first commit

calcom/apps/web/pages/api/auth/[...nextauth].tsx

@@ -0,0 +1,5 @@
+import NextAuth from "next-auth";
+
+import { AUTH_OPTIONS } from "@calcom/features/auth/lib/next-auth-options";
+
+export default NextAuth(AUTH_OPTIONS);

calcom/apps/web/pages/api/auth/changepw.ts

@@ -0,0 +1,70 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { ErrorCode } from "@calcom/features/auth/lib/ErrorCode";
+import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { hashPassword } from "@calcom/features/auth/lib/hashPassword";
+import { verifyPassword } from "@calcom/features/auth/lib/verifyPassword";
+import prisma from "@calcom/prisma";
+import { IdentityProvider } from "@calcom/prisma/enums";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const session = await getServerSession({ req, res });
+
+  if (!session || !session.user || !session.user.email) {
+    res.status(401).json({ message: "Not authenticated" });
+    return;
+  }
+
+  const user = await prisma.user.findFirst({
+    where: {
+      email: session.user.email,
+    },
+    select: {
+      id: true,
+      password: true,
+      identityProvider: true,
+    },
+  });
+
+  if (!user) {
+    res.status(404).json({ message: "User not found" });
+    return;
+  }
+
+  if (user.identityProvider !== IdentityProvider.CAL) {
+    return res.status(400).json({ error: ErrorCode.ThirdPartyIdentityProviderEnabled });
+  }
+
+  const oldPassword = req.body.oldPassword;
+  const newPassword = req.body.newPassword;
+
+  const currentPassword = user.password?.hash;
+  if (!currentPassword) {
+    return res.status(400).json({ error: ErrorCode.UserMissingPassword });
+  }
+
+  const passwordsMatch = await verifyPassword(oldPassword, currentPassword);
+  if (!passwordsMatch) {
+    return res.status(403).json({ error: ErrorCode.IncorrectPassword });
+  }
+
+  if (oldPassword === newPassword) {
+    return res.status(400).json({ error: ErrorCode.NewPasswordMatchesOld });
+  }
+
+  const hashedPassword = await hashPassword(newPassword);
+  await prisma.userPassword.upsert({
+    where: {
+      userId: user.id,
+    },
+    create: {
+      hash: hashedPassword,
+      userId: user.id,
+    },
+    update: {
+      hash: hashedPassword,
+    },
+  });
+
+  res.status(200).json({ message: "Password updated successfully" });
+}

calcom/apps/web/pages/api/auth/forgot-password.ts

@@ -0,0 +1,52 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { z } from "zod";
+
+import { passwordResetRequest } from "@calcom/features/auth/lib/passwordResetRequest";
+import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
+import { defaultHandler } from "@calcom/lib/server";
+import prisma from "@calcom/prisma";
+
+async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const email = z
+    .string()
+    .email()
+    .transform((val) => val.toLowerCase())
+    .safeParse(req.body?.email);
+
+  if (!email.success) {
+    return res.status(400).json({ message: "email is required" });
+  }
+
+  // fallback to email if ip is not present
+  let ip = (req.headers["x-real-ip"] as string) ?? email.data;
+
+  const forwardedFor = req.headers["x-forwarded-for"] as string;
+  if (!ip && forwardedFor) {
+    ip = forwardedFor?.split(",").at(0) ?? email.data;
+  }
+
+  // 10 requests per minute
+
+  await checkRateLimitAndThrowError({
+    rateLimitingType: "core",
+    identifier: ip,
+  });
+
+  try {
+    const user = await prisma.user.findUnique({
+      where: { email: email.data },
+      select: { name: true, email: true, locale: true },
+    });
+    // Don't leak info about whether the user exists
+    if (!user) return res.status(201).json({ message: "password_reset_email_sent" });
+    await passwordResetRequest(user);
+    return res.status(201).json({ message: "password_reset_email_sent" });
+  } catch (reason) {
+    console.error(reason);
+    return res.status(500).json({ message: "Unable to create password reset request" });
+  }
+}
+
+export default defaultHandler({
+  POST: Promise.resolve({ default: handler }),
+});

calcom/apps/web/pages/api/auth/oauth/me.ts

@@ -0,0 +1,14 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import isAuthorized from "@calcom/features/auth/lib/oAuthAuthorization";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const requiredScopes = ["READ_PROFILE"];
+
+  const account = await isAuthorized(req, requiredScopes);
+
+  if (!account) {
+    return res.status(401).json({ message: "Unauthorized" });
+  }
+  return res.status(201).json({ username: account.name });
+}

