Documentation

use Illuminate\Support\Facades\Http;

public function showSetup(Request $request)
{
    $response = Http::withHeaders([
        'X-API-KEY' => env('TOTP_API_KEY'),
    ])->post(env('TOTP_BASE_URL') . '/api/v1/totp/setup', [
        'external_user_id' => (string) auth()->id(),
        'email'            => auth()->user()->email,
    ]);

    $data = $response->json();
    return view('2fa.setup', ['qr' => $data['qr_code_svg']]);
}

{{-- In your Blade template --}}
{!! $qr !!}

public function confirmSetup(Request $request)
{
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->post(env('TOTP_BASE_URL') . '/api/v1/totp/verify_setup', [
            'external_user_id' => (string) auth()->id(),
            'otp_code'         => $request->input('otp_code'),
        ]);

    if ($response->json('status') === 'enabled') {
        $codes = $response->json('recovery_codes'); // ⚠ shown only once — pass to view now
        return view('2fa.setup-complete', ['codes' => $codes]);
    }

    return back()->withErrors(['otp_code' => 'Invalid code, try again.']);
}

public function login(Request $request)
{
    // 1. Validate credentials
    if (!Auth::attempt($request->only('email', 'password'))) {
        return back()->withErrors(['email' => 'Invalid credentials.']);
    }
    $user = Auth::user();

    // 2. Check 2FA status via TOTP Shield status API
    $statusRes = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->get(env('TOTP_BASE_URL') . '/api/v1/totp/status', [
            'external_user_id' => (string) $user->id,
        ]);
    $twoFactorEnabled = $statusRes->json('two_factor_enabled');

    if ($twoFactorEnabled) {
        Auth::logout();
        session(['pending_user_id' => $user->id]);
        return redirect()->route('2fa.challenge');
    }

    return redirect()->intended('/dashboard');
}

public function challenge(Request $request)
{
    $userId   = session('pending_user_id');
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->post(env('TOTP_BASE_URL') . '/api/v1/totp/verify', [
            'external_user_id' => (string) $userId,
            'otp_code'         => $request->input('otp_code'),
        ]);

    if ($response->json('status') === 'verified') {
        Auth::loginUsingId($userId);
        return redirect()->intended('/dashboard');
    }

    return back()->withErrors(['otp_code' => 'Invalid or expired code.']);
}

public function verifyRecovery(Request $request)
{
    $userId   = session('pending_user_id');
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->post(env('TOTP_BASE_URL') . '/api/v1/totp/verify_recovery', [
            'external_user_id' => (string) $userId,
            'recovery_code'    => $request->input('recovery_code'),
        ]);

    if ($response->json('status') === 'verified') {
        Auth::loginUsingId($userId);
        return redirect()->intended('/dashboard');
    }

    return back()->withErrors(['recovery_code' => 'Invalid or already-used recovery code.']);
}

public function recoveryCodes(Request $request)
{
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->get(env('TOTP_BASE_URL') . '/api/v1/totp/recovery_codes', [
            'external_user_id' => (string) auth()->id(),
        ]);

    return view('2fa.recovery', ['data' => $response->json()]);
    // data.codes = [{ masked_code, used }, ...]
    // data.recovery_codes_remaining = integer
}

public function regenerateCodes(Request $request)
{
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->post(env('TOTP_BASE_URL') . '/api/v1/totp/recovery_codes/regenerate', [
            'external_user_id' => (string) auth()->id(),
            'otp_code'         => $request->input('otp_code'), // ← live OTP required
        ]);

    if ($response->json('status') === 'regenerated') {
        // recovery_codes shown only once — pass to view immediately
        return view('2fa.new-codes', ['codes' => $response->json('recovery_codes')]);
    }

    return back()->withErrors(['otp_code' => 'Invalid OTP — regeneration denied.']);
}

public function disable(Request $request)
{
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->delete(env('TOTP_BASE_URL') . '/api/v1/totp/disable', [
            'external_user_id' => (string) auth()->id(),
        ]);

    if ($response->json('status') === 'disabled') {
        auth()->user()->update(['two_factor_enabled' => false]);
        return redirect()->route('dashboard')->with('success', '2FA has been disabled.');
    }

