Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const { AuthyClient } = require('authy-client');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(express.json());

// Initialize Authy client with API key
const authyClient = new AuthyClient({ key: process.env.AUTHY_API_KEY });

// Rate limiting to prevent abuse
const verifyLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many verification attempts, please try again later'
});

// Register user with Authy for 2FA
app.post('/api/auth/register-2fa', async (req, res) => {
  try {
    const { email, phone, countryCode } = req.body;

    // Validate input
    if (!email || !phone || !countryCode) {
      return res.status(400).json({ error: 'Missing required fields' });
    }

    // Register user with Authy
    const user = await authyClient.registerUser({
      email: email,
      phone: phone,
      countryCode: countryCode
    });

    // Store authy_id in your database associated with the user
    // await db.users.update({ email }, { authy_id: user.id });

    res.status(201).json({
      success: true,
      message: '2FA registered successfully',
      authy_id: user.id
    });

  } catch (error) {
    console.error('Authy registration error:', error);
    res.status(500).json({ error: 'Failed to register 2FA' });
  }
});

// Request SMS token for verification
app.post('/api/auth/request-token', verifyLimiter, async (req, res) => {
  try {
    const { authy_id } = req.body;

    if (!authy_id) {
      return res.status(400).json({ error: 'Authy ID required' });
    }

    // Request SMS token
    await authyClient.requestSms({ authyId: authy_id });

    res.json({
      success: true,
      message: 'Verification code sent via SMS'
    });

  } catch (error) {
    console.error('Token request error:', error);
    res.status(500).json({ error: 'Failed to send verification code' });
  }
});

// Verify token for login or sensitive operations
app.post('/api/auth/verify-token', verifyLimiter, async (req, res) => {
  try {
    const { authy_id, token } = req.body;

    if (!authy_id || !token) {
      return res.status(400).json({ error: 'Authy ID and token required' });
    }

    // Verify the token
    const verification = await authyClient.verifyToken({
      authyId: authy_id,
      token: token
    });

    if (verification.success) {
      // Token is valid, proceed with authentication
      // Generate session token or JWT here
      res.json({
        success: true,
        message: 'Authentication successful',
        authenticated: true
      });
    } else {
      res.status(401).json({
        success: false,
        error: 'Invalid verification code'
      });
    }

  } catch (error) {
    console.error('Token verification error:', error);
    
    if (error.message.includes('invalid')) {
      return res.status(401).json({ error: 'Invalid verification code' });
    }
    
    res.status(500).json({ error: 'Verification failed' });
  }
});

// Delete Authy user (when user disables 2FA)
app.delete('/api/auth/disable-2fa', async (req, res) => {
  try {
    const { authy_id } = req.body;

    if (!authy_id) {
      return res.status(400).json({ error: 'Authy ID required' });
    }

    await authyClient.deleteUser({ authyId: authy_id });

    // Remove authy_id from your database
    // await db.users.update({ authy_id }, { authy_id: null });

    res.json({
      success: true,
      message: '2FA disabled successfully'
    });

  } catch (error) {
    console.error('Disable 2FA error:', error);
    res.status(500).json({ error: 'Failed to disable 2FA' });
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Authentication server running on port ${PORT}`);
});