+
+
+ {/* 2FA Section */}
+
)}
{/* Export Tab */}
diff --git a/src/components/TransactionRulesManager.tsx b/src/components/TransactionRulesManager.tsx
index 0e0d6b7..016ec9e 100644
--- a/src/components/TransactionRulesManager.tsx
+++ b/src/components/TransactionRulesManager.tsx
@@ -5,17 +5,22 @@ import type { TransactionRule } from '../app/page';
interface Envelope { id: string; name: string; color: string }
+interface Transaction { id: string; description: string; amount: number; envelopeId?: string }
+
interface Props {
rules: TransactionRule[];
envelopes: Envelope[];
onRulesChange: (rules: TransactionRule[]) => void;
+ transactions?: Transaction[];
+ onApplyToExisting?: (updated: Transaction[]) => void;
}
-export default function TransactionRulesManager({ rules, envelopes, onRulesChange }: Props) {
+export default function TransactionRulesManager({ rules, envelopes, onRulesChange, transactions = [], onApplyToExisting }: Props) {
const [keyword, setKeyword] = useState('');
const [envelopeId, setEnvelopeId] = useState(envelopes[0]?.id ?? '');
const [matchCase, setMatchCase] = useState(false);
const [error, setError] = useState('');
+ const [applyResult, setApplyResult] = useStateChange Password
Signed in as {user.email}
+
+
+
+
+ {twoFAMessage && (
+
+
+
+ {twoFAEnabled ? 'ON' : 'OFF'}
+
+ Two-Factor Authentication
++ {twoFAEnabled ? '🔐 2FA is enabled — your account is protected.' : 'Add an extra layer of security with an authenticator app.'} +
+
+ {twoFAMessage.text}
+
+ )}
+
+ {!twoFAEnabled && !twoFASetupData && (
+
+ )}
+
+ {!twoFAEnabled && twoFASetupData && (
+
+
+ )}
+
+ {twoFAEnabled && (
+
+ )}
+ Scan this QR code with Google Authenticator, Authy, or any TOTP app:
+
+ 
+
+
+
+
+ Or enter this code manually:
+{twoFASetupData.secret}
+
@@ -107,6 +132,27 @@ export default function TransactionRulesManager({ rules, envelopes, onRulesChang
)}
+ {onApplyToExisting && rules.length > 0 && (
+
+
+ )}
+
+ {applyResult && (
+
+
+
+ Apply rules to existing transactions
++ Categorize uncategorized expenses already in your history using the current rules. +
+
+ ✓ {applyResult}
+
+ )}
+
How rules work: When you add a new expense, its description is checked against all rules in order.
The first matching rule wins. Rules only apply to expenses (negative amounts) without an already-assigned envelope.
diff --git a/src/lib/authService.ts b/src/lib/authService.ts
index 9aa6587..4402e11 100644
--- a/src/lib/authService.ts
+++ b/src/lib/authService.ts
@@ -40,6 +40,32 @@ export class AuthService {
throw new Error(error.error || 'Login failed');
}
+ const result = await response.json();
+
+ if (result.requiresTOTP) {
+ const err: any = new Error('2FA required');
+ err.requiresTOTP = true;
+ err.tempToken = result.tempToken;
+ throw err;
+ }
+
+ this._persist(result.user, result.sessionToken);
+ this.notifyAuthChange(result.user);
+ return result.user;
+ }
+
+ static async signInWithTOTP(tempToken: string, code: string): Promise {
+ const response = await fetch('/api/auth/2fa/login', {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({ tempToken, code }),
+ });
+
+ if (!response.ok) {
+ const error = await response.json();
+ throw new Error(error.error || '2FA verification failed');
+ }
+
const result = await response.json();
this._persist(result.user, result.sessionToken);
this.notifyAuthChange(result.user);
diff --git a/src/lib/fileStorage.ts b/src/lib/fileStorage.ts
index 7ef9efd..418a047 100644
--- a/src/lib/fileStorage.ts
+++ b/src/lib/fileStorage.ts
@@ -2,12 +2,14 @@ import path from 'path';
import { promises as fsPromises } from 'fs';
import bcrypt from 'bcryptjs';
import { encryptData, decryptData } from '@/lib/crypto';
+import { generateSecret, verifyTOTP } from '@/lib/totp';
const DATA_DIR = path.join(process.cwd(), 'data');
const USERS_FILE = path.join(DATA_DIR, 'users.json');
const SESSIONS_FILE = path.join(DATA_DIR, 'sessions.json');
const RESET_TOKENS_FILE = path.join(DATA_DIR, 'reset_tokens.json');
