Class: Supabase::Auth::MFAApi

Inherits:
Object
  • Object
show all
Defined in:
lib/supabase/auth/client.rb

Overview

MFA (Multi-Factor Authentication) API. Access via Client#mfa.

Instance Method Summary collapse

Constructor Details

#initialize(client) ⇒ MFAApi

Returns a new instance of MFAApi.

Parameters:

  • client (Client) —

    parent client instance



1057
1058
1059
 
# File 'lib/supabase/auth/client.rb', line 1057

def initialize(client)
  @client = client
end

Instance Method Details

#challenge(params) ⇒ Types::AuthMFAChallengeResponse

Create an MFA challenge for a factor.

Parameters:

  • params (Hash) —

    (:factor_id)

Returns:

Raises:



1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
 
# File 'lib/supabase/auth/client.rb', line 1092

def challenge(params)
  factor_id = params[:factor_id] || params["factor_id"]
  channel = params[:channel] || params["channel"]

  session = @client.get_session
  raise Errors::AuthSessionMissing unless session

  data = @client._request("POST", "factors/#{factor_id}/challenge",
                          jwt: session.access_token, body: { channel: channel })
  Types::AuthMFAChallengeResponse.from_hash(data)
end

#challenge_and_verify(params) ⇒ Types::AuthMFAVerifyResponse

Challenge and verify in one step.

Parameters:

  • params (Hash) —

    (:factor_id, :code, :channel)

Returns:



1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
 
# File 'lib/supabase/auth/client.rb', line 1133

def challenge_and_verify(params)
  challenge_response = challenge(
    factor_id: params[:factor_id] || params["factor_id"],
    channel: params[:channel] || params["channel"]
  )
  verify(
    factor_id: params[:factor_id] || params["factor_id"],
    challenge_id: challenge_response.id,
    code: params[:code] || params["code"]
  )
end

#enroll(params) ⇒ Types::AuthMFAEnrollResponse

Enroll a new MFA factor.

Parameters:

  • params (Hash) —

    (:factor_type, optional :friendly_name, :issuer)

Returns:

Raises:



1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
 
# File 'lib/supabase/auth/client.rb', line 1064

def enroll(params)
  factor_type = params[:factor_type] || params["factor_type"]
  friendly_name = params[:friendly_name] || params["friendly_name"]

  session = @client.get_session
  raise Errors::AuthSessionMissing unless session

  body = { factor_type: factor_type, friendly_name: friendly_name }

  if factor_type == "phone"
    body[:phone] = params[:phone] || params["phone"]
  else
    body[:issuer] = params[:issuer] || params["issuer"]
  end

  data = @client._request("POST", "factors", jwt: session.access_token, body: body)
  response = Types::AuthMFAEnrollResponse.from_hash(data)

  if factor_type == "totp" && response.totp&.qr_code
    response.totp.qr_code = "data:image/svg+xml;utf-8,#{response.totp.qr_code}"
  end

  response
end

#get_authenticator_assurance_level ⇒ Types::AuthMFAGetAuthenticatorAssuranceLevelResponse

Get the authenticator assurance level from the current session JWT.

Returns:



1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
 
# File 'lib/supabase/auth/client.rb', line 1177

def get_authenticator_assurance_level
  session = @client.get_session

  unless session
    return Types::AuthMFAGetAuthenticatorAssuranceLevelResponse.new(
      current_level: nil,
      next_level: nil,
      current_authentication_methods: []
    )
  end

  decoded = Helpers.decode_jwt(session.access_token)
  payload = decoded[:payload]

  aal = payload["aal"]
  amr_entries = (payload["amr"] || []).map { |entry| Types::AMREntry.from_hash(entry) }.compact

  verified_factors = (session.user&.factors || []).select { |f| f.status == "verified" }
  next_level = verified_factors.any? ? "aal2" : aal

  Types::AuthMFAGetAuthenticatorAssuranceLevelResponse.new(
    current_level: aal,
    next_level: next_level,
    current_authentication_methods: amr_entries
  )
end

#list_factors ⇒ Types::AuthMFAListFactorsResponse

List all MFA factors for the current user.

Returns:



1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
 
# File 'lib/supabase/auth/client.rb', line 1161

def list_factors
  user_response = @client.get_user
  factors = user_response&.user&.factors || []

  totp = factors.select { |f| f.factor_type == "totp" && f.status == "verified" }
  phone = factors.select { |f| f.factor_type == "phone" && f.status == "verified" }

  Types::AuthMFAListFactorsResponse.new(
    all: factors,
    totp: totp,
    phone: phone
  )
end

#unenroll(params) ⇒ Types::AuthMFAUnenrollResponse

Unenroll an MFA factor.

Parameters:

  • params (Hash) —

    (:factor_id)

Returns:

Raises:



1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
 
# File 'lib/supabase/auth/client.rb', line 1148

def unenroll(params)
  factor_id = params[:factor_id] || params["factor_id"]

  session = @client.get_session
  raise Errors::AuthSessionMissing unless session

  data = @client._request("DELETE", "factors/#{factor_id}",
                          jwt: session.access_token)
  Types::AuthMFAUnenrollResponse.from_hash(data)
end

#verify(params) ⇒ Types::AuthMFAVerifyResponse

Verify an MFA challenge.

Parameters:

  • params (Hash) —

    (:factor_id, :challenge_id, :code)

Returns:

Raises:



1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
 
# File 'lib/supabase/auth/client.rb', line 1107

def verify(params)
  factor_id = params[:factor_id] || params["factor_id"]
  challenge_id = params[:challenge_id] || params["challenge_id"]
  code = params[:code] || params["code"]

  session = @client.get_session
  raise Errors::AuthSessionMissing unless session

  body = { factor_id: factor_id, challenge_id: challenge_id, code: code }
  data = @client._request("POST", "factors/#{factor_id}/verify",
                          jwt: session.access_token, body: body)
  response = Types::AuthMFAVerifyResponse.from_hash(data)

  # Save the new session from the verify response
  new_session = Types::Session.from_hash(data)
  if new_session&.access_token
    @client.send(:_save_session, new_session)
    @client.send(:_notify_all_subscribers, "MFA_CHALLENGE_VERIFIED", new_session)
  end

  response
end