calcom/apps/web/pages/api/auth/oauth/refreshToken.ts

@@ -0,0 +1,69 @@
+import jwt from "jsonwebtoken";
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import prisma from "@calcom/prisma";
+import { generateSecret } from "@calcom/trpc/server/routers/viewer/oAuth/addClient.handler";
+import type { OAuthTokenPayload } from "@calcom/types/oauth";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "POST") {
+    res.status(405).json({ message: "Invalid method" });
+    return;
+  }
+
+  const refreshToken = req.headers.authorization?.split(" ")[1] || "";
+
+  const { client_id, client_secret, grant_type } = req.body;
+
+  if (grant_type !== "refresh_token") {
+    res.status(400).json({ message: "grant type invalid" });
+    return;
+  }
+
+  const [hashedSecret] = generateSecret(client_secret);
+
+  const client = await prisma.oAuthClient.findFirst({
+    where: {
+      clientId: client_id,
+      clientSecret: hashedSecret,
+    },
+    select: {
+      redirectUri: true,
+    },
+  });
+
+  if (!client) {
+    res.status(401).json({ message: "Unauthorized" });
+    return;
+  }
+
+  const secretKey = process.env.CALENDSO_ENCRYPTION_KEY || "";
+
+  let decodedRefreshToken: OAuthTokenPayload;
+
+  try {
+    decodedRefreshToken = jwt.verify(refreshToken, secretKey) as OAuthTokenPayload;
+  } catch {
+    res.status(401).json({ message: "Unauthorized" });
+    return;
+  }
+
+  if (!decodedRefreshToken || decodedRefreshToken.token_type !== "Refresh Token") {
+    res.status(401).json({ message: "Unauthorized" });
+    return;
+  }
+
+  const payload: OAuthTokenPayload = {
+    userId: decodedRefreshToken.userId,
+    teamId: decodedRefreshToken.teamId,
+    scope: decodedRefreshToken.scope,
+    token_type: "Access Token",
+    clientId: client_id,
+  };
+
+  const access_token = jwt.sign(payload, secretKey, {
+    expiresIn: 1800, // 30 min
+  });
+
+  res.status(200).json({ access_token });
+}

calcom/apps/web/pages/api/auth/oauth/token.ts

@@ -0,0 +1,97 @@
+import jwt from "jsonwebtoken";
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import prisma from "@calcom/prisma";
+import { generateSecret } from "@calcom/trpc/server/routers/viewer/oAuth/addClient.handler";
+import type { OAuthTokenPayload } from "@calcom/types/oauth";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "POST") {
+    res.status(405).json({ message: "Invalid method" });
+    return;
+  }
+
+  const { code, client_id, client_secret, grant_type, redirect_uri } = req.body;
+
+  if (grant_type !== "authorization_code") {
+    res.status(400).json({ message: "grant_type invalid" });
+    return;
+  }
+
+  const [hashedSecret] = generateSecret(client_secret);
+
+  const client = await prisma.oAuthClient.findFirst({
+    where: {
+      clientId: client_id,
+      clientSecret: hashedSecret,
+    },
+    select: {
+      redirectUri: true,
+    },
+  });
+
+  if (!client || client.redirectUri !== redirect_uri) {
+    res.status(401).json({ message: "Unauthorized" });
+    return;
+  }
+
+  const accessCode = await prisma.accessCode.findFirst({
+    where: {
+      code: code,
+      clientId: client_id,
+      expiresAt: {
+        gt: new Date(),
+      },
+    },
+  });
+
+  //delete all expired accessCodes + the one that is used here
+  await prisma.accessCode.deleteMany({
+    where: {
+      OR: [
+        {
+          expiresAt: {
+            lt: new Date(),
+          },
+        },
+        {
+          code: code,
+          clientId: client_id,
+        },
+      ],
+    },
+  });
+
+  if (!accessCode) {
+    res.status(401).json({ message: "Unauthorized" });
+    return;
+  }
+
+  const secretKey = process.env.CALENDSO_ENCRYPTION_KEY || "";
+
+  const payloadAuthToken: OAuthTokenPayload = {
+    userId: accessCode.userId,
+    teamId: accessCode.teamId,
+    scope: accessCode.scopes,
+    token_type: "Access Token",
+    clientId: client_id,
+  };
+
+  const payloadRefreshToken: OAuthTokenPayload = {
+    userId: accessCode.userId,
+    teamId: accessCode.teamId,
+    scope: accessCode.scopes,
+    token_type: "Refresh Token",
+    clientId: client_id,
+  };
+
+  const access_token = jwt.sign(payloadAuthToken, secretKey, {
+    expiresIn: 1800, // 30 min
+  });
+
+  const refresh_token = jwt.sign(payloadRefreshToken, secretKey, {
+    expiresIn: 30 * 24 * 60 * 60, // 30 days
+  });
+
+  res.status(200).json({ access_token, refresh_token });
+}

