Signed in as {session.admin.email}
-
- Password
-
- Forgot password?
-
-
+
-
- );
- }
-
- return (
- // The setup button is gone now, so focus moves to the steps that replaced it.
- - You need an authenticator app on your phone, such as Google Authenticator, 1Password or - Microsoft Authenticator. -
- - {hasPendingFactor ? ( - <> -
-
-
- ) : null}
- Already scanned the QR code?
-- Type the code from your app to finish. Setting up again shows a new QR code and - replaces the one you scanned. -
- node?.focus()} tabIndex={-1} className="flex flex-col gap-6">
-
- );
-}
diff --git a/src/features/admin-auth/factors.test.ts b/src/features/admin-auth/factors.test.ts
deleted file mode 100644
index 6185a96..0000000
--- a/src/features/admin-auth/factors.test.ts
+++ /dev/null
@@ -1,115 +0,0 @@
-import type { SupabaseClient } from "@supabase/supabase-js";
-import { describe, expect, it, vi } from "vitest";
-
-import { factorToVerify, loadTotpFactors, type TotpFactors } from "./factors";
-
-vi.mock("server-only", () => ({}));
-
-type Factor = {
- readonly id: string;
- readonly factor_type: string;
- readonly status: string;
- readonly created_at: string;
-};
-
-function clientListing(result: { data: { all: Factor[] } | null; error: unknown }) {
- return {
- auth: { mfa: { listFactors: vi.fn().mockResolvedValue(result) } },
- } as unknown as SupabaseClient;
-}
-
-const totp = (id: string, status: string, createdAt = "2026-09-25T10:00:00Z"): Factor => ({
- id,
- factor_type: "totp",
- status,
- created_at: createdAt,
-});
-
-describe("loadTotpFactors", () => {
- it("splits TOTP factors into the verified one and the unverified ones", async () => {
- const client = clientListing({
- data: { all: [totp("v1", "verified"), totp("u1", "unverified", "2026-09-25T11:00:00Z")] },
- error: null,
- });
-
- await expect(loadTotpFactors(client)).resolves.toEqual({
- ok: true,
- factors: {
- verified: { id: "v1" },
- unverified: [{ id: "u1", createdAt: "2026-09-25T11:00:00Z" }],
- },
- });
- });
-
- it("ignores factors that are not TOTP", async () => {
- const client = clientListing({
- data: {
- all: [
- {
- id: "p1",
- factor_type: "phone",
- status: "verified",
- created_at: "2026-09-25T10:00:00Z",
- },
- ],
- },
- error: null,
- });
-
- await expect(loadTotpFactors(client)).resolves.toEqual({
- ok: true,
- factors: { verified: null, unverified: [] },
- });
- });
-
- it("reports a rate limit from the Auth server as a failure value", async () => {
- const client = clientListing({ data: null, error: { status: 429 } });
-
- await expect(loadTotpFactors(client)).resolves.toEqual({ ok: false, failure: "rate_limited" });
- });
-
- it("reports an outage as unavailable", async () => {
- const client = clientListing({ data: null, error: { status: 503 } });
-
- await expect(loadTotpFactors(client)).resolves.toEqual({ ok: false, failure: "unavailable" });
- });
-});
-
-describe("factorToVerify", () => {
- it("prefers the verified factor over any being enrolled", () => {
- const factors: TotpFactors = {
- verified: { id: "v1" },
- unverified: [{ id: "u1", createdAt: "2026-09-25T11:00:00Z" }],
- };
-
- expect(factorToVerify(factors)).toBe("v1");
- });
-
- it("picks the newest unverified factor when none is verified", () => {
- const factors: TotpFactors = {
- verified: null,
- unverified: [
- { id: "old", createdAt: "2026-09-25T09:00:00Z" },
- { id: "new", createdAt: "2026-09-25T11:00:00Z" },
- { id: "mid", createdAt: "2026-09-25T10:00:00Z" },
- ],
- };
-
- expect(factorToVerify(factors)).toBe("new");
- });
-
