snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/client/lib/2fa/overrideLoginMethod.ts

@@ -0,0 +1,110 @@
+import { Accounts } from 'meteor/accounts-base';
+
+import type { MeteorErrorLike } from './types';
+import { isTotpInvalidError, isTotpMaxAttemptsError, isTotpRequiredError } from './utils';
+
+export type LoginCallback = (error: MeteorErrorLike | undefined, result?: unknown) => void;
+
+export const overrideLoginMethod = <TArgs extends any[]>(
+	loginMethod: (...args: [...args: TArgs, cb: LoginCallback]) => void,
+	loginArgs: TArgs,
+	callback: LoginCallback | undefined,
+	loginMethodTOTP: (...args: [...args: TArgs, code: string, cb: LoginCallback]) => void,
+) => {
+	loginMethod(...loginArgs, async (error: MeteorErrorLike | undefined, result?: unknown) => {
+		if (!isTotpRequiredError(error)) {
+			callback?.(error);
+			return error;
+		}
+
+		const { process2faReturn } = await import('./process2faReturn');
+
+		try {
+			await process2faReturn({
+				error,
+				result,
+				emailOrUsername: typeof loginArgs[0] === 'string' ? loginArgs[0] : undefined,
+				originalCallback: callback,
+				onCode: (code: string) => {
+					return new Promise<void>((resolve, reject) => {
+						loginMethodTOTP(...loginArgs, code, (error: MeteorErrorLike | undefined, result?: unknown) => {
+							if (!error) {
+								callback?.(undefined, result);
+								resolve();
+								return;
+							}
+
+							if (isTotpInvalidError(error)) {
+								reject(error);
+								return;
+							}
+
+							Promise.all([import('../../../app/utils/lib/i18n'), import('../toast')]).then(([{ t }, { dispatchToastMessage }]) => {
+								if (isTotpMaxAttemptsError(error)) {
+									dispatchToastMessage({ type: 'error', message: t('totp-max-attempts') });
+									reject(error);
+									return;
+								}
+
+								dispatchToastMessage({ type: 'error', message: t('Invalid_two_factor_code') });
+								reject(error);
+							});
+						});
+					});
+				},
+			});
+		} catch (error) {
+			callback?.(error as MeteorErrorLike);
+		}
+	});
+};
+
+export const handleLogin = <TLoginFunction extends (...args: any[]) => Promise<any>>(
+	login: TLoginFunction,
+	loginWithTOTP: (...args: [...args: Parameters<TLoginFunction>, code: string]) => ReturnType<TLoginFunction>,
+) => {
+	return (...args: [...loginArgs: Parameters<TLoginFunction>, callback?: LoginCallback]) => {
+		const loginArgs = args.slice(0, -1) as Parameters<TLoginFunction>;
+		const callback = args.slice(-1)[0] as LoginCallback | undefined;
+
+		return login(...loginArgs)
+			.catch(async (error: MeteorErrorLike | undefined) => {
+				if (!isTotpRequiredError(error)) {
+					return Promise.reject(error);
+				}
+
+				const { process2faAsyncReturn } = await import('./process2faReturn');
+				return process2faAsyncReturn({
+					emailOrUsername: typeof loginArgs[0] === 'string' ? loginArgs[0] : undefined,
+					error,
+					onCode: (code: string) => loginWithTOTP(...loginArgs, code),
+				});
+			})
+			.then((result: unknown) => callback?.(undefined, result))
+			.catch((error: MeteorErrorLike | undefined) => {
+				if (!isTotpInvalidError(error)) {
+					callback?.(error);
+					return;
+				}
+
+				Promise.all([import('../../../app/utils/lib/i18n'), import('../toast')]).then(([{ t }, { dispatchToastMessage }]) => {
+					dispatchToastMessage({ type: 'error', message: t('Invalid_two_factor_code') });
+					callback?.(undefined);
+				});
+			});
+	};
+};
+
+export const callLoginMethod = (options: Omit<Accounts.LoginMethodOptions, 'userCallback'>) =>
+	new Promise<void>((resolve, reject) => {
+		Accounts.callLoginMethod({
+			...options,
+			userCallback: (error) => {
+				if (error) {
+					reject(error);
+				} else {
+					resolve();
+				}
+			},
+		});
+	});

