import speakeasy from 'speakeasy';
import QRCode from 'qrcode';
import { PrismaClient } from '@prisma/client';
import crypto from 'crypto';

const prisma = new PrismaClient();

// Generate TOTP secret and return QR code
export async function initializeTOTP(userId: string, userEmail: string) {
  // Generate a high-entropy secret
  const secret = speakeasy.generateSecret({
    name: `YourApp (${userEmail})`,
    issuer: 'YourApp',
    length: 32
  });

  if (!secret.otpauth_url) {
    throw new Error('Failed to generate secret');
  }

  // Generate QR code
  const qrCodeDataUrl = await QRCode.toDataURL(secret.otpauth_url);

  // Store temporary secret (not verified yet)
  await prisma.mfaSetup.create({
    data: {
      userId,
      secret: secret.base32,
      verified: false,
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + 15 * 60 * 1000) // 15 minute window
    }
  });

  return {
    secret: secret.base32,
    qrCodeUrl: qrCodeDataUrl,
    manualEntryKey: secret.base32
  };
}

// Verify TOTP code during setup (user must provide a valid code)
export async function verifyTOTPSetup(userId: string, token: string) {
  const setup = await prisma.mfaSetup.findFirst({
    where: {
      userId,
      verified: false,
      expiresAt: { gt: new Date() }
    }
  });

  if (!setup) {
    throw new Error('TOTP setup expired or not found');
  }

  // Verify with 1-code window tolerance (±1 interval)
  const verified = speakeasy.totp.verify({
    secret: setup.secret,
    encoding: 'base32',
    token,
    window: 1 // Allow codes from 30s before/after current time
  });

  if (!verified) {
    throw new Error('Invalid TOTP code');
  }

  // Activate TOTP
  await prisma.mfaSetup.update({
    where: { id: setup.id },
    data: { verified: true }
  });

  // Update user record
  await prisma.user.update({
    where: { id: userId },
    data: {
      totpEnabled: true,
      totpSecret: setup.secret
    }
  });

  return { success: true };
}

// Verify TOTP code during login
export async function verifyTOTPLogin(userId: string, token: string): Promise<boolean> {
  const user = await prisma.user.findUnique({
    where: { id: userId }
  });

  if (!user?.totpSecret) {
    return false;
  }

  const verified = speakeasy.totp.verify({
    secret: user.totpSecret,
    encoding: 'base32',
    token,
    window: 1
  });

  if (verified) {
    // Log MFA verification for audit trail
    await prisma.auditLog.create({
      data: {
        userId,
        action: 'MFA_VERIFIED',
        ipAddress: '',
        userAgent: '',
        timestamp: new Date()
      }
    });
  }

  return verified;
}

// Spring Boot + GoogleAuth (com.warrenstrange:googleauth)
import com.warrenstrange.googleauth.GoogleAuthenticator;
import com.warrenstrange.googleauth.GoogleAuthenticatorKey;
import net.glxn.qrgen.javase.QRCode;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.time.Instant;
import java.util.Base64;
import java.util.Map;

@Service
public class TotpService {

    private final GoogleAuthenticator gAuth = new GoogleAuthenticator();
    private final MfaSetupRepository mfaSetupRepo;
    private final UserRepository userRepo;
    private final AuditLogRepository auditLogRepo;

    public TotpService(MfaSetupRepository mfaSetupRepo,
                       UserRepository userRepo,
                       AuditLogRepository auditLogRepo) {
        this.mfaSetupRepo = mfaSetupRepo;
        this.userRepo = userRepo;
        this.auditLogRepo = auditLogRepo;
    }

    // Generate TOTP secret and return QR code
    @Transactional
    public Map<String, String> initializeTOTP(String userId, String userEmail) {
        GoogleAuthenticatorKey key = gAuth.createCredentials();
        String secret = key.getKey();

        String otpauthUrl = String.format(
            "otpauth://totp/YourApp%%3A%%20%s?secret=%s&issuer=YourApp",
            userEmail, secret
        );

        // Generate QR code as Base64
        byte[] qrBytes = QRCode.from(otpauthUrl).withSize(200, 200).stream().toByteArray();
        String qrCodeDataUrl = "data:image/png;base64," + Base64.getEncoder().encodeToString(qrBytes);

        // Store temporary secret (not verified yet)
        MfaSetup setup = new MfaSetup();
        setup.setUserId(userId);
        setup.setSecret(secret);
        setup.setVerified(false);
        setup.setCreatedAt(Instant.now());
        setup.setExpiresAt(Instant.now().plusSeconds(15 * 60)); // 15-minute window
        mfaSetupRepo.save(setup);

        return Map.of(
            "secret", secret,
            "qrCodeUrl", qrCodeDataUrl,
            "manualEntryKey", secret
        );
    }

    // Verify TOTP code during setup
    @Transactional
    public void verifyTOTPSetup(String userId, int token) {
        MfaSetup setup = mfaSetupRepo
            .findFirstByUserIdAndVerifiedFalseAndExpiresAtAfter(userId, Instant.now())
            .orElseThrow(() -> new RuntimeException("TOTP setup expired or not found"));

        boolean verified = gAuth.authorize(setup.getSecret(), token);
        if (!verified) {
            throw new RuntimeException("Invalid TOTP code");
        }

        setup.setVerified(true);
        mfaSetupRepo.save(setup);

        User user = userRepo.findById(userId)
            .orElseThrow(() -> new RuntimeException("User not found"));
        user.setTotpEnabled(true);
        user.setTotpSecret(setup.getSecret());
        userRepo.save(user);
    }

