--- title: "adonia-two-factor API" image: "https://adonia.pages.dev/og.png" version: "next" --- > Documentation Index > Fetch the complete documentation index at: https://adonia.pages.dev/llms.txt > Use this file to discover all available pages before exploring further. # adonia-two-factor API Canonical inventory of every public subpath and TypeScript export in `adonia-two-factor`. ## `adonia-two-factor` | Export | Kind | Source | Summary | | --- | --- | --- | --- | | `clearTwoFactorVerification` | function | `packages/two-factor/src/session.ts:37` | Clear any prior second-factor proof, including proofs for another account. | | `configure` | function | `packages/two-factor/src/index.ts:161` | Ace configure hook that publishes this plugin's attached migration. | | `decodeBase32` | function | `packages/two-factor/src/totp.ts:26` | Decode an unpadded or padded RFC 4648 base32 value. Whitespace and dashes are ignored. | | `decryptTotpSecret` | function | `packages/two-factor/src/crypto.ts:57` | Decrypt and authenticate an encrypted TOTP secret. | | `encodeBase32` | function | `packages/two-factor/src/totp.ts:7` | Encode bytes with the unpadded RFC 4648 base32 alphabet used by authenticator apps. | | `encryptTotpSecret` | function | `packages/two-factor/src/crypto.ts:40` | Encrypt a base32 secret with AES-256-GCM and the host application's app key. | | `generateRecoveryCodes` | function | `packages/two-factor/src/crypto.ts:82` | Generate high-entropy, copyable recovery codes. | | `generateTotpSecret` | function | `packages/two-factor/src/totp.ts:52` | Create a cryptographically random, authenticator-compatible base32 secret. | | `hasCurrentTwoFactorVerification` | function | `packages/two-factor/src/session.ts:42` | Test whether the session proof matches this identity and remains inside its step-up window. | | `hashRecoveryCode` | function | `packages/two-factor/src/crypto.ts:100` | Hash a recovery code with a domain-separated HMAC keyed by the app key. | | `hotp` | function | `packages/two-factor/src/totp.ts:74` | Generate the RFC 4226 HOTP value for an unsigned 64-bit counter. | | `InvalidTwoFactorCodeError` | class | `packages/two-factor/src/service.ts:26` | A submitted TOTP or recovery code did not verify. | | `LucidTwoFactorCredentialStore` | class | `packages/two-factor/src/credential.ts:119` | Default Lucid-backed store, including atomic recovery-code consumption. | | `markTwoFactorVerified` | function | `packages/two-factor/src/session.ts:24` | Bind this session to a successful second-factor proof for one panel user. | | `normalizeAppKey` | function | `packages/two-factor/src/crypto.ts:18` | Normalize Adonis config secrets and plain strings without logging their value. | | `normalizeRecoveryCode` | function | `packages/two-factor/src/crypto.ts:77` | Canonical user-entered representation used for hashing and comparisons. | | `OtpOptions` | type-only interface | `packages/two-factor/src/totp.ts:60` | Options shared by HOTP and TOTP generation. | | `pullTwoFactorIntendedPath` | function | `packages/two-factor/src/session.ts:69` | Consume a safe intended path, falling back when it is absent or malformed. | | `rememberTwoFactorIntendedPath` | function | `packages/two-factor/src/session.ts:62` | Store only local, non-protocol-relative GET paths as post-challenge destinations. | | `requireTwoFactor` | function | `packages/two-factor/src/middleware.ts:43` | Require enabled users to complete TOTP before entering authenticated panel routes. | | `RequireTwoFactorOptions` | type-only interface | `packages/two-factor/src/middleware.ts:17` | Middleware policy and test seams. | | `StoredTwoFactorCredential` | type-only interface | `packages/two-factor/src/credential.ts:12` | Storage-neutral credential data consumed by the TOTP service. | | `totp` | function | `packages/two-factor/src/totp.ts:106` | Generate an RFC 6238 TOTP value. | | `TotpOptions` | type-only interface | `packages/two-factor/src/totp.ts:92` | TOTP generation options. `timestamp` is Unix time in milliseconds. | | `TotpProvisioningOptions` | type-only interface | `packages/two-factor/src/totp.ts:168` | Provisioning URI options understood by standard authenticator applications. | | `totpProvisioningUri` | function | `packages/two-factor/src/totp.ts:176` | Build an `otpauth://totp` provisioning URI without exposing any other account data. | | `TWO_FACTOR_CHALLENGE_PAGE` | constant | `packages/two-factor/src/page_keys.ts:4` | Custom page registry key rendered by the login-time challenge route. | | `TWO_FACTOR_INTENDED_KEY` | constant | `packages/two-factor/src/session.ts:7` | Safe same-origin URL saved while middleware redirects to the challenge. | | `TWO_FACTOR_MIGRATIONS` | constant | `packages/two-factor/src/index.ts:29` | Absolute directory containing the publishable credential migration. | | `TWO_FACTOR_SESSION_KEY` | constant | `packages/two-factor/src/session.ts:5` | Opaque key used inside the host's signed/encrypted Adonis session. | | `TWO_FACTOR_SETUP_PAGE` | constant | `packages/two-factor/src/page_keys.ts:2` | Custom page registry key rendered by the setup manifest route. | | `TWO_FACTOR_VERSION` | constant | `packages/two-factor/src/version.ts:2` | Package version generated from package.json; do not edit directly. | | `twoFactorAppKeyDoctorCheck` | constant | `packages/two-factor/src/doctor.ts:32` | Verify that the host config declares the app key used to encrypt TOTP secrets. | | `TwoFactorCredential` | class | `packages/two-factor/src/credential.ts:31` | Persisted panel/user credential. Plaintext secrets are never assigned to this model. | | `TwoFactorCredentialStore` | type-only interface | `packages/two-factor/src/credential.ts:75` | Persistence interface used by routes, middleware, and deterministic tests. | | `TwoFactorIdentity` | type-only interface | `packages/two-factor/src/credential.ts:6` | Stable identity used for every credential lookup. | | `twoFactorManifest` | constant | `packages/two-factor/src/index.ts:158` | Unconfigured manifest used by installers and default panel setups. | | `twoFactorPlugin` | function | `packages/two-factor/src/index.ts:100` | Build an installable manifest with panel-scoped protected routes. | | `TwoFactorPluginOptions` | type-only interface | `packages/two-factor/src/index.ts:32` | Server, TOTP, recovery, and session policy. | | `TwoFactorService` | class | `packages/two-factor/src/service.ts:65` | Implements the server-authoritative two-factor lifecycle. | | `TwoFactorServiceOptions` | type-only interface | `packages/two-factor/src/service.ts:50` | Configurable protocol and recovery-code policy. | | `TwoFactorSession` | type-only interface | `packages/two-factor/src/session.ts:10` | Minimal session API shared by Adonis sessions and unit-test doubles. | | `TwoFactorSetup` | type-only type | `packages/two-factor/src/service.ts:39` | Result returned while enabling two-factor authentication. | | `TwoFactorSetupIdentity` | type-only interface | `packages/two-factor/src/service.ts:34` | Setup identity plus the non-secret account label shown by authenticator apps. | | `TwoFactorStateError` | class | `packages/two-factor/src/service.ts:21` | A requested operation has no credential in the required lifecycle state. | | `twoFactorTableDoctorCheck` | constant | `packages/two-factor/src/doctor.ts:7` | Verify that the host installed the migration declaring the credential table. | | `verifyRecoveryCode` | function | `packages/two-factor/src/crypto.ts:110` | Compare a recovery code to its stored HMAC in constant time. | | `verifyTotp` | function | `packages/two-factor/src/totp.ts:163` | Verify a TOTP code in constant time across the configured time window. | | `VerifyTotpOptions` | type-only interface | `packages/two-factor/src/totp.ts:121` | TOTP verification options, including adjacent-period clock tolerance. | ## `adonia-two-factor/client` | Export | Kind | Source | Summary | | --- | --- | --- | --- | | `TWO_FACTOR_CHALLENGE_PAGE` | constant | `packages/two-factor/src/page_keys.ts:4` | Custom page registry key rendered by the login-time challenge route. | | `TWO_FACTOR_ENGLISH_MESSAGES` | constant | `packages/two-factor/src/client/i18n.ts:4` | English fallback catalog for every two-factor client string. | | `TWO_FACTOR_SETUP_PAGE` | constant | `packages/two-factor/src/page_keys.ts:2` | Custom page registry key rendered by the setup manifest route. | | `TwoFactorActionResponse` | type-only interface | `packages/two-factor/src/client_types.ts:21` | JSON returned after a successful setup, challenge, or recovery mutation. | | `TwoFactorChallengePageProps` | type-only type | `packages/two-factor/src/client_types.ts:14` | Props passed by the login-time challenge route to the custom client page. | | `TwoFactorMessageKey` | type-only type | `packages/two-factor/src/client/i18n.ts:47` | Keys available in the two-factor client message catalog. | | `TwoFactorMessages` | type-only type | `packages/two-factor/src/client/i18n.ts:49` | Complete localized message catalog for the two-factor client. | | `TwoFactorSetupPageProps` | type-only type | `packages/two-factor/src/client_types.ts:2` | Props passed by the authenticated setup route to the custom client page. | | `twoFactorUiPlugin` | constant | `packages/two-factor/src/client.tsx:48` | Client half installed through `registry.use(twoFactorUiPlugin)`. | Source: https://adonia.pages.dev/reference/api/two-factor/index.mdx