apps/meteor/client/lib/2fa/process2faReturn.ts

@@ -0,0 +1,172 @@
+import { SHA256 } from '@rocket.chat/sha256';
+import { imperativeModal } from '@rocket.chat/ui-client';
+import { lazy } from 'react';
+
+import type { LoginCallback } from './overrideLoginMethod';
+import type { MeteorErrorLike } from './types';
+import { isTotpInvalidError, isTotpRequiredError } from './utils';
+import { getUser } from '../user';
+
+const TwoFactorModal = lazy(() => import('../../components/TwoFactorModal'));
+
+const twoFactorMethods = ['totp', 'email', 'password'] as const;
+
+type TwoFactorMethod = (typeof twoFactorMethods)[number];
+
+const isTwoFactorMethod = (method: string): method is TwoFactorMethod => twoFactorMethods.includes(method as TwoFactorMethod);
+
+const hasRequiredTwoFactorMethod = (
+	error: MeteorErrorLike,
+): error is MeteorErrorLike & { details: { method: TwoFactorMethod; emailOrUsername?: string } } => {
+	const { details } = error;
+
+	return (
+		typeof details === 'object' &&
+		details !== null &&
+		typeof (details as { method: unknown }).method === 'string' &&
+		isTwoFactorMethod((details as { method: string }).method)
+	);
+};
+
+function assertModalProps(props: {
+	method: TwoFactorMethod;
+	emailOrUsername?: string;
+}): asserts props is
+	{ method: 'totp' | 'password'; invalidAttempt?: boolean } | { method: 'email'; emailOrUsername: string; invalidAttempt?: boolean } {
+	if (props.method === 'email' && typeof props.emailOrUsername !== 'string') {
+		throw new Error('Invalid Two Factor method');
+	}
+}
+
+const getProps = (
+	method: 'totp' | 'email' | 'password',
+	emailOrUsername?: { username: string } | { email: string } | { id: string } | string,
+) => {
+	switch (method) {
+		case 'totp':
+			return { method };
+		case 'email':
+			return {
+				method,
+				emailOrUsername: typeof emailOrUsername === 'string' ? emailOrUsername : getUser()?.username,
+			};
+		case 'password':
+			return { method };
+	}
+};
+
+export async function process2faReturn({
+	error,
+	result,
+	originalCallback,
+	onCode,
+	emailOrUsername,
+}: {
+	error: MeteorErrorLike | undefined;
+	result: unknown;
+	originalCallback: LoginCallback | undefined;
+	onCode: (code: string, method: string) => void | Promise<void>;
+	emailOrUsername: { username: string } | { email: string } | { id: string } | string | null | undefined;
+}): Promise<void> {
+	if (!(isTotpRequiredError(error) || isTotpInvalidError(error)) || !hasRequiredTwoFactorMethod(error)) {
+		originalCallback?.(error, result);
+		return;
+	}
+
+	const props = {
+		...getProps(error.details.method, emailOrUsername || error.details.emailOrUsername),
+	};
+
+	const validateCode = async (code: string, method: string): Promise<void> => {
+		await onCode(code, method);
+	};
+
+	await invokeTwoFactorModal(props, validateCode);
+}
+
+export async function process2faAsyncReturn<TResult>({
+	error,
+	onCode,
+	emailOrUsername,
+}: {
+	error: unknown;
+	onCode: (code: string, method: string) => TResult | Promise<TResult>;
+	emailOrUsername: string | null | undefined;
+}): Promise<TResult> {
+	// if the promise is rejected, we need to check if it's a 2fa error
+	// if it's not a 2fa error, we reject the promise
+	if (!(isTotpRequiredError(error) || isTotpInvalidError(error)) || !hasRequiredTwoFactorMethod(error)) {
+		throw error;
+	}
+
+	const props = {
+		method: error.details.method,
+		emailOrUsername: emailOrUsername || error.details.emailOrUsername || getUser()?.username,
+	};
+
+	assertModalProps(props);
+
+	let result: TResult | undefined;
+
+	const validateCode = async (code: string, method: string): Promise<void> => {
+		result = await onCode(code, method);
+	};
+
+	await invokeTwoFactorModal(props, validateCode);
+
+	if (result === undefined) {
+		throw new Error('Unexpected error: result is undefined');
+	}
+
+	return result;
+}
+
+export const invokeTwoFactorModal = async (
+	props: {
+		method: 'totp' | 'email' | 'password';
+		emailOrUsername?: string | undefined;
+		invalidAttempt?: boolean;
+	},
+	validateCode?: (code: string, method: string) => Promise<void>,
+) => {
+	const { invalidAttempt, ...restProps } = props;
+	assertModalProps(restProps);
+
+	return new Promise<string>((resolve, reject) => {
+		let isResolved = false;
+		let isClosed = false;
+
+		imperativeModal.open({
+			component: TwoFactorModal,
+			props: {
+				...restProps,
+				onConfirm: async (code: string, method: string): Promise<void> => {
+					const actualCode = method === 'password' ? SHA256(code) : code;
+					if (validateCode) {
+						await validateCode(actualCode, method);
+					}
+					isResolved = true;
+					imperativeModal.close();
+					resolve(actualCode);
+				},
+				onClose: (): void => {
+					if (isClosed) {
+						return;
+					}
+					isClosed = true;
+					imperativeModal.close();
+					if (!isResolved) {
+						Promise.all([import('../../../app/utils/lib/i18n'), import('../toast')]).then(([{ t }, { dispatchToastMessage }]) => {
+							dispatchToastMessage({
+								type: 'error',
+								message: t('Two-factor_authentication_cancelled'),
+							});
+						});
+						reject(new Error('totp-canceled'));
+					}
+				},
+				...(invalidAttempt && { invalidAttempt }),
+			},
+		});
+	});
+};