const SHARES_FILE = path.join(DATA_DIR, 'shares.json');
+const TEMP_TOKENS_FILE = path.join(DATA_DIR, 'temp_tokens.json');
const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY || 'default-key-change-in-production';
const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
@@ -27,7 +29,7 @@ interface Shares { [shareId: string]: Share }
async function initializeDirectories() {
try {
await fsPromises.mkdir(DATA_DIR, { recursive: true });
- for (const file of [USERS_FILE, SESSIONS_FILE, RESET_TOKENS_FILE, SHARES_FILE]) {
+ for (const file of [USERS_FILE, SESSIONS_FILE, RESET_TOKENS_FILE, SHARES_FILE, TEMP_TOKENS_FILE]) {
try {
await fsPromises.access(file);
} catch {
@@ -45,8 +47,14 @@ interface UserCredentials {
email: string;
passwordHash: string;
userId: string;
+ totpSecret?: string;
+ totpEnabled?: boolean;
+ pendingTotpSecret?: string;
}
+interface TempToken { userId: string; email: string; expiresAt: string }
+interface TempTokens { [token: string]: TempToken }
+
interface Users {
[email: string]: UserCredentials;
}
@@ -133,20 +141,112 @@ export class FileStorageService {
}
}
- static async loginUser(email: string, password: string): Promise<{ userId: string; email: string; sessionToken: string }> {
+ static async loginUser(email: string, password: string): Promise<
+ | { userId: string; email: string; sessionToken: string; requiresTOTP?: false }
+ | { requiresTOTP: true; tempToken: string }
+ > {
const users = await readJson(USERS_FILE);
const user = users[email];
- // Always run bcrypt compare to prevent timing attacks
const hashToCompare = user?.passwordHash ?? '$2a$12$invalidhashpadding000000000000000000000000000000000000000';
const valid = await bcrypt.compare(password, hashToCompare);
if (!user || !valid) throw new Error('Invalid credentials');
+ if (user.totpEnabled && user.totpSecret) {
+ const releaseLock = await FileLock.acquire('temp-tokens');
+ try {
+ const temps = await readJson(TEMP_TOKENS_FILE);
+ const tempToken = crypto.randomUUID();
+ temps[tempToken] = { userId: user.userId, email: user.email, expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString() };
+ await writeJson(TEMP_TOKENS_FILE, temps);
+ return { requiresTOTP: true, tempToken };
+ } finally {
+ releaseLock();
+ }
+ }
+
const sessionToken = await this._createSession(user.userId, email);
return { userId: user.userId, email: user.email, sessionToken };
}
+ static async completeTOTPLogin(tempToken: string, totpCode: string): Promise<{ userId: string; email: string; sessionToken: string }> {
+ const temps = await readJson(TEMP_TOKENS_FILE);
+ const record = temps[tempToken];
+ if (!record) throw new Error('Invalid or expired token');
+ if (new Date(record.expiresAt) < new Date()) throw new Error('Token expired — please sign in again');
+
+ const users = await readJson(USERS_FILE);
+ const user = Object.values(users).find(u => u.userId === record.userId);
+ if (!user?.totpSecret) throw new Error('2FA not configured');
+
+ if (!verifyTOTP(user.totpSecret, totpCode)) throw new Error('Invalid 2FA code');
+
+ const releaseLock = await FileLock.acquire('temp-tokens');
+ try {
+ const temps2 = await readJson(TEMP_TOKENS_FILE);
+ delete temps2[tempToken];
+ await writeJson(TEMP_TOKENS_FILE, temps2);
+ } finally {
+ releaseLock();
+ }
+
+ const sessionToken = await this._createSession(record.userId, record.email);
+ return { userId: record.userId, email: record.email, sessionToken };
+ }
+
+ static async setup2FA(userId: string): Promise<{ secret: string; otpAuthUrl: string }> {
+ const { getOtpAuthUrl } = await import('@/lib/totp');
+ const users = await readJson(USERS_FILE);
+ const userEntry = Object.entries(users).find(([, u]) => u.userId === userId);
+ if (!userEntry) throw new Error('User not found');
+
+ const secret = generateSecret();
+ const [email, user] = userEntry;
+ users[email] = { ...user, pendingTotpSecret: secret };
+ await writeJson(USERS_FILE, users);
+