    return back()->withErrors(['general' => 'Could not disable 2FA.']);
}

public function totpStatus(Request $request)
{
    $response = Http::withHeaders(['X-API-KEY' => env('TOTP_API_KEY')])
        ->get(env('TOTP_BASE_URL') . '/api/v1/totp/status', [
            'external_user_id' => (string) auth()->id(),
        ]);

    return response()->json($response->json());
    // { two_factor_enabled: true/false, recovery_codes_remaining: int }
}

import { useState, useEffect } from 'react';

export default function TwoFactorSetup({ userId, email }) {
  const [qrSvg,   setQrSvg]   = useState(null);
  const [secret,  setSecret]  = useState('');
  const [code,    setCode]    = useState('');
  const [status,  setStatus]  = useState('');
  const [codes,   setCodes]   = useState([]);

  useEffect(() => {
    fetch('/api/totp/setup', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, email }),
    })
      .then(r => r.json())
      .then(d => {
        if (d.status === 'already_enabled') { setStatus('already_enabled'); return; }
        setQrSvg(d.qr_code_svg);
        setSecret(d.otp_secret);
      });
  }, [userId, email]);

  const verifySetup = async () => {
    const d = await fetch('/api/totp/verify-setup', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, otp_code: code }),
    }).then(r => r.json());
    if (d.status === 'enabled') {
      setCodes(d.recovery_codes); // ⚠ shown only once — persist immediately
      setStatus('enabled');
    } else { setStatus('invalid'); }
  };

  if (status === 'already_enabled') return <p>2FA is already active for this account.</p>;

  if (status === 'enabled') return (
    <div>
      <p>✅ 2FA enabled! Save these recovery codes — they will not be shown again:</p>
      <ul>{codes.map(c => <li key={c}>{c}</li>)}</ul>
    </div>
  );

  return (
    <div>
      {qrSvg && <div dangerouslySetInnerHTML={{ __html: qrSvg }} />}
      {secret && <p>Manual entry: <code>{secret}</code></p>}
      <input value={code} onChange={e => setCode(e.target.value)}
             placeholder="Enter 6-digit code" maxLength={6} />
      <button onClick={verifySetup}>Verify & Enable</button>
      {status === 'invalid' && <p style={{ color: 'red' }}>Invalid code — try again</p>}
    </div>
  );
}

import { useState } from 'react';

export default function OtpChallenge({ userId, onSuccess }) {
  const [code, setCode]   = useState('');
  const [error, setError] = useState('');

  const verify = async () => {
    const d = await fetch('/api/totp/verify', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, otp_code: code }),
    }).then(r => r.json());
    if (d.status === 'verified') onSuccess();
    else setError('Invalid or expired code');
  };

  return (
    <div>
      <input value={code} onChange={e => setCode(e.target.value)} maxLength={6}
             placeholder="6-digit authenticator code" />
      <button onClick={verify}>Verify</button>
      {error && <p style={{ color: 'red' }}>{error}</p>}
    </div>
  );
}

import { useState } from 'react';

export default function RecoveryChallenge({ userId, onSuccess }) {
  const [recoveryCode, setRecoveryCode] = useState('');
  const [result, setResult]             = useState(null);

  const verify = async () => {
    const d = await fetch('/api/totp/verify-recovery', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, recovery_code: recoveryCode }),
    }).then(r => r.json());
    if (d.status === 'verified') { setResult(d); onSuccess(); }
    else setResult({ error: 'Invalid or already-used recovery code' });
  };

  return (
    <div>
      <input value={recoveryCode} onChange={e => setRecoveryCode(e.target.value)}
             placeholder="ABCD-EFGH-IJKL-MNOP" />
      <button onClick={verify}>Use Recovery Code</button>
      {result?.error && <p style={{ color: 'red' }}>{result.error}</p>}
      {result?.recovery_codes_remaining !== undefined &&
        <p>Codes remaining: {result.recovery_codes_remaining}</p>}
    </div>
  );
}

import { useEffect, useState } from 'react';

