alias MyApp.Accounts.UserBackupCode

  Returns `{:ok, {user, backup_codes}}` on success, where `backup_codes` is a list of

  plain-text codes to display to the user once.

          backup_codes = generate_backup_codes(user)

          user =

            user

            |> Ecto.Changeset.change(totp_secret: totp_secret)

            |> Repo.update!()

          {user, backup_codes}

      Repo.delete_all(from(UserBackupCode, where: [user_id: ^user.id]))

  defp verify_session_for_totp(token) do

    Repo.update_all(

      UserToken.by_token_and_context_query(token, "session"),

      set: [totp_verified_at: DateTime.truncate(DateTime.utc_now(), :second)]

    )

    :ok

  end

  ## TOTP backup codes

  @doc """

  Returns the count of remaining backup codes for a user.

  """

  def count_backup_codes(user) do

    user

    |> UserBackupCode.for_user_query()

    |> Repo.aggregate(:count)

  end

  @doc """

  Generate a set of backup codes for a user.

  Returns a list of plain-text codes that should be displayed to the user once.

  The codes are stored hashed in the database and cannot be retrieved later.

  """

  def generate_backup_codes(user, count \\ 8) do

    Enum.map(1..count, fn _ ->

      {plain_code, backup_code} = UserBackupCode.build_backup_code(user)

      Repo.insert!(backup_code)

      plain_code

    end)

  end

  @doc """

  Consume a backup code for a user, verifies their session if the code is valid.

  """

  def consume_backup_code(user, token, backup_code) do

    query = UserBackupCode.consume_backup_code_query(user, backup_code)

    case Repo.delete_all(query) do

      {1, _results} ->

        verify_session_for_totp(token)

      {0, _results} ->

        {:error, :invalid_code}

    end

  end

    has_many :backup_codes, MyApp.Accounts.UserBackupCode

defmodule MyApp.Accounts.UserBackupCode do

  use Ecto.Schema

  import Ecto.Query

  alias MyApp.Accounts.UserBackupCode

  # A rand_size of 6 will generate 12-character hex codes.

  # Codes are scoped to signed-in users, this means they safely can

  # be less random than a globally scoped secret.

  @rand_size 6

  @primary_key false

  @foreign_key_type :binary_id

  schema "user_backup_codes" do

    field :code, :string, primary_key: true

    belongs_to :user, MyApp.Accounts.User, primary_key: true

    timestamps(updated_at: false)

  end

  @doc """

  Generates a backup code to be stored for a user.

  Returns a tuple of `{plain_code, struct}` where:

  - `plain_code` is the code to display to the user (shown once)

  - `struct` contains the hashed code for database storage

  """

  def build_backup_code(user) do

    plain_code = Base.encode16(:rand.bytes(@rand_size), case: :lower)

    hashed_code = hash_code(plain_code)

    {plain_code, %UserBackupCode{code: hashed_code, user: user}}

  end

  @doc """

  Returns a query for codes scoped to a user.

  """

  def for_user_query(user) do

    from UserBackupCode, where: [user_id: ^user.id]

  end

  @doc """

  Returns a query for consuming a particular code for a user.

  """

  def consume_backup_code_query(user, backup_code) do

    hashed_code = hash_code(backup_code)

    from UserBackupCode, where: [user_id: ^user.id, code: ^hashed_code]

  end

  defp hash_code(code) do

    :crypto.hash(:sha256, code) |> Base.encode64()

  end

end

      <div :if={@totp_backup_codes}>

        <div class="alert alert-warning">

          <.icon name="hero-lock-closed" class="size-5 shrink-0" />

          <div>

            <p class="font-semibold">Copy your backup codes now!</p>

            <p class="text-xs">

              Sign in with a backup code if you lose access to your authenticator app. They cannot be shown again.

            </p>

          </div>

        </div>

        <div class="bg-base-200 mt-4 grid grid-cols-4 gap-y-4 py-4">

          <div :for={code <- @totp_backup_codes} class="text-center">

            <span class="text-sm font-mono">{code}</span>

          </div>

        </div>

      </div>

      |> assign(:totp_backup_codes, nil)

      {:ok, {user, backup_codes}} ->

          |> assign(:totp_backup_codes, backup_codes)

defmodule MyAppWeb.UserLive.TotpBackupCode do

  use MyAppWeb, :live_view

  alias MyApp.Accounts

  def render(assigns) do

    ~H"""

    <Layouts.app flash={@flash} current_scope={@current_scope}>

      <div class="mx-auto max-w-sm">

        <div class="text-center">

          <.header>

            Use backup code

            <:subtitle>

              Bypass two-factor verification this time.

            </:subtitle>

          </.header>

        </div>

        <.form for={@form} id="verify_backup_form" phx-submit="save">

          <.input

            field={@form[:code]}

            label="Backup code"

            autocomplete="off"

            required

            phx-mounted={JS.focus()}

          />

          <.button phx-disable-with="Verifying..." class="btn btn-primary w-full">

            Verify

          </.button>

        </.form>

      </div>

    </Layouts.app>

    """

  end

  def mount(_params, %{"user_token" => user_token} = session, socket) do

    socket =

      socket

      |> assign(:user_token, user_token)

      |> assign(:return_to, session["user_return_to"] || ~p"/")

      |> assign(:form, to_form(%{}, as: "backup"))

    {:ok, socket}

  end

  def handle_event("save", %{"backup" => %{"code" => code}}, socket) do

    user = socket.assigns.current_scope.user

    user_token = socket.assigns.user_token

    case Accounts.consume_backup_code(user, user_token, code) do

      :ok ->

        {:noreply, push_navigate(socket, to: socket.assigns.return_to)}

      {:error, :invalid_code} ->

        {:noreply, put_flash(socket, :error, "Code is invalid or has already been used.")}

    end

  end

end

          <.link

            navigate={~p"/users/verify-backup"}

            class="text-xs font-semibold leading-6 text-base-content/70 hover:text-base-content/30"

          >

            Use a backup code

          </.link>

      live "/users/verify-backup", UserLive.TotpBackupCode, :backup_code

defmodule MyApp.Repo.Migrations.AddUserBackupCodes do

  use Ecto.Migration

  def change do

    create table(:user_backup_codes, primary_key: false) do

      add :code, :string, primary_key: true

      add :user_id, references(:users, type: :binary_id, on_delete: :delete_all),

        primary_key: true

      timestamps(updated_at: false)

    end

    create index(:user_backup_codes, [:user_id])

  end

end