pixelfed/app/Http/Controllers/Settings/SecuritySettings.php

<?php

namespace App\Http\Controllers\Settings;

use App\Models\AccountLog;
use App\Models\UserDevice;
use BaconQrCode\Renderer\Image\SvgImageBackEnd;
use BaconQrCode\Renderer\ImageRenderer;
use BaconQrCode\Renderer\RendererStyle\RendererStyle;
use BaconQrCode\Writer;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use PragmaRX\Google2FA\Google2FA;

trait SecuritySettings
{
    public function security(Request $request)
    {
        $user = $request->user();

        $activity = AccountLog::whereUserId($user->id)
            ->orderBy('created_at', 'desc')
            ->limit(20)
            ->get();

        $devices = UserDevice::whereUserId($user->id)
            ->orderBy('created_at', 'desc')
            ->limit(5)
            ->get();

        return view('settings.security', ['activity' => $activity, 'user' => $user, 'devices' => $devices]);
    }

    public function securityTwoFactorSetup(Request $request)
    {
        $user = $request->user();
        if ($user->{'2fa_enabled'} && $user->{'2fa_secret'}) {
            return redirect(route('settings.security'));
        }
        $backups = $this->generateBackupCodes();
        // $google2fa = new Google2FA();
        $google2fa = app(Google2FA::class);
        $key = $google2fa->generateSecretKey(32);
        $qrcode = $google2fa->getQRCodeUrl(
            config('pixelfed.domain.app'),
            $user->email,
            $key
        );

        $writer = new Writer(
            new ImageRenderer(
                new RendererStyle(400),
                new SvgImageBackEnd
            )
        );
        $qrcode = $writer->writeString($qrcode);
        $user->{'2fa_secret'} = $key;
        $user->{'2fa_backup_codes'} = json_encode($backups);
        $user->save();

        return view('settings.security.2fa.setup', ['user' => $user, 'qrcode' => $qrcode, 'backups' => $backups]);
    }

    protected function generateBackupCodes()
    {
        $keys = [];
        for ($i = 0; $i < 11; $i++) {
            $key = Str::random(24);
            $keys[] = $key;
        }

        return $keys;
    }

    public function securityTwoFactorSetupStore(Request $request)
    {
        $user = $request->user();
        if ($user->{'2fa_enabled'} && $user->{'2fa_secret'}) {
            abort(403, 'Two factor auth is already setup.');
        }
        $this->validate($request, [
            'code' => 'required|digits:6',
        ]);
        $code = $request->input('code');
        $google2fa = new Google2FA;
        $verify = $google2fa->verifyKey($user->{'2fa_secret'}, $code);
        if ($verify) {
            $user->{'2fa_enabled'} = true;
            $user->{'2fa_setup_at'} = now();
            $user->save();

            return response()->json(['msg' => 'success']);
        }
        return response()->json(['msg' => 'fail'], 403);
    }

    public function securityTwoFactorEdit(Request $request)
    {
        $user = $request->user();

        if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'}) {
            abort(403);
        }

        return view('settings.security.2fa.edit', ['user' => $user]);
    }

    public function securityTwoFactorRecoveryCodes(Request $request)
    {
        $user = $request->user();

        if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'} || ! $user->{'2fa_backup_codes'}) {
            abort(403);
        }
        $codes = json_decode($user->{'2fa_backup_codes'}, true);

        return view('settings.security.2fa.recovery-codes', ['user' => $user, 'codes' => $codes]);
    }

    public function securityTwoFactorRecoveryCodesRegenerate(Request $request)
    {
        $user = $request->user();

        if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'}) {
            abort(403);
        }
        $backups = $this->generateBackupCodes();
        $user->{'2fa_backup_codes'} = json_encode($backups);
        $user->save();

        return redirect(route('settings.security.2fa.recovery'));
    }

    public function securityTwoFactorUpdate(Request $request)
    {
        $user = $request->user();

        if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'} || ! $user->{'2fa_backup_codes'}) {
            abort(403);
        }

        $this->validate($request, [
            'action' => 'required|string|max:12',
        ]);

        if ($request->action !== 'remove') {
            abort(403);
        }

        $user->{'2fa_enabled'} = false;
        $user->{'2fa_secret'} = null;
        $user->{'2fa_backup_codes'} = null;
        $user->{'2fa_setup_at'} = null;
        $user->save();

        return response()->json([
            'msg' => 'Successfully removed 2fa device',
        ], 200);
    }
}