calcom/apps/web/pages/api/auth/oidc.ts

@@ -0,0 +1,36 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import jackson from "@calcom/features/ee/sso/lib/jackson";
+import { HttpError } from "@calcom/lib/http-error";
+
+// This is the callback endpoint for the OIDC provider
+// A team must set this endpoint in the OIDC provider's configuration
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "GET") {
+    return res.status(400).send("Method not allowed");
+  }
+
+  const { code, state } = req.query as {
+    code: string;
+    state: string;
+  };
+
+  const { oauthController } = await jackson();
+
+  try {
+    const { redirect_url } = await oauthController.oidcAuthzResponse({ code, state });
+
+    if (!redirect_url) {
+      throw new HttpError({
+        message: "No redirect URL found",
+        statusCode: 500,
+      });
+    }
+
+    return res.redirect(302, redirect_url);
+  } catch (err) {
+    const { message, statusCode = 500 } = err as HttpError;
+
+    return res.status(statusCode).send(message);
+  }
+}

calcom/apps/web/pages/api/auth/reset-password.ts

@@ -0,0 +1,75 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { z } from "zod";
+
+import { hashPassword } from "@calcom/features/auth/lib/hashPassword";
+import { validPassword } from "@calcom/features/auth/lib/validPassword";
+import prisma from "@calcom/prisma";
+import { IdentityProvider } from "@calcom/prisma/enums";
+
+const passwordResetRequestSchema = z.object({
+  password: z.string().refine(validPassword, () => ({
+    message: "Password does not meet the requirements",
+  })),
+  requestId: z.string(), // format doesn't matter.
+});
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  // Bad Method when not POST
+  if (req.method !== "POST") return res.status(405).end();
+
+  const { password: rawPassword, requestId: rawRequestId } = passwordResetRequestSchema.parse(req.body);
+  // rate-limited there is a low, very low chance that a password request stays valid long enough
+  // to brute force 3.8126967e+40 options.
+  const maybeRequest = await prisma.resetPasswordRequest.findFirstOrThrow({
+    where: {
+      id: rawRequestId,
+      expires: {
+        gt: new Date(),
+      },
+    },
+    select: {
+      email: true,
+    },
+  });
+
+  const hashedPassword = await hashPassword(rawPassword);
+  // this can fail if a password request has been made for an email that has since changed or-
+  // never existed within Cal. In this case we do not want to disclose the email's existence.
+  // instead, we just return 404
+  try {
+    await prisma.user.update({
+      where: {
+        email: maybeRequest.email,
+      },
+      data: {
+        password: {
+          upsert: {
+            create: { hash: hashedPassword },
+            update: { hash: hashedPassword },
+          },
+        },
+        emailVerified: new Date(),
+        identityProvider: IdentityProvider.CAL,
+        identityProviderId: null,
+      },
+    });
+  } catch (e) {
+    return res.status(404).end();
+  }
+
+  await expireResetPasswordRequest(rawRequestId);
+
+  return res.status(201).json({ message: "Password reset." });
+}
+
+async function expireResetPasswordRequest(rawRequestId: string) {
+  await prisma.resetPasswordRequest.update({
+    where: {
+      id: rawRequestId,
+    },
+    data: {
+      // We set the expiry to now to invalidate the request
+      expires: new Date(),
+    },
+  });
+}

calcom/apps/web/pages/api/auth/saml/authorize.ts

@@ -0,0 +1,23 @@
+import type { OAuthReq } from "@boxyhq/saml-jackson";
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import jackson from "@calcom/features/ee/sso/lib/jackson";
+import type { HttpError } from "@calcom/lib/http-error";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const { oauthController } = await jackson();
+
+  if (req.method !== "GET") {
+    return res.status(400).send("Method not allowed");
+  }
+
+  try {
+    const { redirect_url } = await oauthController.authorize(req.query as unknown as OAuthReq);
+
+    return res.redirect(302, redirect_url as string);
+  } catch (err) {
+    const { message, statusCode = 500 } = err as HttpError;
+
+    return res.status(statusCode).send(message);
+  }
+}

calcom/apps/web/pages/api/auth/saml/callback.ts

@@ -0,0 +1,18 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import jackson from "@calcom/features/ee/sso/lib/jackson";
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+async function postHandler(req: NextApiRequest, res: NextApiResponse) {
+  const { oauthController } = await jackson();
+
+  const { redirect_url } = await oauthController.samlResponse(req.body);
+
+  if (redirect_url) {
+    res.redirect(302, redirect_url);
+  }
+}
+
+export default defaultHandler({
+  POST: Promise.resolve({ default: defaultResponder(postHandler) }),
+});

calcom/apps/web/pages/api/auth/saml/token.ts

@@ -0,0 +1,13 @@
+import type { NextApiRequest } from "next";
+
+import jackson from "@calcom/features/ee/sso/lib/jackson";
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+async function postHandler(req: NextApiRequest) {
+  const { oauthController } = await jackson();
+  return await oauthController.token(req.body);
+}
+
+export default defaultHandler({
+  POST: Promise.resolve({ default: defaultResponder(postHandler) }),
+});