export function useTotpStatus(userId: string) {
  const [status, setStatus] = useState<{ two_factor_enabled: boolean; recovery_codes_remaining: number } | null>(null);

  useEffect(() => {
    fetch(`/api/totp/status?external_user_id=${encodeURIComponent(userId)}`)
      .then(r => r.json())
      .then(setStatus);
  }, [userId]);

  return status;
}

import { useState } from 'react';

export default function RegenerateCodes({ userId }) {
  const [otpCode,    setOtpCode]    = useState('');
  const [newCodes,   setNewCodes]   = useState([]);
  const [error,     setError]      = useState('');

  const regenerate = async () => {
    const d = await fetch('/api/totp/regenerate', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, otp_code: otpCode }),
    }).then(r => r.json());
    if (d.status === 'regenerated') {
      setNewCodes(d.recovery_codes); // ⚠ shown only once
      setError('');
    } else { setError(d.message || 'Invalid OTP code'); }
  };

  return (
    <div>
      <input value={otpCode} onChange={e => setOtpCode(e.target.value)}
             placeholder="Current OTP code (required)" maxLength={6} />
      <button onClick={regenerate}>Regenerate</button>
      {error && <p style={{ color: 'red' }}>{error}</p>}
      {newCodes.length > 0 && (
        <div>
          <p>✅ New codes — save them now, they won't be shown again:</p>
          <ul>{newCodes.map(c => <li key={c}>{c}</li>)}</ul>
        </div>
      )}
    </div>
  );
}

import { useState } from 'react';

export default function DisableTwoFactor({ userId, onDisabled }) {
  const [otpCode, setOtpCode] = useState('');
  const [error,   setError]   = useState('');

  const disable = async () => {
    // Step 1: verify current OTP code
    const check = await fetch('/api/totp/verify', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId, otp_code: otpCode }),
    }).then(r => r.json());
    if (check.status !== 'verified') { setError('Invalid OTP — cannot disable'); return; }

    // Step 2: disable
    const d = await fetch('/api/totp/disable', {
      method: 'DELETE',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ external_user_id: userId }),
    }).then(r => r.json());
    if (d.status === 'disabled') onDisabled();
    else setError('Failed to disable');
  };

  return (
    <div>
      <input value={otpCode} onChange={e => setOtpCode(e.target.value)}
             placeholder="Current OTP (required to disable)" maxLength={6} />
      <button onClick={disable}>Disable 2FA</button>
      {error && <p style={{ color: 'red' }}>{error}</p>}
    </div>
  );
}

// middleware.ts
import { NextRequest, NextResponse } from 'next/server'

export function middleware(req: NextRequest) {
  const otpVerified = req.cookies.get('otp_verified')?.value

  if (!otpVerified && req.nextUrl.pathname.startsWith('/dashboard')) {
    return NextResponse.redirect(new URL('/auth/2fa', req.url))
  }
}

export const config = { matcher: ['/dashboard/:path*'] }

import { ref } from 'vue'

export function useTotpSetup(userId, email) {
  const qrSvg  = ref(null)
  const codes  = ref([])   // recovery codes — shown only once
  const error  = ref(null)

  async function fetchQr() {
    const data = await $fetch('/api/totp/setup', {
      method: 'POST',
      body: { external_user_id: userId, email },
    })
    qrSvg.value = data.qr_code_svg
  }

  async function confirmCode(otp_code) {
    const data = await $fetch('/api/totp/verify-setup', {
      method: 'POST',
      body: { external_user_id: userId, otp_code },
    })
    if (data.status === 'enabled') codes.value = data.recovery_codes
    else error.value = 'Invalid code'
    return data.status === 'enabled'
  }

  return { qrSvg, codes, error, fetchQr, confirmCode }
}

export function useTotpVerify(userId) {
  const error = ref(null)

  async function verify(otp_code) {
    const data = await $fetch('/api/totp/verify', {
      method: 'POST',
      body: { external_user_id: userId, otp_code },
    })
    if (data.status !== 'verified') error.value = 'Invalid or expired code'
    return data.status === 'verified'
  }

