fix: validate MFA claim before allowing TOTP device removal

supertokens · Nov 22, 2024 · 7797099 · 7797099
1 parent 6420511
commit 7797099
Show file tree

Hide file tree

Showing 11 changed files with 39 additions and 9 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,6 @@
 /node_modules
 /examples/**/node_modules
+/examples/**/dist
 .DS_Store
 /.history
 *.js.map
@@ -12,4 +13,5 @@ releasePassword
 /test_report
 /temp_test_exports
 /temp_*
-/.nyc_output
+/.nyc_output
+.circleci/.pat
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [unreleased]
 
+## [20.0.6] - 2024-11-22
+
+-   Fixes an issue where `removeDevice` API allowed removing TOTP devices without the user completing MFA.
+
 ## [20.0.5] - 2024-09-02
 
 -   Optional form fields are now truly optional, can be omitted from the payload.

diff --git a/examples/express/with-m2m/clients.json b/examples/express/with-m2m/clients.json
@@ -0,0 +1,6 @@
+{
+    "assistant": {
+        "clientId": "stcl_e06aa4a8-d070-430c-be94-2803ba35ef12",
+        "clientSecret": "JND.Z5162vBtyMCJ4UV6PZ.5Sq"
+    }
+}
diff --git a/lib/build/recipe/totp/api/removeDevice.js b/lib/build/recipe/totp/api/removeDevice.js
@@ -28,7 +28,11 @@ async function removeDeviceAPI(apiImplementation, options, userContext) {
     const session = await session_1.default.getSession(
         options.req,
         options.res,
-        { overrideGlobalClaimValidators: () => [], sessionRequired: true },
+        {
+            overrideGlobalClaimValidators: (globalClaimValidators) =>
+                globalClaimValidators.filter((v) => v.id === "st-mfa"),
+            sessionRequired: true,
+        },
         userContext
     );
     const bodyParams = await options.req.getJSONBody();

diff --git a/lib/build/version.d.ts b/lib/build/version.d.ts
diff --git a/lib/build/version.js b/lib/build/version.js
diff --git a/lib/ts/recipe/totp/api/removeDevice.ts b/lib/ts/recipe/totp/api/removeDevice.ts
@@ -30,7 +30,11 @@ export default async function removeDeviceAPI(
     const session = await Session.getSession(
         options.req,
         options.res,
-        { overrideGlobalClaimValidators: () => [], sessionRequired: true },
+        {
+            overrideGlobalClaimValidators: (globalClaimValidators) =>
+                globalClaimValidators.filter((v) => v.id === "st-mfa"),
+            sessionRequired: true,
+        },
         userContext
     );
 

diff --git a/lib/ts/version.ts b/lib/ts/version.ts
@@ -12,7 +12,7 @@
  * License for the specific language governing permissions and limitations
  * under the License.
  */
-export const version = "20.0.5";
+export const version = "20.0.6";
 
 export const cdiSupported = ["5.1"];
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "supertokens-node",
-    "version": "20.0.5",
+    "version": "20.0.6",
     "description": "NodeJS driver for SuperTokens core",
     "main": "index.js",
     "scripts": {

diff --git a/test/test-server/src/testFunctionMapper.ts b/test/test-server/src/testFunctionMapper.ts
@@ -347,6 +347,16 @@ export function getFunc(evalStr: string): (...args: any[]) => any {
     }
 
     if (evalStr.startsWith("multifactorauth.init.override.functions")) {
+        if (evalStr.includes(`getMFARequirementsForAuth:async()=>["totp"]`)) {
+            return (e) => {
+                return {
+                    ...e,
+                    getMFARequirementsForAuth: (e) => {
+                        return ["totp"];
+                    },
+                };
+            };
+        }
         return (e) => {
             return {
                 ...e,