feat: Phishing resistant MFA

.changeset/breezy-parts-kiss.md

@@ -0,0 +1,31 @@
+---
+'@rocket.chat/web-ui-registration': major
+'@rocket.chat/model-typings': major
+'@rocket.chat/core-typings': major
+'@rocket.chat/rest-typings': major
+'@rocket.chat/passport-x': major
+'@rocket.chat/models': major
+'@rocket.chat/i18n': major
+'@rocket.chat/meteor': major
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
+
+- **Improved OAuth login security**  
+  OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
+
+- **Built-in CSRF, state validation, and PKCE protection**  
+  OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
+
+- **Improved two-step verification with OAuth logins**  
+  Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
+
+- **Improved mobile & desktop app login**  
+  Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
+
+- **A new setting to enable/disable new OAuth Flow**
+  Enable this new setting `Accounts_OAuth_Use_Modern_Flow` to use all of the above mentioned features.

.changeset/flat-poets-cheat.md

@@ -0,0 +1,28 @@
+---
+'@rocket.chat/web-ui-registration': minor
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/desktop-api': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
+
+- **Improved OAuth login security**  
+  OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
+
+- **Built-in CSRF, state validation, and PKCE protection**  
+  OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
+
+- **Improved two-step verification with OAuth logins**  
+  Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
+
+- **Improved mobile & desktop app login**  
+  Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.

apps/meteor/app/2fa/server/code/EmailCheck.ts

@@ -10,7 +10,7 @@ import * as Mailer from '../../../mailer/server/api';
 import { settings } from '../../../settings/server';
 
 export class EmailCheck implements ICodeCheck {
-	public readonly name = 'email';
+	public readonly name: string = 'email';
 
 	private getUserVerifiedEmails(user: IUser): string[] {
 		if (!Array.isArray(user.emails)) {
@@ -145,6 +145,6 @@ ${t('If_you_didnt_try_to_login_in_your_account_please_ignore_this_email')}
 
 	public async maxFaildedAttemtpsReached(user: IUser) {
 		const maxAttempts = settings.get<number>('Accounts_TwoFactorAuthentication_Max_Invalid_Email_Code_Attempts');
-		return (await Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts)) as boolean;
+		return Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts);
 	}
 }

apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts

@@ -0,0 +1,38 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { EmailCheck } from './EmailCheck';
+
+export class EmailCheckForOAuth extends EmailCheck {
+	public override readonly name = 'email-oauth';
+
+	public readonly method = 'email';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		const challengeId = await TwoFactorChallenges.createTwoFactorChallenge(user._id, 'email');
+		await this.sendEmailCode(user);
+		return challengeId;
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}

apps/meteor/app/2fa/server/code/TOTPCheck.ts

@@ -5,7 +5,7 @@ import { settings } from '../../../settings/server';
 import { TOTP } from '../lib/totp';
 
 export class TOTPCheck implements ICodeCheck {
-	public readonly name = 'totp';
+	public readonly name: string = 'totp';
 
 	public isEnabled(user: IUser): boolean {
 		if (!settings.get('Accounts_TwoFactorAuthentication_By_TOTP_Enabled')) {

apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts

@@ -0,0 +1,36 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { TOTPCheck } from './TOTPCheck';
+
+export class TOTPCheckForOAuth extends TOTPCheck {
+	public override readonly name = 'totp-oauth';
+
+	public readonly method = 'totp';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		return TwoFactorChallenges.createTwoFactorChallenge(user._id, 'totp');
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}

apps/meteor/app/2fa/server/code/index.ts

@@ -63,8 +63,8 @@ export function getFingerprintFromConnection(connection: IMethodConnection): str
 	return crypto.createHash('md5').update(data).digest('hex');
 }
 