    // Verify TOTP code during login
    @Transactional
    public boolean verifyTOTPLogin(String userId, int token) {
        User user = userRepo.findById(userId)
            .orElseThrow(() -> new RuntimeException("User not found"));

        if (user.getTotpSecret() == null) return false;

        boolean verified = gAuth.authorize(user.getTotpSecret(), token);
        if (verified) {
            AuditLog log = new AuditLog();
            log.setUserId(userId);
            log.setAction("MFA_VERIFIED");
            log.setIpAddress("");
            log.setUserAgent("");
            log.setTimestamp(Instant.now());
            auditLogRepo.save(log);
        }
        return verified;
    }
}

# FastAPI + pyotp + qrcode
import pyotp
import qrcode
import io
import base64
import hashlib
from datetime import datetime, timedelta, timezone
from sqlalchemy.orm import Session
from models import MfaSetup, User, AuditLog

def initialize_totp(user_id: str, user_email: str, db: Session) -> dict:
    # Generate a high-entropy secret
    secret = pyotp.random_base32()
    totp = pyotp.TOTP(secret)
    otpauth_url = totp.provisioning_uri(name=user_email, issuer_name="YourApp")

    # Generate QR code as data URL
    img = qrcode.make(otpauth_url)
    buf = io.BytesIO()
    img.save(buf, format="PNG")
    qr_code_data_url = "data:image/png;base64," + base64.b64encode(buf.getvalue()).decode()

    # Store temporary secret (not verified yet)
    expires_at = datetime.now(timezone.utc) + timedelta(minutes=15)
    setup = MfaSetup(
        user_id=user_id,
        secret=secret,
        verified=False,
        created_at=datetime.now(timezone.utc),
        expires_at=expires_at,
    )
    db.add(setup)
    db.commit()

    return {"secret": secret, "qr_code_url": qr_code_data_url, "manual_entry_key": secret}


def verify_totp_setup(user_id: str, token: str, db: Session) -> dict:
    setup = (
        db.query(MfaSetup)
        .filter(
            MfaSetup.user_id == user_id,
            MfaSetup.verified == False,
            MfaSetup.expires_at > datetime.now(timezone.utc),
        )
        .first()
    )
    if not setup:
        raise ValueError("TOTP setup expired or not found")

    totp = pyotp.TOTP(setup.secret)
    # valid_window=1 allows ±1 interval tolerance
    if not totp.verify(token, valid_window=1):
        raise ValueError("Invalid TOTP code")

    setup.verified = True
    user = db.query(User).filter(User.id == user_id).first()
    user.totp_enabled = True
    user.totp_secret = setup.secret
    db.commit()

    return {"success": True}


def verify_totp_login(user_id: str, token: str, db: Session) -> bool:
    user = db.query(User).filter(User.id == user_id).first()
    if not user or not user.totp_secret:
        return False

    totp = pyotp.TOTP(user.totp_secret)
    verified = totp.verify(token, valid_window=1)

    if verified:
        log = AuditLog(
            user_id=user_id,
            action="MFA_VERIFIED",
            ip_address="",
            user_agent="",
            timestamp=datetime.now(timezone.utc),
        )
        db.add(log)
        db.commit()

    return verified

// ASP.NET Core + OtpNet + QRCoder
using OtpNet;
using QRCoder;
using System.Security.Cryptography;

public class TotpService
{
    private readonly AppDbContext _db;

    public TotpService(AppDbContext db) => _db = db;

    // Generate TOTP secret and return QR code
    public async Task<TotpSetupResult> InitializeTotpAsync(string userId, string userEmail)
    {
        // Generate a high-entropy secret (20 bytes = 160 bits)
        var secretBytes = RandomNumberGenerator.GetBytes(20);
        var secret = Base32Encoding.ToString(secretBytes);

        var otpauthUrl = $"otpauth://totp/YourApp%3A{Uri.EscapeDataString(userEmail)}" +
                         $"?secret={secret}&issuer=YourApp";

        // Generate QR code as data URL
        using var qrGenerator = new QRCodeGenerator();
        using var qrData = qrGenerator.CreateQrCode(otpauthUrl, QRCodeGenerator.ECCLevel.Q);
        using var qrCode = new PngByteQRCode(qrData);
        var qrBytes = qrCode.GetGraphic(5);
        var qrCodeDataUrl = "data:image/png;base64," + Convert.ToBase64String(qrBytes);

        // Store temporary secret (not verified yet)
        var setup = new MfaSetup
        {
            UserId = userId,
            Secret = secret,
            Verified = false,
            CreatedAt = DateTime.UtcNow,
            ExpiresAt = DateTime.UtcNow.AddMinutes(15)
        };
        _db.MfaSetups.Add(setup);
        await _db.SaveChangesAsync();

        return new TotpSetupResult
        {
            Secret = secret,
            QrCodeUrl = qrCodeDataUrl,
            ManualEntryKey = secret
        };
    }

    // Verify TOTP code during setup
    public async Task VerifyTotpSetupAsync(string userId, string token)
    {
        var setup = await _db.MfaSetups
            .Where(s => s.UserId == userId && !s.Verified && s.ExpiresAt > DateTime.UtcNow)
            .FirstOrDefaultAsync()
            ?? throw new InvalidOperationException("TOTP setup expired or not found");

        var secretBytes = Base32Encoding.ToBytes(setup.Secret);
        var totp = new Totp(secretBytes);
        // VerifyTotp with window of 1 (±1 interval)
        bool verified = totp.VerifyTotp(token, out _, new VerificationWindow(1, 1));
        if (!verified)
            throw new InvalidOperationException("Invalid TOTP code");

        setup.Verified = true;
        var user = await _db.Users.FindAsync(userId)
            ?? throw new InvalidOperationException("User not found");
        user.TotpEnabled = true;
        user.TotpSecret = setup.Secret;
        await _db.SaveChangesAsync();
    }