calcom/apps/web/pages/api/auth/saml/userinfo.ts

@@ -0,0 +1,34 @@
+import type { NextApiRequest } from "next";
+import z from "zod";
+
+import jackson from "@calcom/features/ee/sso/lib/jackson";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+
+const extractAuthToken = (req: NextApiRequest) => {
+  const authHeader = req.headers["authorization"];
+  const parts = (authHeader || "").split(" ");
+  if (parts.length > 1) return parts[1];
+
+  // check for query param
+  let arr: string[] = [];
+  const { access_token } = requestQuery.parse(req.query);
+  arr = arr.concat(access_token);
+  if (arr[0].length > 0) return arr[0];
+
+  throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+};
+
+const requestQuery = z.object({
+  access_token: z.string(),
+});
+
+async function getHandler(req: NextApiRequest) {
+  const { oauthController } = await jackson();
+  const token = extractAuthToken(req);
+  return await oauthController.userInfo(token);
+}
+
+export default defaultHandler({
+  GET: Promise.resolve({ default: defaultResponder(getHandler) }),
+});

calcom/apps/web/pages/api/auth/setup.ts

@@ -0,0 +1,58 @@
+import type { NextApiRequest } from "next";
+import z from "zod";
+
+import { hashPassword } from "@calcom/features/auth/lib/hashPassword";
+import { isPasswordValid } from "@calcom/features/auth/lib/isPasswordValid";
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultHandler, defaultResponder } from "@calcom/lib/server";
+import slugify from "@calcom/lib/slugify";
+import prisma from "@calcom/prisma";
+import { IdentityProvider } from "@calcom/prisma/enums";
+
+const querySchema = z.object({
+  username: z
+    .string()
+    .refine((val) => val.trim().length >= 1, { message: "Please enter at least one character" }),
+  full_name: z.string().min(3, "Please enter at least 3 characters"),
+  email_address: z.string().email({ message: "Please enter a valid email" }),
+  password: z.string().refine((val) => isPasswordValid(val.trim(), false, true), {
+    message:
+      "The password must be a minimum of 15 characters long containing at least one number and have a mixture of uppercase and lowercase letters",
+  }),
+});
+
+async function handler(req: NextApiRequest) {
+  const userCount = await prisma.user.count();
+  if (userCount !== 0) {
+    throw new HttpError({ statusCode: 400, message: "No setup needed." });
+  }
+
+  const parsedQuery = querySchema.safeParse(req.body);
+  if (!parsedQuery.success) {
+    throw new HttpError({ statusCode: 422, message: parsedQuery.error.message });
+  }
+
+  const username = slugify(parsedQuery.data.username.trim());
+  const userEmail = parsedQuery.data.email_address.toLowerCase();
+
+  const hashedPassword = await hashPassword(parsedQuery.data.password);
+
+  await prisma.user.create({
+    data: {
+      username,
+      email: userEmail,
+      password: { create: { hash: hashedPassword } },
+      role: "ADMIN",
+      name: parsedQuery.data.full_name,
+      emailVerified: new Date(),
+      locale: "en", // TODO: We should revisit this
+      identityProvider: IdentityProvider.CAL,
+    },
+  });
+
+  return { message: "First admin user created successfully." };
+}
+
+export default defaultHandler({
+  POST: Promise.resolve({ default: defaultResponder(handler) }),
+});

