Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const speakeasy = require('speakeasy');
const qrcode = require('qrcode');
const rateLimit = require('express-rate-limit');
const crypto = require('crypto');

const app = express();
app.use(express.json());

// Rate limiting to prevent brute force attacks
const totpLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many verification attempts, please try again later'
});

// Simulated user database
const users = new Map();

// Generate TOTP secret for user enrollment
app.post('/api/auth/totp/setup', async (req, res) => {
  try {
    const { userId, email } = req.body;

    if (!userId || !email) {
      return res.status(400).json({ error: 'userId and email are required' });
    }

    // Generate a secret key for the user
    const secret = speakeasy.generateSecret({
      name: `MyApp (${email})`,
      issuer: 'MyCompany',
      length: 32
    });

    // Store secret temporarily (in production, use encrypted database)
    users.set(userId, {
      tempSecret: secret.base32,
      email: email,
      totpEnabled: false,
      backupCodes: generateBackupCodes()
    });

    // Generate QR code for authenticator app
    const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);

    res.json({
      secret: secret.base32,
      qrCode: qrCodeUrl,
      backupCodes: users.get(userId).backupCodes,
      manualEntry: secret.base32
    });
  } catch (error) {
    console.error('TOTP setup error:', error);
    res.status(500).json({ error: 'Failed to setup authenticator' });
  }
});

// Verify TOTP token and complete enrollment
app.post('/api/auth/totp/verify-setup', totpLimiter, (req, res) => {
  try {
    const { userId, token } = req.body;

    if (!userId || !token) {
      return res.status(400).json({ error: 'userId and token are required' });
    }

    const user = users.get(userId);
    if (!user || !user.tempSecret) {
      return res.status(404).json({ error: 'Setup not initiated' });
    }

    // Verify the token with time window tolerance
    const verified = speakeasy.totp.verify({
      secret: user.tempSecret,
      encoding: 'base32',
      token: token,
      window: 2
    });

    if (verified) {
      // Move temp secret to permanent and enable TOTP
      user.totpSecret = user.tempSecret;
      user.totpEnabled = true;
      delete user.tempSecret;
      users.set(userId, user);

      res.json({
        success: true,
        message: 'Two-factor authentication enabled successfully'
      });
    } else {
      res.status(401).json({ error: 'Invalid verification code' });
    }
  } catch (error) {
    console.error('TOTP verification error:', error);
    res.status(500).json({ error: 'Verification failed' });
  }
});

// Login with TOTP verification
app.post('/api/auth/login-verify', totpLimiter, (req, res) => {
  try {
    const { userId, token, isBackupCode } = req.body;

    if (!userId || !token) {
      return res.status(400).json({ error: 'userId and token are required' });
    }

    const user = users.get(userId);
    if (!user || !user.totpEnabled) {
      return res.status(404).json({ error: 'User not found or TOTP not enabled' });
    }

    let verified = false;

    if (isBackupCode) {
      // Verify backup code (one-time use)
      const codeIndex = user.backupCodes.indexOf(token);
      if (codeIndex !== -1) {
        user.backupCodes.splice(codeIndex, 1);
        users.set(userId, user);
        verified = true;
      }
    } else {
      // Verify TOTP token
      verified = speakeasy.totp.verify({
        secret: user.totpSecret,
        encoding: 'base32',
        token: token,
        window: 1
      });
    }

    if (verified) {
      // Generate session token (simplified)
      const sessionToken = crypto.randomBytes(32).toString('hex');
      res.json({
        success: true,
        sessionToken: sessionToken,
        remainingBackupCodes: user.backupCodes.length
      });
    } else {
      res.status(401).json({ error: 'Invalid authentication code' });
    }
  } catch (error) {
    console.error('Login verification error:', error);
    res.status(500).json({ error: 'Authentication failed' });
  }
});

// Generate cryptographically secure backup codes
function generateBackupCodes(count = 10) {
  const codes = [];
  for (let i = 0; i < count; i++) {
    const code = crypto.randomBytes(4).toString('hex').toUpperCase();
    codes.push(code.match(/.{1,4}/g).join('-'));
  }
  return codes;
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`TOTP Authentication API running on port ${PORT}`);
});