    // Verify TOTP code during login
    public async Task<bool> VerifyTotpLoginAsync(string userId, string token)
    {
        var user = await _db.Users.FindAsync(userId);
        if (user?.TotpSecret == null) return false;

        var secretBytes = Base32Encoding.ToBytes(user.TotpSecret);
        var totp = new Totp(secretBytes);
        bool verified = totp.VerifyTotp(token, out _, new VerificationWindow(1, 1));

        if (verified)
        {
            _db.AuditLogs.Add(new AuditLog
            {
                UserId = userId,
                Action = "MFA_VERIFIED",
                IpAddress = "",
                UserAgent = "",
                Timestamp = DateTime.UtcNow
            });
            await _db.SaveChangesAsync();
        }
        return verified;
    }
}

import express, { Request, Response } from 'express';
import { authenticateUser } from './auth';

const app = express();

// Step 1: User initiates TOTP setup
app.post('/api/mfa/totp/setup', async (req: Request, res: Response) => {
  try {
    const userId = req.user?.id;
    if (!userId) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const { secret, qrCodeUrl, manualEntryKey } = await initializeTOTP(
      userId,
      req.user.email
    );

    res.json({
      secret: manualEntryKey, // For manual entry
      qrCode: qrCodeUrl,
      message: 'Scan the QR code with your authenticator app'
    });
  } catch (error) {
    res.status(500).json({ error: 'Failed to initialize TOTP' });
  }
});

// Step 2: User confirms TOTP setup with a valid code
app.post('/api/mfa/totp/verify-setup', async (req: Request, res: Response) => {
  try {
    const userId = req.user?.id;
    const { token } = req.body;

    if (!userId || !token) {
      return res.status(400).json({ error: 'Missing required fields' });
    }

    await verifyTOTPSetup(userId, token);
    res.json({ success: true, message: 'TOTP enabled successfully' });
  } catch (error) {
    res.status(400).json({ error: 'Invalid code or setup expired' });
  }
});

// Step 3: Verify TOTP during login
app.post('/api/auth/verify-mfa', async (req: Request, res: Response) => {
  try {
    const { userId, token } = req.body;

    const valid = await verifyTOTPLogin(userId, token);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid TOTP code' });
    }

    // Issue session/JWT after MFA verification
    const session = await createSession(userId);
    res.json({ sessionToken: session.token });
  } catch (error) {
    res.status(500).json({ error: 'MFA verification failed' });
  }
});

// Spring Boot REST Controller
@RestController
@RequestMapping("/api")
public class MfaController {

    private final TotpService totpService;
    private final SessionService sessionService;

    public MfaController(TotpService totpService, SessionService sessionService) {
        this.totpService = totpService;
        this.sessionService = sessionService;
    }

    // Step 1: User initiates TOTP setup
    @PostMapping("/mfa/totp/setup")
    public ResponseEntity<?> setupTotp(@AuthenticationPrincipal UserPrincipal principal) {
        if (principal == null) {
            return ResponseEntity.status(401).body(Map.of("error", "Unauthorized"));
        }
        try {
            var result = totpService.initializeTOTP(principal.getId(), principal.getEmail());
            return ResponseEntity.ok(Map.of(
                "secret", result.get("manualEntryKey"),
                "qrCode", result.get("qrCodeUrl"),
                "message", "Scan the QR code with your authenticator app"
            ));
        } catch (Exception e) {
            return ResponseEntity.status(500).body(Map.of("error", "Failed to initialize TOTP"));
        }
    }

    // Step 2: User confirms TOTP setup with a valid code
    @PostMapping("/mfa/totp/verify-setup")
    public ResponseEntity<?> verifyTotpSetup(
            @AuthenticationPrincipal UserPrincipal principal,
            @RequestBody Map<String, String> body) {
        if (principal == null || body.get("token") == null) {
            return ResponseEntity.status(400).body(Map.of("error", "Missing required fields"));
        }
        try {
            int token = Integer.parseInt(body.get("token"));
            totpService.verifyTOTPSetup(principal.getId(), token);
            return ResponseEntity.ok(Map.of("success", true, "message", "TOTP enabled successfully"));
        } catch (Exception e) {
            return ResponseEntity.status(400).body(Map.of("error", "Invalid code or setup expired"));
        }
    }

    // Step 3: Verify TOTP during login
    @PostMapping("/auth/verify-mfa")
    public ResponseEntity<?> verifyMfa(@RequestBody Map<String, String> body) {
        try {
            String userId = body.get("userId");
            int token = Integer.parseInt(body.get("token"));
            boolean valid = totpService.verifyTOTPLogin(userId, token);
            if (!valid) {
                return ResponseEntity.status(401).body(Map.of("error", "Invalid TOTP code"));
            }
            var session = sessionService.createSession(userId);
            return ResponseEntity.ok(Map.of("sessionToken", session.getToken()));
        } catch (Exception e) {
            return ResponseEntity.status(500).body(Map.of("error", "MFA verification failed"));
        }
    }
}

# FastAPI router
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session
from pydantic import BaseModel
from database import get_db
from auth import get_current_user

router = APIRouter()

class TokenBody(BaseModel):
    token: str

class VerifyMfaBody(BaseModel):
    user_id: str
    token: str

# Step 1: User initiates TOTP setup
@router.post("/mfa/totp/setup")
async def setup_totp(
    current_user=Depends(get_current_user),
    db: Session = Depends(get_db),
):
    result = initialize_totp(current_user.id, current_user.email, db)
    return {
        "secret": result["manual_entry_key"],
        "qr_code": result["qr_code_url"],
        "message": "Scan the QR code with your authenticator app",
    }