calcom/apps/web/pages/api/auth/signup.ts

@@ -0,0 +1,71 @@
+import type { NextApiResponse } from "next";
+
+import calcomSignupHandler from "@calcom/feature-auth/signup/handlers/calcomHandler";
+import selfHostedSignupHandler from "@calcom/feature-auth/signup/handlers/selfHostedHandler";
+import { type RequestWithUsernameStatus } from "@calcom/features/auth/signup/username";
+import { IS_PREMIUM_USERNAME_ENABLED } from "@calcom/lib/constants";
+import getIP from "@calcom/lib/getIP";
+import { HttpError } from "@calcom/lib/http-error";
+import logger from "@calcom/lib/logger";
+import { checkCfTurnstileToken } from "@calcom/lib/server/checkCfTurnstileToken";
+import { signupSchema } from "@calcom/prisma/zod-utils";
+
+function ensureSignupIsEnabled(req: RequestWithUsernameStatus) {
+  const { token } = signupSchema
+    .pick({
+      token: true,
+    })
+    .parse(req.body);
+
+  // Stil allow signups if there is a team invite
+  if (token) return;
+
+  if (process.env.NEXT_PUBLIC_DISABLE_SIGNUP === "true") {
+    throw new HttpError({
+      statusCode: 403,
+      message: "Signup is disabled",
+    });
+  }
+}
+
+function ensureReqIsPost(req: RequestWithUsernameStatus) {
+  if (req.method !== "POST") {
+    throw new HttpError({
+      statusCode: 405,
+      message: "Method not allowed",
+    });
+  }
+}
+
+export default async function handler(req: RequestWithUsernameStatus, res: NextApiResponse) {
+  const remoteIp = getIP(req);
+  // Use a try catch instead of returning res every time
+  try {
+    await checkCfTurnstileToken({
+      token: req.headers["cf-access-token"] as string,
+      remoteIp,
+    });
+
+    ensureReqIsPost(req);
+    ensureSignupIsEnabled(req);
+
+    /**
+     * Im not sure its worth merging these two handlers. They are different enough to be separate.
+     * Calcom handles things like creating a stripe customer - which we don't need to do for self hosted.
+     * It also handles things like premium username.
+     * TODO: (SEAN) - Extract a lot of the logic from calcomHandler into a separate file and import it into both handlers.
+     * @zomars: We need to be able to test this with E2E. They way it's done RN it will never run on CI.
+     */
+    if (IS_PREMIUM_USERNAME_ENABLED) {
+      return await calcomSignupHandler(req, res);
+    }
+
+    return await selfHostedSignupHandler(req, res);
+  } catch (e) {
+    if (e instanceof HttpError) {
+      return res.status(e.statusCode).json({ message: e.message });
+    }
+    logger.error(e);
+    return res.status(500).json({ message: "Internal server error" });
+  }
+}

calcom/apps/web/pages/api/auth/two-factor/totp/disable.ts

@@ -0,0 +1,114 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { ErrorCode } from "@calcom/features/auth/lib/ErrorCode";
+import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { verifyPassword } from "@calcom/features/auth/lib/verifyPassword";
+import { symmetricDecrypt } from "@calcom/lib/crypto";
+import { totpAuthenticatorCheck } from "@calcom/lib/totp";
+import prisma from "@calcom/prisma";
+import { IdentityProvider } from "@calcom/prisma/client";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "POST") {
+    return res.status(405).json({ message: "Method not allowed" });
+  }
+
+  const session = await getServerSession({ req, res });
+  if (!session) {
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (!session.user?.id) {
+    console.error("Session is missing a user id.");
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const user = await prisma.user.findUnique({ where: { id: session.user.id }, include: { password: true } });
+  if (!user) {
+    console.error(`Session references user that no longer exists.`);
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (!user.password?.hash && user.identityProvider === IdentityProvider.CAL) {
+    return res.status(400).json({ error: ErrorCode.UserMissingPassword });
+  }
+
+  if (!user.twoFactorEnabled) {
+    return res.json({ message: "Two factor disabled" });
+  }
+
+  if (user.password?.hash && user.identityProvider === IdentityProvider.CAL) {
+    const isCorrectPassword = await verifyPassword(req.body.password, user.password.hash);
+    if (!isCorrectPassword) {
+      return res.status(400).json({ error: ErrorCode.IncorrectPassword });
+    }
+  }
+
+  // if user has 2fa and using backup code
+  if (user.twoFactorEnabled && req.body.backupCode) {
+    if (!process.env.CALENDSO_ENCRYPTION_KEY) {
+      console.error("Missing encryption key; cannot proceed with backup code login.");
+      throw new Error(ErrorCode.InternalServerError);
+    }
+
+    if (!user.backupCodes) {
+      return res.status(400).json({ error: ErrorCode.MissingBackupCodes });
+    }
+
+    const backupCodes = JSON.parse(symmetricDecrypt(user.backupCodes, process.env.CALENDSO_ENCRYPTION_KEY));
+
+    // check if user-supplied code matches one
+    const index = backupCodes.indexOf(req.body.backupCode.replaceAll("-", ""));
+    if (index === -1) {
+      return res.status(400).json({ error: ErrorCode.IncorrectBackupCode });
+    }
+
+    // we delete all stored backup codes at the end, no need to do this here
+
+    // if user has 2fa and NOT using backup code, try totp
+  } else if (user.twoFactorEnabled) {
+    if (!req.body.code) {
+      return res.status(400).json({ error: ErrorCode.SecondFactorRequired });
+      // throw new Error(ErrorCode.SecondFactorRequired);
+    }
+
+    if (!user.twoFactorSecret) {
+      console.error(`Two factor is enabled for user ${user.id} but they have no secret`);
+      throw new Error(ErrorCode.InternalServerError);
+    }
+
+    if (!process.env.CALENDSO_ENCRYPTION_KEY) {
+      console.error(`"Missing encryption key; cannot proceed with two factor login."`);
+      throw new Error(ErrorCode.InternalServerError);
+    }
+
+    const secret = symmetricDecrypt(user.twoFactorSecret, process.env.CALENDSO_ENCRYPTION_KEY);
+    if (secret.length !== 32) {
+      console.error(
+        `Two factor secret decryption failed. Expected key with length 32 but got ${secret.length}`
+      );
+      throw new Error(ErrorCode.InternalServerError);
+    }
+
+    // If user has 2fa enabled, check if body.code is correct
+    const isValidToken = totpAuthenticatorCheck(req.body.code, secret);
+    if (!isValidToken) {
+      return res.status(400).json({ error: ErrorCode.IncorrectTwoFactorCode });
+
+      // throw new Error(ErrorCode.IncorrectTwoFactorCode);
+    }
+  }
+  // If it is, disable users 2fa
+  await prisma.user.update({
+    where: {
+      id: session.user.id,
+    },
+    data: {
+      backupCodes: null,
+      twoFactorEnabled: false,
+      twoFactorSecret: null,
+    },
+  });
+
+  return res.json({ message: "Two factor disabled" });
+}