apps/meteor/client/lib/2fa/types.ts

@@ -0,0 +1,9 @@
+// Structural shape covering both Meteor.Error and Meteor.TypedError. The 2FA
+// helpers only narrow errors by `error` / `errorType` / `details` — they never
+// instanceof — so a local type avoids pulling `meteor/meteor` for type info.
+export type MeteorErrorLike = Error & {
+	error?: unknown;
+	errorType?: unknown;
+	reason?: string;
+	details?: unknown;
+};

apps/meteor/client/lib/2fa/utils.ts

@@ -0,0 +1,20 @@
+import type { MeteorErrorLike } from './types';
+
+export const isTotpRequiredError = (
+	error: unknown,
+): error is MeteorErrorLike & ({ error: 'totp-required' } | { errorType: 'totp-required' }) =>
+	typeof error === 'object' &&
+	((error as { error?: unknown } | undefined)?.error === 'totp-required' ||
+		(error as { errorType?: unknown } | undefined)?.errorType === 'totp-required');
+
+export const isTotpInvalidError = (
+	error: unknown,
+): error is MeteorErrorLike & ({ error: 'totp-invalid' } | { errorType: 'totp-invalid' }) =>
+	(error as { error?: unknown } | undefined)?.error === 'totp-invalid' ||
+	(error as { errorType?: unknown } | undefined)?.errorType === 'totp-invalid';
+
+export const isTotpMaxAttemptsError = (
+	error: unknown,
+): error is MeteorErrorLike & ({ error: 'totp-max-attempts' } | { errorType: 'totp-max-attempts' }) =>
+	(error as { error?: unknown } | undefined)?.error === 'totp-max-attempts' ||
+	(error as { errorType?: unknown } | undefined)?.errorType === 'totp-max-attempts';