newznab-tmux/app/Support/Google2FAAuthenticator.php

<?php

declare(strict_types=1);

namespace App\Support;

use App\Models\TrustedDevice;
use PragmaRX\Google2FALaravel\Exceptions\InvalidSecretKey;
use PragmaRX\Google2FALaravel\Support\Authenticator;

class Google2FAAuthenticator extends Authenticator
{
    /**
     * Check if the user is authenticated for 2FA
     */
    public function isAuthenticated()
    {
        // First check - directly check for the cookie before any other logic
        $cookie = request()->cookie('2fa_trusted_device');

        if ($cookie && $this->checkCookieValidity($cookie)) {
            // Force the session to be marked as 2FA authenticated
            session([config('google2fa.session_var') => true]);
            session([config('google2fa.session_var').'.auth.passed_at' => time()]);

            // Successful authentication with cookie
            return true;
        }

        return parent::isAuthenticated();
    }

    /**
     * Directly validate the cookie without any output or logging
     */
    private function checkCookieValidity(mixed $cookie): bool
    {
        try {
            return $this->trustedDeviceCookieIsValid($cookie);
        } catch (\Exception $e) {
            return false;
        }
    }

    protected function canPassWithoutCheckingOTP(): bool
    {
        if (! $this->getUser()->passwordSecurity) {
            return true;
        }

        return
            ! $this->getUser()->passwordSecurity->google2fa_enable ||
            ! $this->isEnabled() ||
            $this->noUserIsAuthenticated() ||
            $this->twoFactorAuthStillValid() ||
            $this->isDeviceTrusted();
    }

    /**
     * Check if current device is trusted
     */
    protected function isDeviceTrusted(): bool
    {
        try {
            return $this->trustedDeviceCookieIsValid(request()->cookie('2fa_trusted_device'));
        } catch (\Exception $e) {
            // Silently handle any exceptions
            return false;
        }
    }

    /**
     * @return mixed
     *
     * @throws InvalidSecretKey
     */
    protected function getGoogle2FASecretKey()
    {
        $secret = $this->getUser()->passwordSecurity->{$this->config('otp_secret_column')};

        if (empty($secret)) {
            throw new InvalidSecretKey('Secret key cannot be empty.');
        }

        return $secret;
    }

    /**
     * Override the parent isEnabled method to force-disable 2FA when a trusted device is detected
     */
    public function isEnabled()
    {
        // Check for trusted device cookie
        $trustedCookie = request()->cookie('2fa_trusted_device');

        if ($trustedCookie && auth()->check()) {
            try {
                if ($this->trustedDeviceCookieIsValid($trustedCookie)) {
                    session([config('google2fa.session_var') => true]);
                    session([config('google2fa.session_var').'.auth.passed_at' => time()]);

                    return false;
                }
            } catch (\Exception $e) {
                // Silently handle any exceptions
            }
        }

        // Otherwise, use the parent implementation
        return parent::isEnabled();
    }

    private function trustedDeviceCookieIsValid(mixed $cookie): bool
    {
        if (! is_string($cookie) || $cookie === '') {
            return false;
        }

        $data = json_decode($cookie, true);

        if (json_last_error() !== JSON_ERROR_NONE || ! is_array($data)) {
            return false;
        }

        if (! isset($data['user_id'], $data['token'], $data['expires_at'])) {
            return false;
        }

        $user = $this->getUser();
        if ((int) $data['user_id'] !== (int) $user->id) {
            return false;
        }

        if (time() > (int) $data['expires_at']) {
            return false;
        }

        return TrustedDevice::findValidForUser((int) $user->id, (string) $data['token']) !== null;
    }
}