  return { error, verify }
}

export function useTotpRecoveryVerify(userId) {
  const error     = ref(null)
  const remaining = ref(null)

  async function verifyRecovery(recovery_code) {
    const data = await $fetch('/api/totp/verify-recovery', {
      method: 'POST',
      body: { external_user_id: userId, recovery_code },
    })
    if (data.status === 'verified') remaining.value = data.recovery_codes_remaining
    else error.value = 'Invalid or already-used recovery code'
    return data.status === 'verified'
  }

  return { error, remaining, verifyRecovery }
}

export function useTotpStatus(userId) {
  const enabled   = ref(false)
  const remaining = ref(0)

  async function fetchStatus() {
    const data = await $fetch(`/api/totp/status?external_user_id=${encodeURIComponent(userId)}`)
    enabled.value   = data.two_factor_enabled
    remaining.value = data.recovery_codes_remaining
  }

  return { enabled, remaining, fetchStatus }
}

export function useRecoveryCodes(userId) {
  const codes     = ref([])
  const remaining = ref(0)

  async function fetchCodes() {
    const data = await $fetch(`/api/totp/recovery-codes?external_user_id=${encodeURIComponent(userId)}`)
    codes.value     = data.codes     // [{ masked_code, used }]
    remaining.value = data.recovery_codes_remaining
  }

  return { codes, remaining, fetchCodes }
}

export function useRegenCodes(userId) {
  const newCodes = ref([])
  const error    = ref(null)

  async function regenerate(otp_code) {
    const data = await $fetch('/api/totp/regenerate', {
      method: 'POST',
      body: { external_user_id: userId, otp_code },  // live OTP required
    })
    if (data.status === 'regenerated') newCodes.value = data.recovery_codes
    else error.value = data.message || 'Invalid OTP'
    return data.status === 'regenerated'
  }

  return { newCodes, error, regenerate }
}

export function useTotpDisable(userId) {
  const error = ref(null)

  async function disable() {
    const data = await $fetch('/api/totp/disable', {
      method: 'DELETE',
      body: { external_user_id: userId },
    })
    if (data.status !== 'disabled') error.value = 'Could not disable 2FA'
    return data.status === 'disabled'
  }

  return { error, disable }
}

const express = require('express')
const router  = express.Router()
const axios   = require('axios')

const totpApi = axios.create({
  baseURL: process.env.TOTP_BASE_URL,
  headers: { 'X-API-KEY': process.env.TOTP_API_KEY },
})

// 1. Generate QR code for setup
router.post('/setup', async (req, res) => {
  const { data } = await totpApi.post('/api/v1/totp/setup', {
    external_user_id: req.user.id.toString(), // from auth middleware — never req.body
    email: req.user.email,
  })
  res.json(data)  // { qr_code_svg, otp_secret, message }
})

// 2. Confirm setup (user scanned QR, submits first code)
router.post('/verify-setup', async (req, res) => {
  const { data } = await totpApi.post('/api/v1/totp/verify_setup', {
    external_user_id: req.user.id.toString(),
    otp_code: req.body.otp_code,
  })
  if (data.status === 'enabled') {
    req.session.twoFactorEnabled = true
    return res.json(data)  // includes recovery_codes — shown only once
  }
  res.status(422).json({ error: 'Invalid code' })
})

// 3. Verify OTP on login (user_id comes from session, not body)
router.post('/verify', async (req, res) => {
  const userId = req.session.pendingUserId  // stored during login
  if (!userId) return res.status(401).json({ error: 'No pending session' })
  const { data } = await totpApi.post('/api/v1/totp/verify', {
    external_user_id: userId.toString(),
    otp_code: req.body.otp_code,
  })
  if (data.status === 'verified') {
    req.session.otpVerified = true
    delete req.session.pendingUserId
    return res.json({ ok: true })
  }
  res.status(422).json({ error: 'Invalid code' })
})

// 4. Verify via recovery code (user_id from session)
router.post('/verify-recovery', async (req, res) => {
  const userId = req.session.pendingUserId
  if (!userId) return res.status(401).json({ error: 'No pending session' })
  const { data } = await totpApi.post('/api/v1/totp/verify_recovery', {
    external_user_id: userId.toString(),
    recovery_code: req.body.recovery_code,
  })
  if (data.status === 'verified') {
    req.session.otpVerified = true
    delete req.session.pendingUserId
    return res.json(data)
  }
  res.status(422).json({ error: 'Invalid or used recovery code' })
})