# Step 2: User confirms TOTP setup with a valid code
@router.post("/mfa/totp/verify-setup")
async def verify_totp_setup_endpoint(
    body: TokenBody,
    current_user=Depends(get_current_user),
    db: Session = Depends(get_db),
):
    try:
        result = verify_totp_setup(current_user.id, body.token, db)
        return {"success": True, "message": "TOTP enabled successfully"}
    except ValueError:
        raise HTTPException(status_code=400, detail="Invalid code or setup expired")

# Step 3: Verify TOTP during login
@router.post("/auth/verify-mfa")
async def verify_mfa(body: VerifyMfaBody, db: Session = Depends(get_db)):
    valid = verify_totp_login(body.user_id, body.token, db)
    if not valid:
        raise HTTPException(status_code=401, detail="Invalid TOTP code")
    session = create_session(body.user_id)
    return {"session_token": session.token}

// ASP.NET Core Controller
[ApiController]
[Route("api")]
public class MfaController : ControllerBase
{
    private readonly TotpService _totpService;
    private readonly SessionService _sessionService;

    public MfaController(TotpService totpService, SessionService sessionService)
    {
        _totpService = totpService;
        _sessionService = sessionService;
    }

    // Step 1: User initiates TOTP setup
    [HttpPost("mfa/totp/setup")]
    [Authorize]
    public async Task<IActionResult> SetupTotp()
    {
        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
        var email = User.FindFirstValue(ClaimTypes.Email);
        try
        {
            var result = await _totpService.InitializeTotpAsync(userId!, email!);
            return Ok(new
            {
                secret = result.ManualEntryKey,
                qrCode = result.QrCodeUrl,
                message = "Scan the QR code with your authenticator app"
            });
        }
        catch
        {
            return StatusCode(500, new { error = "Failed to initialize TOTP" });
        }
    }

    // Step 2: User confirms TOTP setup with a valid code
    [HttpPost("mfa/totp/verify-setup")]
    [Authorize]
    public async Task<IActionResult> VerifyTotpSetup([FromBody] TokenRequest request)
    {
        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
        if (userId == null || request.Token == null)
            return BadRequest(new { error = "Missing required fields" });
        try
        {
            await _totpService.VerifyTotpSetupAsync(userId, request.Token);
            return Ok(new { success = true, message = "TOTP enabled successfully" });
        }
        catch
        {
            return BadRequest(new { error = "Invalid code or setup expired" });
        }
    }

    // Step 3: Verify TOTP during login
    [HttpPost("auth/verify-mfa")]
    public async Task<IActionResult> VerifyMfa([FromBody] VerifyMfaRequest request)
    {
        try
        {
            var valid = await _totpService.VerifyTotpLoginAsync(request.UserId, request.Token);
            if (!valid)
                return Unauthorized(new { error = "Invalid TOTP code" });
            var session = await _sessionService.CreateSessionAsync(request.UserId);
            return Ok(new { sessionToken = session.Token });
        }
        catch
        {
            return StatusCode(500, new { error = "MFA verification failed" });
        }
    }
}

export async function generateBackupCodes(userId: string, count: number = 10) {
  const codes = Array.from({ length: count }).map(() => {
    // Generate 8-character alphanumeric codes
    return crypto
      .randomBytes(6)
      .toString('hex')
      .substring(0, 8)
      .toUpperCase();
  });

  // Hash codes before storage (they should be one-way)
  const hashedCodes = codes.map(code => ({
    hash: crypto.createHash('sha256').update(code).digest('hex'),
    used: false,
    createdAt: new Date(),
    userId
  }));

  // Store hashed codes
  await prisma.backupCode.createMany({
    data: hashedCodes
  });

  // Return unhashed codes for display (only time user sees them)
  return codes;
}

// Verify and consume a backup code
export async function verifyBackupCode(userId: string, code: string): Promise<boolean> {
  const codeHash = crypto.createHash('sha256').update(code).digest('hex');

  const backupCode = await prisma.backupCode.findFirst({
    where: {
      userId,
      hash: codeHash,
      used: false
    }
  });

  if (!backupCode) {
    return false;
  }

  // Mark as used (one-time only)
  await prisma.backupCode.update({
    where: { id: backupCode.id },
    data: { used: true, usedAt: new Date() }
  });

  // Log usage for audit trail
  await prisma.auditLog.create({
    data: {
      userId,
      action: 'BACKUP_CODE_USED',
      timestamp: new Date()
    }
  });

  return true;
}

// Check if user has remaining backup codes
export async function getBackupCodeCount(userId: string): Promise<number> {
  return prisma.backupCode.count({
    where: {
      userId,
      used: false
    }
  });
}

@Service
public class BackupCodeService {

    private final BackupCodeRepository backupCodeRepo;
    private final AuditLogRepository auditLogRepo;

    public BackupCodeService(BackupCodeRepository backupCodeRepo,
                             AuditLogRepository auditLogRepo) {
        this.backupCodeRepo = backupCodeRepo;
        this.auditLogRepo = auditLogRepo;
    }

    @Transactional
    public List<String> generateBackupCodes(String userId, int count) {
        List<String> codes = new ArrayList<>();
        List<BackupCode> entities = new ArrayList<>();

        for (int i = 0; i < count; i++) {
            // Generate 8-character hex code
            byte[] bytes = new byte[6];
            new SecureRandom().nextBytes(bytes);
            String code = HexFormat.of().formatHex(bytes).substring(0, 8).toUpperCase();
            codes.add(code);