calcom/apps/web/pages/api/auth/two-factor/totp/enable.ts

@@ -0,0 +1,66 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { ErrorCode } from "@calcom/features/auth/lib/ErrorCode";
+import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { symmetricDecrypt } from "@calcom/lib/crypto";
+import { totpAuthenticatorCheck } from "@calcom/lib/totp";
+import prisma from "@calcom/prisma";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "POST") {
+    return res.status(405).json({ message: "Method not allowed" });
+  }
+
+  const session = await getServerSession({ req, res });
+  if (!session) {
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (!session.user?.id) {
+    console.error("Session is missing a user id.");
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const user = await prisma.user.findUnique({ where: { id: session.user.id } });
+  if (!user) {
+    console.error(`Session references user that no longer exists.`);
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (user.twoFactorEnabled) {
+    return res.status(400).json({ error: ErrorCode.TwoFactorAlreadyEnabled });
+  }
+
+  if (!user.twoFactorSecret) {
+    return res.status(400).json({ error: ErrorCode.TwoFactorSetupRequired });
+  }
+
+  if (!process.env.CALENDSO_ENCRYPTION_KEY) {
+    console.error("Missing encryption key; cannot proceed with two factor setup.");
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const secret = symmetricDecrypt(user.twoFactorSecret, process.env.CALENDSO_ENCRYPTION_KEY);
+  if (secret.length !== 32) {
+    console.error(
+      `Two factor secret decryption failed. Expected key with length 32 but got ${secret.length}`
+    );
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const isValidToken = totpAuthenticatorCheck(req.body.code, secret);
+  if (!isValidToken) {
+    return res.status(400).json({ error: ErrorCode.IncorrectTwoFactorCode });
+  }
+
+  await prisma.user.update({
+    where: {
+      id: session.user.id,
+    },
+    data: {
+      twoFactorEnabled: true,
+    },
+  });
+
+  return res.json({ message: "Two-factor enabled" });
+}

calcom/apps/web/pages/api/auth/two-factor/totp/setup.ts

@@ -0,0 +1,79 @@
+import crypto from "crypto";
+import type { NextApiRequest, NextApiResponse } from "next";
+import { authenticator } from "otplib";
+import qrcode from "qrcode";
+
+import { ErrorCode } from "@calcom/features/auth/lib/ErrorCode";
+import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { verifyPassword } from "@calcom/features/auth/lib/verifyPassword";
+import { symmetricEncrypt } from "@calcom/lib/crypto";
+import prisma from "@calcom/prisma";
+import { IdentityProvider } from "@calcom/prisma/enums";
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method !== "POST") {
+    return res.status(405).json({ message: "Method not allowed" });
+  }
+
+  const session = await getServerSession({ req, res });
+  if (!session) {
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (!session.user?.id) {
+    console.error("Session is missing a user id.");
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const user = await prisma.user.findUnique({ where: { id: session.user.id }, include: { password: true } });
+  if (!user) {
+    console.error(`Session references user that no longer exists.`);
+    return res.status(401).json({ message: "Not authenticated" });
+  }
+
+  if (user.identityProvider !== IdentityProvider.CAL && !user.password?.hash) {
+    return res.status(400).json({ error: ErrorCode.ThirdPartyIdentityProviderEnabled });
+  }
+
+  if (!user.password?.hash) {
+    return res.status(400).json({ error: ErrorCode.UserMissingPassword });
+  }
+
+  if (user.twoFactorEnabled) {
+    return res.status(400).json({ error: ErrorCode.TwoFactorAlreadyEnabled });
+  }
+
+  if (!process.env.CALENDSO_ENCRYPTION_KEY) {
+    console.error("Missing encryption key; cannot proceed with two factor setup.");
+    return res.status(500).json({ error: ErrorCode.InternalServerError });
+  }
+
+  const isCorrectPassword = await verifyPassword(req.body.password, user.password.hash);
+  if (!isCorrectPassword) {
+    return res.status(400).json({ error: ErrorCode.IncorrectPassword });
+  }
+
+  // This generates a secret 32 characters in length. Do not modify the number of
+  // bytes without updating the sanity checks in the enable and login endpoints.
+  const secret = authenticator.generateSecret(20);
+
+  // generate backup codes with 10 character length
+  const backupCodes = Array.from(Array(10), () => crypto.randomBytes(5).toString("hex"));
+
+  await prisma.user.update({
+    where: {
+      id: session.user.id,
+    },
+    data: {
+      backupCodes: symmetricEncrypt(JSON.stringify(backupCodes), process.env.CALENDSO_ENCRYPTION_KEY),
+      twoFactorEnabled: false,
+      twoFactorSecret: symmetricEncrypt(secret, process.env.CALENDSO_ENCRYPTION_KEY),
+    },
+  });
+
+  const name = user.email || user.username || user.id.toString();
+  const keyUri = authenticator.keyuri(name, "Cal", secret);
+  const dataUri = await qrcode.toDataURL(keyUri);
+
+  return res.json({ secret, keyUri, dataUri, backupCodes });
+}

