Trusted devices

import { createKavach } from 'kavachos';
import { twoFactor } from 'kavachos/auth';
import { createTrustedDeviceModule } from 'kavachos/modules/trusted-device'; 

const trustedDevice = createTrustedDeviceModule({ 
  secret: process.env.TRUSTED_DEVICE_SECRET!, // separate from KAVACH_SECRET
  trustDuration: 30 * 24 * 60 * 60, // 30 days in seconds
}); 

const kavach = await createKavach({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  secret: process.env.KAVACH_SECRET!,
  baseUrl: 'https://auth.example.com',
  plugins: [
    twoFactor({
      isTrustedDevice: trustedDevice.verify, 
    }),
  ],
  modules: [trustedDevice], 
});

import { trustedDevice } from './lib/kavach';

// After verifying the 2FA code:
const { token, expiresAt } = await trustedDevice.trust({
  userId: session.userId,
  fingerprint: request.headers.get('x-device-fingerprint') ?? '',
  userAgent: request.headers.get('user-agent') ?? '',
});

// Store the token in a long-lived cookie
response.setCookie('td_token', token, { maxAge: 30 * 24 * 60 * 60, httpOnly: true });

const token = request.cookies.get('td_token');

const trusted = await trustedDevice.verify({
  userId: user.id,
  token,
  fingerprint: request.headers.get('x-device-fingerprint') ?? '',
});

if (trusted) {
  // Skip 2FA, proceed with session creation
}

await trustedDevice.revoke({ userId: session.userId, token: deviceToken });

await trustedDevice.revokeAll({ userId: session.userId });

const devices = await trustedDevice.list({ userId: session.userId });

// [{ id, userAgent, createdAt, expiresAt }, ...]