            String hash = sha256Hex(code);
            BackupCode entity = new BackupCode();
            entity.setUserId(userId);
            entity.setHash(hash);
            entity.setUsed(false);
            entity.setCreatedAt(Instant.now());
            entities.add(entity);
        }

        backupCodeRepo.saveAll(entities);
        return codes; // Return plaintext codes for one-time display
    }

    @Transactional
    public boolean verifyBackupCode(String userId, String code) {
        String codeHash = sha256Hex(code);

        Optional<BackupCode> backupCode = backupCodeRepo
            .findFirstByUserIdAndHashAndUsedFalse(userId, codeHash);

        if (backupCode.isEmpty()) return false;

        BackupCode bc = backupCode.get();
        bc.setUsed(true);
        bc.setUsedAt(Instant.now());
        backupCodeRepo.save(bc);

        AuditLog log = new AuditLog();
        log.setUserId(userId);
        log.setAction("BACKUP_CODE_USED");
        log.setTimestamp(Instant.now());
        auditLogRepo.save(log);

        return true;
    }

    public long getBackupCodeCount(String userId) {
        return backupCodeRepo.countByUserIdAndUsedFalse(userId);
    }

    private String sha256Hex(String input) {
        try {
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
            return HexFormat.of().formatHex(hash);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }
    }
}

import secrets
import hashlib
from datetime import datetime, timezone
from sqlalchemy.orm import Session
from models import BackupCode, AuditLog

def generate_backup_codes(user_id: str, db: Session, count: int = 10) -> list[str]:
    codes = []
    entities = []

    for _ in range(count):
        # Generate 8-character hex code
        code = secrets.token_hex(6)[:8].upper()
        codes.append(code)

        code_hash = hashlib.sha256(code.encode()).hexdigest()
        entities.append(BackupCode(
            user_id=user_id,
            hash=code_hash,
            used=False,
            created_at=datetime.now(timezone.utc),
        ))

    db.add_all(entities)
    db.commit()
    return codes  # Return plaintext codes for one-time display


def verify_backup_code(user_id: str, code: str, db: Session) -> bool:
    code_hash = hashlib.sha256(code.encode()).hexdigest()

    backup_code = (
        db.query(BackupCode)
        .filter(
            BackupCode.user_id == user_id,
            BackupCode.hash == code_hash,
            BackupCode.used == False,
        )
        .first()
    )
    if not backup_code:
        return False

    backup_code.used = True
    backup_code.used_at = datetime.now(timezone.utc)

    log = AuditLog(
        user_id=user_id,
        action="BACKUP_CODE_USED",
        timestamp=datetime.now(timezone.utc),
    )
    db.add(log)
    db.commit()
    return True


def get_backup_code_count(user_id: str, db: Session) -> int:
    return db.query(BackupCode).filter(
        BackupCode.user_id == user_id,
        BackupCode.used == False,
    ).count()

public class BackupCodeService
{
    private readonly AppDbContext _db;

    public BackupCodeService(AppDbContext db) => _db = db;

    public async Task<List<string>> GenerateBackupCodesAsync(string userId, int count = 10)
    {
        var codes = new List<string>();
        var entities = new List<BackupCode>();

        for (int i = 0; i < count; i++)
        {
            // Generate 8-character hex code
            var bytes = RandomNumberGenerator.GetBytes(6);
            var code = Convert.ToHexString(bytes)[..8].ToUpper();
            codes.Add(code);

            entities.Add(new BackupCode
            {
                UserId = userId,
                Hash = Sha256Hex(code),
                Used = false,
                CreatedAt = DateTime.UtcNow
            });
        }

        _db.BackupCodes.AddRange(entities);
        await _db.SaveChangesAsync();
        return codes; // Return plaintext codes for one-time display
    }

    public async Task<bool> VerifyBackupCodeAsync(string userId, string code)
    {
        var codeHash = Sha256Hex(code);

        var backupCode = await _db.BackupCodes
            .Where(bc => bc.UserId == userId && bc.Hash == codeHash && !bc.Used)
            .FirstOrDefaultAsync();

        if (backupCode == null) return false;

        backupCode.Used = true;
        backupCode.UsedAt = DateTime.UtcNow;

        _db.AuditLogs.Add(new AuditLog
        {
            UserId = userId,
            Action = "BACKUP_CODE_USED",
            Timestamp = DateTime.UtcNow
        });
        await _db.SaveChangesAsync();
        return true;
    }

    public async Task<int> GetBackupCodeCountAsync(string userId) =>
        await _db.BackupCodes.CountAsync(bc => bc.UserId == userId && !bc.Used);

    private static string Sha256Hex(string input)
    {
        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(input));
        return Convert.ToHexString(hash).ToLower();
    }
}

app.post('/api/mfa/backup-codes/generate', async (req: Request, res: Response) => {
  try {
    const userId = req.user?.id;
    if (!userId) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const codes = await generateBackupCodes(userId);

    res.json({
      codes,
      message: 'Save these codes in a secure location. Each code can only be used once.'
    });
  } catch (error) {
    res.status(500).json({ error: 'Failed to generate backup codes' });
  }
});

// Verify backup code during login
app.post('/api/auth/verify-backup-code', async (req: Request, res: Response) => {
  try {
    const { userId, code } = req.body;

    const valid = await verifyBackupCode(userId, code);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid or expired backup code' });
    }

    const session = await createSession(userId);
    res.json({ sessionToken: session.token });
  } catch (error) {
    res.status(500).json({ error: 'Backup code verification failed' });
  }
});

@RestController
@RequestMapping("/api")
public class BackupCodeController {

    private final BackupCodeService backupCodeService;
    private final SessionService sessionService;

    public BackupCodeController(BackupCodeService backupCodeService,
                                SessionService sessionService) {
        this.backupCodeService = backupCodeService;
        this.sessionService = sessionService;
    }

