Laravel Auth Recovery-Codes

This package provides Laravel bindings and a Eloquent/Model trait for pragmarx/recovery package. It allows you to easily handle recovery codes, needed for 2FA setups and only care about the app logic.

Installation

You can install the package via composer:

composer require astrotomic/laravel-auth-recovery-codes

And publish the config via artisan:

php artisan vendor:publish --provider="Astrotomic\AuthRecoveryCodes\AuthRecoveryCodesServiceProvider" --tag=config

Usage

Model

You will have to add the Recoverable trait to your model you want to have recovery codes and should add a json or array cast to the attribute holding the recovery codes.

use Illuminate\Database\Eloquent\Model;
use Astrotomic\AuthRecoveryCodes\Recoverable;

class User extends Model
{
    use Recoverable;

    protected $casts = [
        'recovery_codes' => 'array',
    ];
}

By default the trait uses a recovery_codes attribute/column - you can change this by setting $recoveryCodesName property:

class User extends Model
{
    use Recoverable;

    protected string $recoveryCodesName = 'mfa_recovery_codes';

    protected $casts = [
        'mfa_recovery_codes' => 'array',
    ];
}

To set the new recovery codes to your model you should use the setRecoveryCodes() method because this method automatically hashes the recovery codes, if not already hashed. This step is important for security because with this step only the user has access to the recovery codes and no one else. The following snippet is an example of a possible controller action

• generating the codes
• setting and saving the codes on the user model
• responding with the codes to the user (the one and only time anyone can get/read the plaintext recovery codes)

$codes = User::generateRecoveryCodes();

$user->setRecoveryCodes($codes)->save();

return response()->json($codes);

If you want to use the default model attribute without the need to use setRecoveryCodes() method you should add your own accessor and mutator, keep in mind to call the Recoverable::hashRecoveryCodes() method on set and that you have to do the JSON casting by your own.

Migration

After setting up your model you will have to add the new column to your database table, there aren't much requirements - the json column type would only help to prevent invalid content, but the recovery codes JSON isn't really queryable (only an array of hashes), but the column should be nullable if you don't setup recovery codes on user create/register.

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class AddRecoveryCodesToUsersTable extends Migration
{
    public function up(): void
    {
        Schema::table('users', static function (Blueprint $table): void {
            $table->json('recovery_codes')->nullable();
        });
    }

    public function down(): void
    {
        Schema::table('users', static function (Blueprint $table): void {
            $table->dropColumn('recovery_codes');
        });
    }
}

Recovery

Now that you have setup your app to generate and store recovery codes you should add the logic to recover an account. The Recoverable trait comes with two methods to help you with this task.

• isValidRecoveryCode() return a bool and tells you if any of the saved recovery codes matches the input
• useRecoveryCode() removes the matching hash from the array and sets the array of remaining recovery codes

use Astrotomic\AuthRecoveryCodes\Recoverable;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Symfony\Component\HttpFoundation\Response;

class RecoverController
{
    public function __invoke(Request $request)
    {
        /** @var Model|Recoverable $user */
        $user = User::whereEmail($request->email)->firstOrFail();

        abort_unless(Hash::check($request->password, $user->password), Response::HTTP_NOT_FOUND);

        abort_unless($user->isValidRecoveryCode($request->recovery_code), Response::HTTP_NOT_FOUND);

        // do something to allow the user to recover the account
        // - log them in and redirect to account/security settings
        // - disable 2FA
        // - send an email with a signed link to do something

        $user->useRecoveryCode($request->recovery_code)->save();

        // you should check if user has remaining recovery codes
        // if not you should re-generate some and tell the user
        // for sure you can trigger this before all codes are used
        // or remind the user on regular login to generate new ones
        // if he's running out of remaining ones
        if(empty($user->getRecoveryCodes())) {
            $codes = User::generateRecoveryCodes();

            $user->setRecoveryCodes($codes)->save();

            return response()->json($codes);
        }
    }
}

Testing

composer test

Changelog

Please see CHANGELOG for more information what has changed recently.

Contributing

Please see CONTRIBUTING for details. You could also be interested in CODE OF CONDUCT.

Security

If you discover any security related issues, please check SECURITY for steps to report it.

Credits

• Tom Witkowski
• All Contributors

License

The MIT License (MIT). Please see License File for more information.

Treeware

You're free to use this package, but if it makes it to your production environment I would highly appreciate you buying the world a tree.

It’s now common knowledge that one of the best tools to tackle the climate crisis and keep our temperatures from rising above 1.5C is to plant trees. If you contribute to my forest you’ll be creating employment for local families and restoring wildlife habitats.

You can buy trees at offset.earth/treeware

Read more about Treeware at treeware.earth