- it("does not reorder the factors it was given", () => {
- const unverified = [
- { id: "old", createdAt: "2026-09-25T09:00:00Z" },
- { id: "new", createdAt: "2026-09-25T11:00:00Z" },
- ];
-
- factorToVerify({ verified: null, unverified });
-
- expect(unverified.map((factor) => factor.id)).toEqual(["old", "new"]);
- });
-
- it("returns null when there is no factor at all", () => {
- expect(factorToVerify({ verified: null, unverified: [] })).toBeNull();
- });
-});
diff --git a/src/features/admin-auth/factors.ts b/src/features/admin-auth/factors.ts
deleted file mode 100644
index 90b59ad..0000000
--- a/src/features/admin-auth/factors.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import "server-only";
-
-import type { SupabaseClient } from "@supabase/supabase-js";
-
-import { type AuthFailure, classifyAuthError } from "@/lib/auth/errors";
-
-export type TotpFactors = {
- readonly verified: { readonly id: string } | null;
- readonly unverified: readonly { readonly id: string; readonly createdAt: string }[];
-};
-
-// The factor is always looked up on the server; a factor id from the browser is never trusted.
-export async function loadTotpFactors(
- supabase: SupabaseClient,
-): Promise<{ ok: true; factors: TotpFactors } | { ok: false; failure: AuthFailure }> {
- const { data, error } = await supabase.auth.mfa.listFactors();
- if (error) return { ok: false, failure: classifyAuthError(error) };
-
- const totp = data.all.filter((factor) => factor.factor_type === "totp");
- const verified = totp.find((factor) => factor.status === "verified");
- return {
- ok: true,
- factors: {
- verified: verified ? { id: verified.id } : null,
- unverified: totp
- .filter((factor) => factor.status === "unverified")
- .map((factor) => ({ id: factor.id, createdAt: factor.created_at })),
- },
- };
-}
-
-// The factor a code is checked against: the verified one, else the one being enrolled.
-// enrollTotp leaves at most one unverified factor; the newest wins if that ever slips.
-export function factorToVerify(factors: TotpFactors): string | null {
- if (factors.verified) return factors.verified.id;
- const newest = [...factors.unverified].sort((a, b) => b.createdAt.localeCompare(a.createdAt))[0];
- return newest?.id ?? null;
-}
diff --git a/src/features/admin-auth/log.ts b/src/features/admin-auth/log.ts
index 5659552..18705c5 100644
--- a/src/features/admin-auth/log.ts
+++ b/src/features/admin-auth/log.ts
@@ -6,16 +6,10 @@ import { logger } from "@/lib/logger";
export type AuthEvent =
| "auth.sign_in.succeeded"
| "auth.sign_in.failed"
- | "auth.mfa.enrolled"
- | "auth.mfa.succeeded"
- | "auth.mfa.failed"
- | "auth.mfa.locked"
| "auth.sign_out"
| "auth.session.expired"
| "auth.access.denied"
- | "auth.proxy.lookup_failed"
- | "auth.reset.requested"
- | "auth.password.changed";
+ | "auth.proxy.lookup_failed";
export type AuthEventFields = {
// The admin or user id when known.
@@ -24,7 +18,6 @@ export type AuthEventFields = {
readonly email?: string | null;
readonly ip: string | null;
readonly reason?: string;
- readonly sent?: boolean;
};
// Unsalted on purpose: it only correlates repeated attempts, and emails are guessable anyway.
@@ -39,19 +32,18 @@ export function requestIp(headers: Pick-
-
-
-
Scan this QR code with your authenticator app.
-- {/* An SVG data URL from Supabase; next/image adds nothing for it. */} - {/* eslint-disable-next-line @next/next/no-img-element */} ---
- -
-
Or type this key into the app instead:
-- {groupSecret(enrollment.secret)} -
-
- -
-
Type the 6 digit code the app now shows.
-
-