revert: Phishing resistant multi factor authentication

apps/meteor/app/2fa/server/code/EmailCheck.ts

@@ -10,7 +10,7 @@ import * as Mailer from '../../../mailer/server/api';
 import { settings } from '../../../settings/server';
 
 export class EmailCheck implements ICodeCheck {
-	public readonly name: string = 'email';
+	public readonly name = 'email';
 
 	private getUserVerifiedEmails(user: IUser): string[] {
 		if (!Array.isArray(user.emails)) {
@@ -145,6 +145,6 @@ ${t('If_you_didnt_try_to_login_in_your_account_please_ignore_this_email')}
 
 	public async maxFaildedAttemtpsReached(user: IUser) {
 		const maxAttempts = settings.get<number>('Accounts_TwoFactorAuthentication_Max_Invalid_Email_Code_Attempts');
-		return Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts);
+		return (await Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts)) as boolean;
 	}
 }

apps/meteor/app/2fa/server/code/TOTPCheck.ts

@@ -5,7 +5,7 @@ import { settings } from '../../../settings/server';
 import { TOTP } from '../lib/totp';
 
 export class TOTPCheck implements ICodeCheck {
-	public readonly name: string = 'totp';
+	public readonly name = 'totp';
 
 	public isEnabled(user: IUser): boolean {
 		if (!settings.get('Accounts_TwoFactorAuthentication_By_TOTP_Enabled')) {

apps/meteor/app/2fa/server/code/index.ts

@@ -63,8 +63,8 @@ function getFingerprintFromConnection(connection: IMethodConnection): string {
 	return crypto.createHash('md5').update(data).digest('hex');
 }
 
-export function getRememberDate(from: Date = new Date()): Date | undefined {
-	const rememberFor = settings.get<number>('Accounts_TwoFactorAuthentication_RememberFor');
+function getRememberDate(from: Date = new Date()): Date | undefined {
+	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor') as string, 10);
 
 	if (rememberFor <= 0) {
 		return;
@@ -118,20 +118,6 @@ function isAuthorizedForToken(connection: IMethodConnection, user: IUser, option
 	return true;
 }
 
-export async function rememberAuthorizationByToken(token: string, userId: IUser['_id'], connection: IMethodConnection): Promise<void> {
-	const user = await Users.findOneByIdAndLoginHashedToken(userId, token, { projection: { _id: 1, services: 1 } });
-	if (!user) {
-		throw new Meteor.Error('error-user-not-found', 'user not found');
-	}
-
-	const expires = getRememberDate();
-	if (!expires) {
-		return;
-	}
-
-	await Users.setTwoFactorAuthorizationHashAndUntilForUserIdAndToken(user._id, token, getFingerprintFromConnection(connection), expires);
-}
-
 async function rememberAuthorization(connection: IMethodConnection, user: IUser): Promise<void> {
 	const currentToken = Accounts._getLoginToken(connection.id);
 
@@ -160,7 +146,7 @@ interface ICheckCodeForUser {
 	connection?: IMethodConnection;
 }
 
-export const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
+const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
 	// try first getting one of the available methods or the one that was already provided
 	const selectedMethod = getMethodByNameOrFirstActiveForUser(user, method);
 	if (selectedMethod) {
@@ -188,6 +174,7 @@ export async function checkCodeForUser({ user, code, method, options = {}, conne
 	}
 
 	let existingUser: IUser | null;
+
 	if (typeof user === 'string') {
 		existingUser = await getUserForCheck(user);
 	} else {

apps/meteor/app/api/server/ApiClass.ts

@@ -144,7 +144,7 @@ const rateLimiterDictionary: Record<
 	}
 > = {};
 
-export const generateConnection = (
+const generateConnection = (
 	ipAddress: string,
 	httpHeaders: Record<string, any>,
 ): {

apps/meteor/app/api/server/index.ts

@@ -45,7 +45,7 @@ import './v1/mailer';
 import './v1/teams';
 import './v1/moderation';
 import './v1/uploads';
-import './v1/twoFactorChallenges';
+
 // This has to come last so all endpoints are registered before generating the OpenAPI documentation
 import './default/openApi';
 

apps/meteor/app/apple/lib/handleIdentityToken.ts

@@ -27,7 +27,7 @@ async function isValidAppleJWT(identityToken: string, header: any): Promise<bool
 	}
 }
 
-export async function handleIdentityToken(identityToken: string): Promise<Record<string, any>> {
+export async function handleIdentityToken(identityToken: string): Promise<{ id: string; email: string; name: string }> {
 	const decodedToken = KJUR.jws.JWS.parse(identityToken);
 
 	if (!(await isValidAppleJWT(identityToken, decodedToken.headerObj))) {
@@ -38,14 +38,15 @@ export async function handleIdentityToken(identityToken: string): Promise<Record
 		throw new Error('identityToken does not have a payload');
 	}
 
-	const { iss, sub } = decodedToken.payloadObj as any;
+	const { iss, sub, email } = decodedToken.payloadObj as any;
 	if (!iss) {
 		throw new Error('Insufficient data in auth response token');
 	}
 
 	const serviceData = {
 		id: sub,
-		...decodedToken.payloadObj,
+		email,
+		name: '',
 	};
 
 	return serviceData;