calcom/apps/web/pages/api/auth/verify-email.test.ts

@@ -0,0 +1,82 @@
+import { organizationScenarios } from "@calcom/lib/server/repository/__mocks__/organization";
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+import { MembershipRole } from "@calcom/prisma/client";
+import { inviteMembersWithNoInviterPermissionCheck } from "@calcom/trpc/server/routers/viewer/teams/inviteMember/inviteMember.handler";
+
+import { moveUserToMatchingOrg } from "./verify-email";
+
+vi.mock("@calcom/trpc/server/routers/viewer/teams/inviteMember/inviteMember.handler");
+vi.mock("@calcom/lib/server/repository/organization");
+
+describe("moveUserToMatchingOrg", () => {
+  const email = "test@example.com";
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+  });
+
+  it("should not proceed if no matching organization is found", async () => {
+    organizationScenarios.OrganizationRepository.findUniqueByMatchingAutoAcceptEmail.fakeNoMatch();
+
+    await moveUserToMatchingOrg({ email });
+
+    expect(inviteMembersWithNoInviterPermissionCheck).not.toHaveBeenCalled();
+  });
+
+  describe("should invite user to the matching organization", () => {
+    const argToInviteMembersWithNoInviterPermissionCheck = {
+      inviterName: null,
+      language: "en",
+      invitations: [
+        {
+          usernameOrEmail: email,
+          role: MembershipRole.MEMBER,
+        },
+      ],
+    };
+
+    it("when organization has a slug and requestedSlug(slug is used)", async () => {
+      const org = {
+        id: "org123",
+        slug: "test-org",
+        requestedSlug: "requested-test-org",
+      };
+
+      organizationScenarios.OrganizationRepository.findUniqueByMatchingAutoAcceptEmail.fakeReturnOrganization(
+        org,
+        { email }
+      );
+
+      await moveUserToMatchingOrg({ email });
+
+      expect(inviteMembersWithNoInviterPermissionCheck).toHaveBeenCalledWith({
+        ...argToInviteMembersWithNoInviterPermissionCheck,
+        teamId: org.id,
+        orgSlug: org.slug,
+      });
+    });
+
+    it("when organization has requestedSlug only", async () => {
+      const org = {
+        id: "org123",
+        slug: null,
+        requestedSlug: "requested-test-org",
+      };
+
+      organizationScenarios.OrganizationRepository.findUniqueByMatchingAutoAcceptEmail.fakeReturnOrganization(
+        org,
+        { email }
+      );
+
+      await moveUserToMatchingOrg({ email });
+
+      expect(inviteMembersWithNoInviterPermissionCheck).toHaveBeenCalledWith({
+        ...argToInviteMembersWithNoInviterPermissionCheck,
+        teamId: org.id,
+        orgSlug: org.requestedSlug,
+      });
+    });
+  });
+});

