounts

  def render(assigns) do

    ~H"""

    <div class="mx-auto max-w-sm">

      <.header class="text-center">

        Use backup code

        <:subtitle>

          Bypass two-factor verification this time.

        </:subtitle>

      </.header>

      <.simple_form for={@backup_form} id="verify_backup" phx-submit="verify_backup">

        <.input field={@backup_form[:code]} label="Backup code" required />

        <:actions>

          <.button phx-disable-with="Verifying..." class="w-full">

            Verify

          </.button>

        </:actions>

      </.simple_form>

    </div>

    """

  end

  def mount(_params, %{"user_token" => user_token} = session, socket) do

    socket =

      socket

      |> assign(:user_token, user_token)

      |> assign(:return_to, session["user_return_to"] || ~p"/")

      |> assign(:backup_form, to_form(%{}, as: :backup))

    {:ok, socket}

  end

  def handle_event("verify_backup", %{"backup" => %{"code" => code}}, socket) do

    user = socket.assigns.current_user

    user_token = socket.assigns.user_token

    case Accounts.consume_backup_code(user, user_token, code) do

      :ok ->

        {:noreply, push_redirect(socket, to: socket.assigns.return_to)}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Code is invalid or has already been used.")}

    end

  end

end

        <.link

          navigate={~p"/users/verify-backup"}

          class="text-xs font-semibold leading-6 text-zinc-900 hover:text-zinc-700"

        >

          Use a backup code

        </.link>

      live "/users/verify-backup", UserTotpBackupLive, :verify

defmodule MyApp.Repo.Migrations.AddBackupCodes do

  use Ecto.Migration

  def change do

    create table(:users_backup_codes, primary_key: false) do

      add :code, :string, primary_key: true

      add :user_id, references(:users, type: :binary_id, on_delete: :delete_all),

        primary_key: true

      timestamps(updated_at: false)

    end

    create index(:users_backup_codes, [:user_id])

  end

end