Add Two-Factor Authentication with AI Prompts

Implement TOTP-based two-factor authentication.

Language: TypeScript/JavaScript/Python

Setup flow:

1. Generate secret key for user
2. Create QR code with otpauth:// URL
3. Show QR code and manual entry key
4. Verify user can generate valid code
5. Store encrypted secret in database
6. Generate backup codes

Verification flow:

1. After password check, prompt for TOTP
2. Validate 6-digit code
3. Allow 1 code before/after for clock drift
4. Track failed attempts (rate limit)
5. Complete login on success

Use standard libraries:

• otplib or speakeasy for Node.js
• pyotp for Python

Include QR code generation with qrcode library.

Implement backup codes for 2FA recovery.

Requirements:

1. Generate 10 single-use backup codes
2. Each code: 8 alphanumeric characters
3. Store hashed codes in database
4. Mark used codes as consumed
5. Show codes only once during setup

Code format: XXXX-XXXX (easy to read/type)

Implementation:

• generateBackupCodes() -> string
• verifyBackupCode(userId, code) -> boolean
• regenerateBackupCodes(userId) -> string
• getRemainingCodeCount(userId) -> number

Security:

• Hash codes before storing (bcrypt)
• Don't allow code reuse
• Require re-auth to regenerate codes
• Log when backup codes are used

Create a complete 2FA enrollment flow.

Steps:

1. User clicks "Enable 2FA" in settings
2. Require password confirmation
3. Generate and display QR code
4. Show manual entry key below QR
5. User scans with authenticator app
6. User enters code to verify setup
7. Display backup codes (one time only)
8. User confirms they saved backup codes
9. 2FA is now active

UI needs:

• QR code display component
• Code input (6 digits, auto-advance)
• Backup codes display (copyable)
• Checkbox: "I have saved these codes"
• Clear instructions for setup

Handle errors:

• Invalid verification code
• Code already used
• Rate limiting on attempts

Implement 2FA recovery for users who lose access.

Recovery options:

1. Backup codes (primary method)
2. Recovery email with time-limited link
3. Admin/support manual verification

Backup code recovery:

• Accept backup code instead of TOTP
• Mark code as used after success
• Alert user about remaining codes

Email recovery (use carefully):

• Send link to verified email
• Link expires in 1 hour
• Requires answering security questions
• Logs recovery attempt
• Notifies user of recovery

After recovery:

• Force 2FA re-setup or disable
• Invalidate all existing sessions
• Send notification to user email
• Log the recovery event

Don't allow: Disabling 2FA without verification