// 5. Check 2FA status
router.get('/status', async (req, res) => {
  const { data } = await totpApi.get('/api/v1/totp/status', {
    params: { external_user_id: req.user.id.toString() },
  })
  res.json(data)
})

// 6. List recovery codes (masked)
router.get('/recovery-codes', async (req, res) => {
  const { data } = await totpApi.get('/api/v1/totp/recovery_codes', {
    params: { external_user_id: req.user.id.toString() },
  })
  res.json(data)  // { codes: [{ masked_code, used }], recovery_codes_remaining }
})

// 7. Regenerate recovery codes (requires live OTP code)
router.post('/regenerate', async (req, res) => {
  const { data } = await totpApi.post('/api/v1/totp/recovery_codes/regenerate', {
    external_user_id: req.user.id.toString(),
    otp_code: req.body.otp_code,  // live OTP required
  })
  if (data.status === 'regenerated') return res.json(data)  // recovery_codes shown only once
  res.status(422).json({ error: 'Invalid OTP — regeneration denied' })
})

// 8. Disable 2FA
router.delete('/disable', async (req, res) => {
  const { data } = await totpApi.delete('/api/v1/totp/disable', {
    data: { external_user_id: req.user.id.toString() },
  })
  req.session.otpVerified = false
  res.json(data)
})

module.exports = router

// middleware/requireOtp.js
module.exports = function requireOtp(req, res, next) {
  if (req.session.otpVerified) return next()
  res.status(401).json({ error: '2FA verification required' })
}

// app.js — apply to protected routes
const requireOtp = require('./middleware/requireOtp')

app.use('/api/dashboard', requireOtp, require('./routes/dashboard'))
app.use('/api/totp',       require('./routes/totp'))

# services/totp.py
import os
import requests

BASE_URL = os.environ['TOTP_BASE_URL']
HEADERS  = { 'X-API-KEY': os.environ['TOTP_API_KEY'] }

def setup_user(user_id: str, email: str) -> dict:
    r = requests.post(
        f"{BASE_URL}/api/v1/totp/setup",
        json={ "external_user_id": user_id, "email": email },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { qr_code_svg, otp_secret }

def verify_setup(user_id: str, otp_code: str) -> dict:
    r = requests.post(
        f"{BASE_URL}/api/v1/totp/verify_setup",
        json={ "external_user_id": user_id, "otp_code": otp_code },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { status: 'enabled', recovery_codes: [...] } — codes shown only once

def verify_otp(user_id: str, otp_code: str) -> bool:
    r = requests.post(
        f"{BASE_URL}/api/v1/totp/verify",
        json={ "external_user_id": user_id, "otp_code": otp_code },
        headers=HEADERS,
    )
    return r.json().get("status") == "verified"

def verify_recovery_code(user_id: str, recovery_code: str) -> dict:
    r = requests.post(
        f"{BASE_URL}/api/v1/totp/verify_recovery",
        json={ "external_user_id": user_id, "recovery_code": recovery_code },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { status: 'verified', recovery_codes_remaining: n }

def check_status(user_id: str) -> dict:
    r = requests.get(
        f"{BASE_URL}/api/v1/totp/status",
        params={ "external_user_id": user_id },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { two_factor_enabled, recovery_codes_remaining }

def list_recovery_codes(user_id: str) -> dict:
    r = requests.get(
        f"{BASE_URL}/api/v1/totp/recovery_codes",
        params={ "external_user_id": user_id },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { codes: [{ masked_code, used }], recovery_codes_remaining }

def regenerate_recovery_codes(user_id: str, otp_code: str) -> dict:
    r = requests.post(
        f"{BASE_URL}/api/v1/totp/recovery_codes/regenerate",
        json={ "external_user_id": user_id, "otp_code": otp_code },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { status: 'regenerated', recovery_codes: [...] } — shown only once

def disable_totp(user_id: str) -> dict:
    r = requests.delete(
        f"{BASE_URL}/api/v1/totp/disable",
        json={ "external_user_id": user_id },
        headers=HEADERS,
    )
    r.raise_for_status()
    return r.json()     # { status: 'disabled' }

from .services.totp import setup_user, verify_setup
from django.contrib.auth.decorators import login_required