calcom/apps/web/pages/api/auth/verify-email.ts

@@ -0,0 +1,181 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { z } from "zod";
+
+import stripe from "@calcom/app-store/stripepayment/lib/server";
+import dayjs from "@calcom/dayjs";
+import { WEBAPP_URL } from "@calcom/lib/constants";
+import { IS_STRIPE_ENABLED } from "@calcom/lib/constants";
+import { OrganizationRepository } from "@calcom/lib/server/repository/organization";
+import { prisma } from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/client";
+import { userMetadata } from "@calcom/prisma/zod-utils";
+import { inviteMembersWithNoInviterPermissionCheck } from "@calcom/trpc/server/routers/viewer/teams/inviteMember/inviteMember.handler";
+
+const verifySchema = z.object({
+  token: z.string(),
+});
+
+const USER_ALREADY_EXISTING_MESSAGE = "A User already exists with this email";
+
+// TODO: To be unit tested
+export async function moveUserToMatchingOrg({ email }: { email: string }) {
+  const org = await OrganizationRepository.findUniqueByMatchingAutoAcceptEmail({ email });
+
+  if (!org) {
+    return;
+  }
+
+  await inviteMembersWithNoInviterPermissionCheck({
+    inviterName: null,
+    teamId: org.id,
+    language: "en",
+    invitations: [
+      {
+        usernameOrEmail: email,
+        role: MembershipRole.MEMBER,
+      },
+    ],
+    orgSlug: org.slug || org.requestedSlug,
+  });
+}
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const { token } = verifySchema.parse(req.query);
+
+  const foundToken = await prisma.verificationToken.findFirst({
+    where: {
+      token,
+    },
+  });
+
+  if (!foundToken) {
+    return res.status(401).json({ message: "No token found" });
+  }
+
+  if (dayjs(foundToken?.expires).isBefore(dayjs())) {
+    return res.status(401).json({ message: "Token expired" });
+  }
+
+  // The user is verifying the secondary email
+  if (foundToken?.secondaryEmailId) {
+    await prisma.secondaryEmail.update({
+      where: {
+        id: foundToken.secondaryEmailId,
+        email: foundToken?.identifier,
+      },
+      data: {
+        emailVerified: new Date(),
+      },
+    });
+
+    await cleanUpVerificationTokens(foundToken.id);
+
+    return res.redirect(`${WEBAPP_URL}/settings/my-account/profile`);
+  }
+
+  const user = await prisma.user.findFirst({
+    where: {
+      email: foundToken?.identifier,
+    },
+  });
+
+  if (!user) {
+    return res.status(401).json({ message: "Cannot find a user attached to this token" });
+  }
+
+  const userMetadataParsed = userMetadata.parse(user.metadata);
+  // Attach the new email and verify
+  if (userMetadataParsed?.emailChangeWaitingForVerification) {
+    // Ensure this email isnt in use
+    const existingUser = await prisma.user.findUnique({
+      where: { email: userMetadataParsed?.emailChangeWaitingForVerification },
+      select: {
+        id: true,
+      },
+    });
+    if (existingUser) {
+      return res.status(401).json({ message: USER_ALREADY_EXISTING_MESSAGE });
+    }
+
+    // Ensure this email isn't being added by another user as secondary email
+    const existingSecondaryUser = await prisma.secondaryEmail.findUnique({
+      where: {
+        email: userMetadataParsed?.emailChangeWaitingForVerification,
+      },
+      select: {
+        id: true,
+        userId: true,
+      },
+    });
+
+    if (existingSecondaryUser && existingSecondaryUser.userId !== user.id) {
+      return res.status(401).json({ message: USER_ALREADY_EXISTING_MESSAGE });
+    }
+
+    const oldEmail = user.email;
+    const updatedEmail = userMetadataParsed.emailChangeWaitingForVerification;
+    delete userMetadataParsed.emailChangeWaitingForVerification;
+
+    // Update and re-verify
+    await prisma.user.update({
+      where: {
+        id: user.id,
+      },
+      data: {
+        email: updatedEmail,
+        metadata: userMetadataParsed,
+      },
+    });
+
+    if (IS_STRIPE_ENABLED && userMetadataParsed.stripeCustomerId) {
+      await stripe.customers.update(userMetadataParsed.stripeCustomerId, {
+        email: updatedEmail,
+      });
+    }
+
+    // The user is trying to update the email to an already existing unverified secondary email of his
+    // so we swap the emails and its verified status
+    if (existingSecondaryUser?.userId === user.id) {
+      await prisma.secondaryEmail.update({
+        where: {
+          id: existingSecondaryUser.id,
+          userId: user.id,
+        },
+        data: {
+          email: oldEmail,
+          emailVerified: user.emailVerified,
+        },
+      });
+    }
+
+    await cleanUpVerificationTokens(foundToken.id);
+
+    return res.status(200).json({
+      updatedEmail,
+    });
+  }
+
+  await prisma.user.update({
+    where: {
+      id: user.id,
+    },
+    data: {
+      emailVerified: new Date(),
+    },
+  });
+
+  const hasCompletedOnboarding = user.completedOnboarding;
+
+  await moveUserToMatchingOrg({ email: user.email });
+
+  return res.redirect(`${WEBAPP_URL}/${hasCompletedOnboarding ? "/event-types" : "/getting-started"}`);
+}
+
+export async function cleanUpVerificationTokens(id: number) {
+  // Delete token from DB after it has been used
+  await prisma.verificationToken.delete({
+    where: {
+      id,
+    },
+  });
+}