Description

Add optional TOTP 2fa for login.
Partially solves: #1439

Screenshots

Additional Context

next-auth does not support 2fa natively.
There are several ways to implement it, but i've come up with this custom solution that is tailored to sn.

The goals of this implementation are:

• don't make it feel like an hack
  • don't ask for TOTP before the login (eg. enter the totp code if you have one)
  • don't ask the user to login twice
• make it work for every present and future credential provider
• use graphql apis like the rest of the site
• don't mess with next-auth internals
• make it extensible for other 2fa methods

To achieve this i've implemented 2fa as two middlewares:

• pageGuard: that redirects the user to the 2fa prompt
• sessionGuard: that forces the session to 'anon' until 2fa is resolved

Most of the logic is contained in /lib/auth2fa

As reference i've used the github 2fa flow.

Checklist

Are your changes backwards compatible? Please answer below:
yes

On a scale of 1-10 how well and how have you QA'd this change and any features it might affect? Please answer below:
6

For frontend changes: Tested on mobile, light and dark mode? Please answer below:
not yet

Did you introduce any new environment variables? If so, call them out explicitly here:
no