-function getRememberDate(from: Date = new Date()): Date | undefined {
-	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor') as string, 10);
+export function getRememberDate(from: Date = new Date()): Date | undefined {
+	const rememberFor = settings.get<number>('Accounts_TwoFactorAuthentication_RememberFor');
 
 	if (rememberFor <= 0) {
 		return;
@@ -126,6 +126,20 @@ function isAuthorizedForToken(connection: IMethodConnection, user: IUser, option
 	return true;
 }
 
+export async function rememberAuthorizationByToken(token: string, userId: IUser['_id'], connection: IMethodConnection): Promise<void> {
+	const user = await Users.findOneByIdAndLoginHashedToken(userId, token, { projection: { _id: 1, services: 1 } });
+	if (!user) {
+		throw new Meteor.Error('error-user-not-found', 'user not found');
+	}
+
+	const expires = getRememberDate();
+	if (!expires) {
+		return;
+	}
+
+	await Users.setTwoFactorAuthorizationHashAndUntilForUserIdAndToken(user._id, token, getFingerprintFromConnection(connection), expires);
+}
+
 async function rememberAuthorization(connection: IMethodConnection, user: IUser): Promise<void> {
 	// Same dual-transport resolution as `isAuthorizedForToken`: DDP reads from `Accounts._accountData`
 	// via `_getLoginToken`, REST falls back to the token carried on `connection.token`.
@@ -156,7 +170,7 @@ interface ICheckCodeForUser {
 	connection?: IMethodConnection;
 }
 
-const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
+export const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
 	// try first getting one of the available methods or the one that was already provided
 	const selectedMethod = getMethodByNameOrFirstActiveForUser(user, method);
 	if (selectedMethod) {
@@ -184,7 +198,6 @@ export async function checkCodeForUser({ user, code, method, options = {}, conne
 	}
 
 	let existingUser: IUser | null;
-
 	if (typeof user === 'string') {
 		existingUser = await getUserForCheck(user);
 	} else {