    @PostMapping("/mfa/backup-codes/generate")
    @Authorize
    public ResponseEntity<?> generateBackupCodes(
            @AuthenticationPrincipal UserPrincipal principal) {
        try {
            List<String> codes = backupCodeService.generateBackupCodes(principal.getId(), 10);
            return ResponseEntity.ok(Map.of(
                "codes", codes,
                "message", "Save these codes in a secure location. Each code can only be used once."
            ));
        } catch (Exception e) {
            return ResponseEntity.status(500).body(Map.of("error", "Failed to generate backup codes"));
        }
    }

    @PostMapping("/auth/verify-backup-code")
    public ResponseEntity<?> verifyBackupCode(@RequestBody Map<String, String> body) {
        try {
            String userId = body.get("userId");
            String code = body.get("code");
            boolean valid = backupCodeService.verifyBackupCode(userId, code);
            if (!valid) {
                return ResponseEntity.status(401).body(Map.of("error", "Invalid or expired backup code"));
            }
            var session = sessionService.createSession(userId);
            return ResponseEntity.ok(Map.of("sessionToken", session.getToken()));
        } catch (Exception e) {
            return ResponseEntity.status(500).body(Map.of("error", "Backup code verification failed"));
        }
    }
}

from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session
from pydantic import BaseModel
from database import get_db
from auth import get_current_user

router = APIRouter()

class VerifyBackupCodeBody(BaseModel):
    user_id: str
    code: str

@router.post("/mfa/backup-codes/generate")
async def generate_backup_codes_endpoint(
    current_user=Depends(get_current_user),
    db: Session = Depends(get_db),
):
    codes = generate_backup_codes(current_user.id, db)
    return {
        "codes": codes,
        "message": "Save these codes in a secure location. Each code can only be used once.",
    }

@router.post("/auth/verify-backup-code")
async def verify_backup_code_endpoint(
    body: VerifyBackupCodeBody,
    db: Session = Depends(get_db),
):
    valid = verify_backup_code(body.user_id, body.code, db)
    if not valid:
        raise HTTPException(status_code=401, detail="Invalid or expired backup code")
    session = create_session(body.user_id)
    return {"session_token": session.token}

[ApiController]
[Route("api")]
public class BackupCodeController : ControllerBase
{
    private readonly BackupCodeService _backupCodeService;
    private readonly SessionService _sessionService;

    public BackupCodeController(BackupCodeService backupCodeService,
                                SessionService sessionService)
    {
        _backupCodeService = backupCodeService;
        _sessionService = sessionService;
    }

    [HttpPost("mfa/backup-codes/generate")]
    [Authorize]
    public async Task<IActionResult> GenerateBackupCodes()
    {
        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier)!;
        var codes = await _backupCodeService.GenerateBackupCodesAsync(userId);
        return Ok(new
        {
            codes,
            message = "Save these codes in a secure location. Each code can only be used once."
        });
    }

    [HttpPost("auth/verify-backup-code")]
    public async Task<IActionResult> VerifyBackupCode([FromBody] VerifyBackupCodeRequest request)
    {
        var valid = await _backupCodeService.VerifyBackupCodeAsync(request.UserId, request.Code);
        if (!valid)
            return Unauthorized(new { error = "Invalid or expired backup code" });
        var session = await _sessionService.CreateSessionAsync(request.UserId);
        return Ok(new { sessionToken = session.Token });
    }
}

import twilio from 'twilio';
import { RateLimiter } from 'bottleneck';

const twilioClient = twilio(process.env.TWILIO_ACCOUNT_SID, process.env.TWILIO_AUTH_TOKEN);

// Rate limiter: max 3 SMS per phone number per hour
const smsLimiter = new RateLimiter({
  maxConcurrent: 1,
  minTime: 1000,
  reservoir: 3,
  reservoirRefreshAmount: 3,
  reservoirRefreshInterval: 60 * 60 * 1000
});

export async function sendSMSCode(userId: string, phoneNumber: string) {
  try {
    // Rate limiting check
    await smsLimiter.schedule(async () => {
      const code = crypto.randomInt(100000, 999999).toString();

      // Store code with expiration (5 minutes)
      await prisma.smsChallenge.create({
        data: {
          userId,
          code,
          phoneNumber: maskPhoneNumber(phoneNumber),
          expiresAt: new Date(Date.now() + 5 * 60 * 1000),
          attempts: 0
        }
      });

      // Send SMS
      await twilioClient.messages.create({
        body: `Your authentication code is: ${code}. Valid for 5 minutes.`,
        from: process.env.TWILIO_PHONE_NUMBER,
        to: phoneNumber
      });

      return { success: true };
    });
  } catch (error) {
    if (error instanceof Error && error.message.includes('Rate limit exceeded')) {
      throw new Error('Too many SMS requests. Please try again later.');
    }
    throw error;
  }
}

export async function verifySMSCode(userId: string, code: string): Promise<boolean> {
  const challenge = await prisma.smsChallenge.findFirst({
    where: {
      userId,
      expiresAt: { gt: new Date() },
      attempts: { lt: 5 } // Max 5 attempts
    },
    orderBy: { createdAt: 'desc' }
  });

  if (!challenge) {
    return false;
  }

  // Increment attempts
  await prisma.smsChallenge.update({
    where: { id: challenge.id },
    data: { attempts: challenge.attempts + 1 }
  });

  // Verify code (timing-safe comparison to prevent timing attacks)
  const isValid = crypto.timingSafeEqual(
    Buffer.from(challenge.code),
    Buffer.from(code)
  );

  if (isValid) {
    // Mark as used
    await prisma.smsChallenge.update({
      where: { id: challenge.id },
      data: { verifiedAt: new Date() }
    });
  }

  return isValid;
}

function maskPhoneNumber(phone: string): string {
  return phone.replace(/\d(?=\d{4})/g, '*');
}