@login_required
def setup_2fa_view(request):
    if request.method == 'POST':
        result = verify_setup(str(request.user.id), request.POST.get('otp_code', ''))
        if result.get('status') == 'enabled':
            # ⚠ recovery_codes shown only once — render immediately
            return render(request, '2fa/setup_complete.html', {
                'new_codes': result['recovery_codes'],
            })
        return render(request, '2fa/setup.html', {
            'qr': request.session.get('totp_qr'),
            'error': 'Invalid code, try again.',
        })

    # GET — generate QR code
    data = setup_user(str(request.user.id), request.user.email)
    request.session['totp_qr'] = data['qr_code_svg']
    return render(request, '2fa/setup.html', { 'qr': data['qr_code_svg'] })

from django.contrib.auth import authenticate, login, get_user_model
from .services.totp import verify_otp, check_status

def login_view(request):
    if request.method != 'POST':
        return render(request, 'login.html')

    user = authenticate(request,
        username=request.POST['email'],
        password=request.POST['password'],
    )
    if not user:
        return render(request, 'login.html', { 'error': 'Invalid credentials' })

    # Check 2FA status — user.id comes from server-side authenticate(), not from the request body
    if check_status(str(user.id)).get('two_factor_enabled'):
        request.session['pending_user_id'] = user.id
        return redirect('/auth/2fa/')

    login(request, user)
    return redirect('/dashboard/')

def otp_challenge(request):
    if request.method != 'POST':
        return render(request, 'otp_challenge.html')

    user_id  = request.session.get('pending_user_id')
    otp_code = request.POST.get('otp_code', '')
    if not user_id:
        return redirect('/auth/login/')

    if verify_otp(str(user_id), otp_code):
        login(request, get_user_model().objects.get(pk=user_id))
        del request.session['pending_user_id']
        return redirect('/dashboard/')

    return render(request, 'otp_challenge.html', { 'error': 'Invalid or expired code' })

from .services.totp import verify_recovery_code

def recovery_challenge(request):
    if request.method != 'POST':
        return render(request, 'recovery_challenge.html')

    user_id       = request.session.get('pending_user_id')
    recovery_code = request.POST.get('recovery_code', '')
    if not user_id:
        return redirect('/auth/login/')

    result = verify_recovery_code(str(user_id), recovery_code)
    if result.get('status') == 'verified':
        login(request, get_user_model().objects.get(pk=user_id))
        del request.session['pending_user_id']
        return redirect('/dashboard/')

    return render(request, 'recovery_challenge.html', { 'error': 'Invalid or already-used recovery code' })

from .services.totp import list_recovery_codes, regenerate_recovery_codes
from django.contrib.auth.decorators import login_required

@login_required
def recovery_codes_view(request):
    # GET — show masked codes
    result = list_recovery_codes(str(request.user.id))
    return render(request, 'recovery_codes.html', {
        'codes':     result['codes'],
        'remaining': result['recovery_codes_remaining'],
    })

@login_required
def regenerate_codes_view(request):
    if request.method != 'POST':
        return render(request, 'regenerate.html')

    otp_code = request.POST.get('otp_code', '')
    result   = regenerate_recovery_codes(str(request.user.id), otp_code)

    if result.get('status') == 'regenerated':
        return render(request, 'regenerate.html', {
            'new_codes': result['recovery_codes'],  # show once
        })

    return render(request, 'regenerate.html', { 'error': 'Invalid OTP — regeneration denied' })

from .services.totp import disable_totp
from django.contrib.auth.decorators import login_required

@login_required
def disable_2fa_view(request):
    if request.method != 'POST':
        return render(request, 'disable_2fa.html')

    disable_totp(str(request.user.id))
    return redirect('/settings/')