apps/meteor/app/apple/server/applePassportOAuth.ts

@@ -0,0 +1,176 @@
+import { MeteorError } from '@rocket.chat/core-services';
+import { Users } from '@rocket.chat/models';
+import express from 'express';
+import { Accounts } from 'meteor/accounts-base';
+import { ServiceConfiguration } from 'meteor/service-configuration';
+import passport from 'passport';
+import { Strategy as AppleStrategy } from 'passport-apple';
+import type { Profile } from 'passport-apple';
+
+import { AppleCustomOAuth } from './AppleCustomOAuth';
+import { oAuthRouter } from '../../../server/configuration/configurePassport';
+import { allowPassportOAuthMiddleware } from '../../../server/lib/oauth/allowPassportOAuthMiddleware';
+import { passportOAuthCallback } from '../../../server/lib/oauth/passportOAuthCallback';
+import { settings } from '../../settings/server';
+import { config } from '../lib/config';
+import { handleIdentityToken } from '../lib/handleIdentityToken';
+
+new AppleCustomOAuth('apple', config);
+
+type RequestWithAppleProfile = {
+	appleProfile?: {
+		name?: {
+			firstName?: string;
+			middleName?: string;
+			lastName?: string;
+		};
+	};
+};
+
+function isRequestWithAppleProfile(req: object): req is RequestWithAppleProfile {
+	if (
+		'appleProfile' in req &&
+		req.appleProfile &&
+		typeof req.appleProfile === 'object' &&
+		'name' in req.appleProfile &&
+		req.appleProfile.name &&
+		typeof req.appleProfile.name === 'object'
+	) {
+		return true;
+	}
+	return false;
+}
+
+settings.watchMultiple(
+	[
+		'Accounts_OAuth_Apple',
+		'Accounts_OAuth_Apple_id',
+		'Accounts_OAuth_Apple_secretKey',
+		'Accounts_OAuth_Apple_iss',
+		'Accounts_OAuth_Apple_kid',
+		'Accounts_OAuth_Use_Modern_Flow',
+	],
+	async ([enabled, clientId, serverSecret, iss, kid, useModernFlow]) => {
+		passport.unuse('apple');
+
+		if (!useModernFlow) {
+			return;
+		}
+
+		if (!enabled) {
+			return ServiceConfiguration.configurations.removeAsync({
+				service: 'apple',
+			});
+		}
+
+		// if everything is empty but Apple login is enabled, don't show the login button
+		if (!clientId && !serverSecret && !iss && !kid) {
+			await ServiceConfiguration.configurations.upsertAsync(
+				{
+					service: 'apple',
+				},
+				{
+					$set: {
+						showButton: false,
+						enabled: settings.get('Accounts_OAuth_Apple'),
+					},
+				},
+			);
+			return;
+		}
+
+		if (typeof clientId !== 'string' || !clientId) {
+			return ServiceConfiguration.configurations.removeAsync({
+				service: 'apple',
+			});
+		}
+
+		passport.use(
+			'apple',
+
+			new AppleStrategy(
+				{
+					clientID: clientId,
+					teamID: settings.get<string>('Accounts_OAuth_Apple_iss'),
+					keyID: settings.get<string>('Accounts_OAuth_Apple_kid'),
+					privateKeyString: settings.get<string>('Accounts_OAuth_Apple_secretKey').replace(/\\n/g, '\n'),
+					callbackURL: `${settings.get<string>('Site_Url').replace(/\/$/, '')}/_oauth/apple`,
+					scope: ['name', 'email'],
+					passReqToCallback: true,
+					state: false,
+				},
+				async (req, accessToken: string, refreshToken: string, idToken: string, _profile: Profile, done) => {
+					try {
+						const serviceData = await handleIdentityToken(idToken, clientId);
+
+						if (isRequestWithAppleProfile(req)) {
+							const appleName = req.appleProfile?.name;
+							serviceData.name = [appleName?.firstName, appleName?.middleName, appleName?.lastName].filter(Boolean).join(' ');
+						}
+
+						const user = await Accounts.updateOrCreateUserFromExternalService(
+							'apple',
+							{
+								accessToken,
+								refreshToken,
+								...serviceData,
+							},
+							{},
+						);
+
+						if (!user?.userId || typeof user?.userId !== 'string') {
+							return done(new Error('User not found'));
+						}
+
+						const userFromDB = await Users.findOneById(user.userId);
+
+						if (!userFromDB) {
+							return done(new Error('User not found'));
+						}
+
+						return done(null, userFromDB);
+					} catch (error: any) {
+						done(error);
+						return {
+							type: 'apple',
+							error: new MeteorError(Accounts.LoginCancelledError.numericError, error.message),
+						};
+					}
+				},
+			),
+		);
+
+		const callbackHandler = [
+			allowPassportOAuthMiddleware('apple'),
+			express.urlencoded({ extended: true }),
+			passport.authenticate('apple', { failWithError: true, session: true, keepSessionInfo: true }),
+			passportOAuthCallback(settings.get<string>('Site_Url').replace(/\/$/, '')),
+		];
+
+		oAuthRouter.get(
+			'/oauth/apple',
+			allowPassportOAuthMiddleware('apple'),
+			(req, _res, next) => {
+				const { loginClient } = req.query;
+				if (loginClient === 'mobile' || loginClient === 'desktop') {
+					req.session.loginClient = loginClient;
+					req.session.save(() => {
+						next();
+					});
+				} else {
+					//delete stale value from previous sessions if any
+					delete req.session.loginClient;
+					next();
+				}
+			},
+			passport.authenticate('apple', {
+				scope: ['name', 'email'],
+			}),
+		);
+
+		oAuthRouter
+			.route('/_oauth/apple')
+			.post(...callbackHandler)
+			.get(...callbackHandler);
+	},
+);

apps/meteor/app/apple/server/index.ts

@@ -1,2 +1,3 @@
 import './appleOauthRegisterService';
 import './loginHandler';
+import './applePassportOAuth';