// Spring Boot + Twilio SDK + Bucket4j rate limiting
import com.twilio.Twilio;
import com.twilio.rest.api.v2010.account.Message;
import com.twilio.type.PhoneNumber;
import io.github.bucket4j.Bandwidth;
import io.github.bucket4j.Bucket;
import java.time.Duration;

@Service
public class SmsService {

    private final SmsChallengeRepository smsChallengeRepo;
    private final Map<String, Bucket> rateLimitBuckets = new ConcurrentHashMap<>();

    public SmsService(SmsChallengeRepository smsChallengeRepo) {
        this.smsChallengeRepo = smsChallengeRepo;
        Twilio.init(System.getenv("TWILIO_ACCOUNT_SID"), System.getenv("TWILIO_AUTH_TOKEN"));
    }

    // Rate limiter: max 3 SMS per userId per hour
    private Bucket getBucketForUser(String userId) {
        return rateLimitBuckets.computeIfAbsent(userId, k ->
            Bucket.builder()
                .addLimit(Bandwidth.simple(3, Duration.ofHours(1)))
                .build()
        );
    }

    @Transactional
    public void sendSmsCode(String userId, String phoneNumber) {
        Bucket bucket = getBucketForUser(userId);
        if (!bucket.tryConsume(1)) {
            throw new RuntimeException("Too many SMS requests. Please try again later.");
        }

        // 6-digit code
        String code = String.format("%06d", new SecureRandom().nextInt(900000) + 100000);

        SmsChallenge challenge = new SmsChallenge();
        challenge.setUserId(userId);
        challenge.setCode(code);
        challenge.setPhoneNumber(maskPhoneNumber(phoneNumber));
        challenge.setExpiresAt(Instant.now().plusSeconds(5 * 60));
        challenge.setAttempts(0);
        smsChallengeRepo.save(challenge);

        Message.creator(
            new PhoneNumber(phoneNumber),
            new PhoneNumber(System.getenv("TWILIO_PHONE_NUMBER")),
            "Your authentication code is: " + code + ". Valid for 5 minutes."
        ).create();
    }

    @Transactional
    public boolean verifySmsCode(String userId, String code) {
        SmsChallenge challenge = smsChallengeRepo
            .findFirstByUserIdAndExpiresAtAfterAndAttemptsLessThan(
                userId, Instant.now(), 5)
            .orElse(null);

        if (challenge == null) return false;

        challenge.setAttempts(challenge.getAttempts() + 1);
        smsChallengeRepo.save(challenge);

        // Timing-safe comparison
        boolean isValid = MessageDigest.isEqual(
            challenge.getCode().getBytes(StandardCharsets.UTF_8),
            code.getBytes(StandardCharsets.UTF_8)
        );

        if (isValid) {
            challenge.setVerifiedAt(Instant.now());
            smsChallengeRepo.save(challenge);
        }
        return isValid;
    }

    private String maskPhoneNumber(String phone) {
        return phone.replaceAll("\\d(?=\\d{4})", "*");
    }
}

# FastAPI + Twilio + slowapi rate limiting
from twilio.rest import Client as TwilioClient
from datetime import datetime, timedelta, timezone
import secrets
import hmac
from sqlalchemy.orm import Session
from models import SmsChallenge

twilio_client = TwilioClient(
    os.environ["TWILIO_ACCOUNT_SID"],
    os.environ["TWILIO_AUTH_TOKEN"],
)

# Simple in-memory rate limiter (use Redis in production)
_sms_rate_limits: dict[str, list[datetime]] = {}

def _check_rate_limit(user_id: str, max_count: int = 3, window_hours: int = 1) -> bool:
    now = datetime.now(timezone.utc)
    cutoff = now - timedelta(hours=window_hours)
    times = [t for t in _sms_rate_limits.get(user_id, []) if t > cutoff]
    if len(times) >= max_count:
        return False
    times.append(now)
    _sms_rate_limits[user_id] = times
    return True


def send_sms_code(user_id: str, phone_number: str, db: Session) -> None:
    if not _check_rate_limit(user_id):
        raise ValueError("Too many SMS requests. Please try again later.")

    code = str(secrets.randbelow(900000) + 100000)  # 6-digit code

    challenge = SmsChallenge(
        user_id=user_id,
        code=code,
        phone_number=mask_phone_number(phone_number),
        expires_at=datetime.now(timezone.utc) + timedelta(minutes=5),
        attempts=0,
    )
    db.add(challenge)
    db.commit()

    twilio_client.messages.create(
        body=f"Your authentication code is: {code}. Valid for 5 minutes.",
        from_=os.environ["TWILIO_PHONE_NUMBER"],
        to=phone_number,
    )


def verify_sms_code(user_id: str, code: str, db: Session) -> bool:
    challenge = (
        db.query(SmsChallenge)
        .filter(
            SmsChallenge.user_id == user_id,
            SmsChallenge.expires_at > datetime.now(timezone.utc),
            SmsChallenge.attempts < 5,
        )
        .order_by(SmsChallenge.created_at.desc())
        .first()
    )
    if not challenge:
        return False

    challenge.attempts += 1

    # Timing-safe comparison
    is_valid = hmac.compare_digest(challenge.code.encode(), code.encode())

    if is_valid:
        challenge.verified_at = datetime.now(timezone.utc)
    db.commit()
    return is_valid


def mask_phone_number(phone: str) -> str:
    import re
    return re.sub(r'\d(?=\d{4})', '*', phone)