+ return { secret, otpAuthUrl: getOtpAuthUrl(secret, email) };
+ }
+
+ static async enable2FA(userId: string, token: string): Promise {
+ const releaseLock = await FileLock.acquire('users-file');
+ try {
+ const users = await readJson(USERS_FILE);
+ const entry = Object.entries(users).find(([, u]) => u.userId === userId);
+ if (!entry) throw new Error('User not found');
+ const [email, user] = entry;
+ if (!user.pendingTotpSecret) throw new Error('No pending 2FA setup — start setup first');
+ if (!verifyTOTP(user.pendingTotpSecret, token)) throw new Error('Invalid code — please check your authenticator app');
+ users[email] = { ...user, totpSecret: user.pendingTotpSecret, totpEnabled: true, pendingTotpSecret: undefined };
+ await writeJson(USERS_FILE, users);
+ } finally {
+ releaseLock();
+ }
+ }
+
+ static async disable2FA(userId: string, token: string): Promise {
+ const releaseLock = await FileLock.acquire('users-file');
+ try {
+ const users = await readJson(USERS_FILE);
+ const entry = Object.entries(users).find(([, u]) => u.userId === userId);
+ if (!entry) throw new Error('User not found');
+ const [email, user] = entry;
+ if (!user.totpEnabled || !user.totpSecret) throw new Error('2FA is not enabled');
+ if (!verifyTOTP(user.totpSecret, token)) throw new Error('Invalid 2FA code');
+ users[email] = { ...user, totpSecret: undefined, totpEnabled: false, pendingTotpSecret: undefined };
+ await writeJson(USERS_FILE, users);
+ } finally {
+ releaseLock();
+ }
+ }
+
+ static async get2FAStatus(userId: string): Promise {
+ const users = await readJson(USERS_FILE);
+ const user = Object.values(users).find(u => u.userId === userId);
+ return user?.totpEnabled ?? false;
+ }
+
static async validateSession(token: string): Promise<{ userId: string; email: string } | null> {
try {
const sessions = await readJson(SESSIONS_FILE);
diff --git a/src/lib/totp.ts b/src/lib/totp.ts
new file mode 100644
index 0000000..f140003
--- /dev/null
+++ b/src/lib/totp.ts
@@ -0,0 +1,70 @@
+import crypto from 'crypto';
+
+const BASE32_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+
+function base32Encode(buf: Buffer): string {
+ let result = '';
+ let bits = 0;
+ let current = 0;
+ for (const byte of buf) {
+ current = (current << 8) | byte;
+ bits += 8;
+ while (bits >= 5) {
+ result += BASE32_CHARS[(current >> (bits - 5)) & 0x1f];
+ bits -= 5;
+ }
+ }
+ if (bits > 0) result += BASE32_CHARS[(current << (5 - bits)) & 0x1f];
+ return result;
+}
+
+function base32Decode(s: string): Buffer {
+ const bytes: number[] = [];
+ let bits = 0;
+ let value = 0;
+ for (const ch of s.toUpperCase().replace(/=+$/, '')) {
+ const idx = BASE32_CHARS.indexOf(ch);
+ if (idx < 0) continue;
+ value = (value << 5) | idx;
+ bits += 5;
+ if (bits >= 8) {
+ bytes.push((value >> (bits - 8)) & 0xff);
+ bits -= 8;
+ }
+ }
+ return Buffer.from(bytes);
+}
+
+export function generateSecret(): string {
+ return base32Encode(crypto.randomBytes(20));
+}
+
+export function getOtpAuthUrl(secret: string, email: string, issuer = 'Capsule'): string {
+ const label = encodeURIComponent(`${issuer}:${email}`);
+ return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+}
+
+function computeTOTP(key: Buffer, counter: number): string {
+ const buf = Buffer.alloc(8);
+ buf.writeBigUInt64BE(BigInt(counter));
+ const hmac = crypto.createHmac('sha1', key);
+ hmac.update(buf);
+ const digest = hmac.digest();
+ const offset = digest[digest.length - 1] & 0x0f;
+ const code = (
+ ((digest[offset] & 0x7f) << 24) |
+ ((digest[offset + 1] & 0xff) << 16) |
+ ((digest[offset + 2] & 0xff) << 8) |
+ (digest[offset + 3] & 0xff)
+ ) % 1_000_000;
+ return code.toString().padStart(6, '0');
+}
+
+export function verifyTOTP(secret: string, token: string): boolean {
+ const key = base32Decode(secret);
+ const step = Math.floor(Date.now() / 1000 / 30);
+ for (const w of [-1, 0, 1]) {
+ if (computeTOTP(key, step + w) === token) return true;
+ }
+ return false;
+}