// ASP.NET Core + Twilio + in-process rate limiter
using Twilio;
using Twilio.Rest.Api.V2010.Account;
using Twilio.Types;
using System.Security.Cryptography;
using System.Collections.Concurrent;

public class SmsService
{
    private readonly AppDbContext _db;
    private readonly ConcurrentDictionary<string, List<DateTime>> _rateLimits = new();

    public SmsService(AppDbContext db)
    {
        _db = db;
        TwilioClient.Init(
            Environment.GetEnvironmentVariable("TWILIO_ACCOUNT_SID"),
            Environment.GetEnvironmentVariable("TWILIO_AUTH_TOKEN")
        );
    }

    private bool CheckRateLimit(string userId, int maxCount = 3, int windowHours = 1)
    {
        var now = DateTime.UtcNow;
        var cutoff = now.AddHours(-windowHours);
        var times = _rateLimits.GetOrAdd(userId, _ => new List<DateTime>());
        lock (times)
        {
            times.RemoveAll(t => t < cutoff);
            if (times.Count >= maxCount) return false;
            times.Add(now);
        }
        return true;
    }

    public async Task SendSmsCodeAsync(string userId, string phoneNumber)
    {
        if (!CheckRateLimit(userId))
            throw new InvalidOperationException("Too many SMS requests. Please try again later.");

        // 6-digit code
        var code = RandomNumberGenerator.GetInt32(100000, 999999).ToString();

        _db.SmsChallenges.Add(new SmsChallenge
        {
            UserId = userId,
            Code = code,
            PhoneNumber = MaskPhoneNumber(phoneNumber),
            ExpiresAt = DateTime.UtcNow.AddMinutes(5),
            Attempts = 0
        });
        await _db.SaveChangesAsync();

        await MessageResource.CreateAsync(
            body: $"Your authentication code is: {code}. Valid for 5 minutes.",
            from: new PhoneNumber(Environment.GetEnvironmentVariable("TWILIO_PHONE_NUMBER")),
            to: new PhoneNumber(phoneNumber)
        );
    }

    public async Task<bool> VerifySmsCodeAsync(string userId, string code)
    {
        var challenge = await _db.SmsChallenges
            .Where(c => c.UserId == userId
                     && c.ExpiresAt > DateTime.UtcNow
                     && c.Attempts < 5)
            .OrderByDescending(c => c.CreatedAt)
            .FirstOrDefaultAsync();

        if (challenge == null) return false;

        challenge.Attempts++;

        // Timing-safe comparison
        bool isValid = CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(challenge.Code),
            Encoding.UTF8.GetBytes(code)
        );

        if (isValid) challenge.VerifiedAt = DateTime.UtcNow;
        await _db.SaveChangesAsync();
        return isValid;
    }

    private static string MaskPhoneNumber(string phone) =>
        System.Text.RegularExpressions.Regex.Replace(phone, @"\d(?=\d{4})", "*");
}

app.post('/api/mfa/sms/send', async (req: Request, res: Response) => {
  try {
    const userId = req.user?.id;
    if (!userId) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const user = await prisma.user.findUnique({ where: { id: userId } });
    if (!user?.phoneNumber) {
      return res.status(400).json({ error: 'Phone number not configured' });
    }

    await sendSMSCode(userId, user.phoneNumber);

    res.json({
      success: true,
      message: `Code sent to ${maskPhoneNumber(user.phoneNumber)}`
    });
  } catch (error) {
    res.status(429).json({ error: 'Too many requests' });
  }
});

app.post('/api/auth/verify-sms', async (req: Request, res: Response) => {
  try {
    const { userId, code } = req.body;

    const valid = await verifySMSCode(userId, code);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid or expired code' });
    }

    const session = await createSession(userId);
    res.json({ sessionToken: session.token });
  } catch (error) {
    res.status(500).json({ error: 'SMS verification failed' });
  }
});

@RestController
@RequestMapping("/api")
public class SmsController {

    private final SmsService smsService;
    private final UserRepository userRepo;
    private final SessionService sessionService;

    public SmsController(SmsService smsService, UserRepository userRepo,
                         SessionService sessionService) {
        this.smsService = smsService;
        this.userRepo = userRepo;
        this.sessionService = sessionService;
    }

    @PostMapping("/mfa/sms/send")
    @Authorize
    public ResponseEntity<?> sendSms(@AuthenticationPrincipal UserPrincipal principal) {
        try {
            User user = userRepo.findById(principal.getId())
                .orElseThrow(() -> new RuntimeException("User not found"));
            if (user.getPhoneNumber() == null) {
                return ResponseEntity.status(400).body(Map.of("error", "Phone number not configured"));
            }
            smsService.sendSmsCode(principal.getId(), user.getPhoneNumber());
            return ResponseEntity.ok(Map.of(
                "success", true,
                "message", "Code sent to " + smsService.maskPhoneNumber(user.getPhoneNumber())
            ));
        } catch (RuntimeException e) {
            return ResponseEntity.status(429).body(Map.of("error", "Too many requests"));
        }
    }

    @PostMapping("/auth/verify-sms")
    public ResponseEntity<?> verifySms(@RequestBody Map<String, String> body) {
        try {
            boolean valid = smsService.verifySmsCode(body.get("userId"), body.get("code"));
            if (!valid) {
                return ResponseEntity.status(401).body(Map.of("error", "Invalid or expired code"));
            }
            var session = sessionService.createSession(body.get("userId"));
            return ResponseEntity.ok(Map.of("sessionToken", session.getToken()));
        } catch (Exception e) {
            return ResponseEntity.status(500).body(Map.of("error", "SMS verification failed"));
        }
    }
}