upgrade to @epic-web/totp

app/routes/resources+/verify.tsx

@@ -7,7 +7,7 @@ import { ErrorList, Field } from '~/components/forms.tsx'
 import { StatusButton } from '~/components/ui/status-button.tsx'
 import { prisma } from '~/utils/db.server.ts'
 import { EnsurePE, getDomainUrl, useIsSubmitting } from '~/utils/misc.tsx'
-import { generateTOTP, verifyTOTP } from '~/utils/totp.server.ts'
+import { generateTOTP, verifyTOTP } from '@epic-web/totp'
 import { handleVerification as handleForgotPasswordVerification } from '../_auth+/forgot-password/index.tsx'
 import { handleVerification as handleOnboardingVerification } from '../_auth+/onboarding.tsx'
 import { handleVerification as handleChangeEmailVerification } from '../settings+/profile.change-email.index/index.tsx'

app/routes/settings+/profile.two-factor.index.tsx

@@ -4,7 +4,7 @@ import { Icon } from '~/components/ui/icon.tsx'
 import { StatusButton } from '~/components/ui/status-button.tsx'
 import { requireUserId } from '~/utils/auth.server.ts'
 import { prisma } from '~/utils/db.server.ts'
-import { generateTOTP } from '~/utils/totp.server.ts'
+import { generateTOTP } from '@epic-web/totp'
 import { shouldRequestTwoFA } from '../resources+/login.tsx'
 import { twoFAVerificationType } from './profile.two-factor.tsx'
 import { verificationType as verifyVerificationType } from './profile.two-factor.verify.tsx'

app/routes/settings+/profile.two-factor.verify.tsx

@@ -6,7 +6,7 @@ import { StatusButton } from '~/components/ui/status-button.tsx'
 import { requireUserId } from '~/utils/auth.server.ts'
 import { prisma } from '~/utils/db.server.ts'
 import { getDomainUrl, invariant, invariantResponse } from '~/utils/misc.tsx'
-import { getTOTPAuthUri } from '~/utils/totp.server.ts'
+import { getTOTPAuthUri } from '@epic-web/totp'
 import { useUser } from '~/utils/user.ts'
 import {
 	type VerificationTypes,

docs/decisions/014-totp.md

@@ -102,7 +102,8 @@ to implement 2FA which we'll do in the future. This also allows us to remove the
 `ENCRIPTION_SECRET` from the list of environment variables you need to manage.
 And we can swap the `encryption.server.ts` utility for a `totp.server.ts`
 utility which, while not simpler is a fair trade (and could definitely be
-developed and externalized into an open source library).
+developed and externalized into an open source library). **Update:** This has
+now been published as [@epic-web/totp](https://npm.im/@epic-web/totp).
 
 This also means we now need a new table in the database. This can be designed in
 such a way that there's no migration cost and it's purely additive.

package.json

@@ -40,6 +40,7 @@
   "dependencies": {
     "@conform-to/react": "^0.7.4",
     "@conform-to/zod": "^0.7.4",
+    "@epic-web/totp": "^1.0.2",
     "@prisma/client": "^5.0.0",
     "@radix-ui/react-checkbox": "^1.0.4",
     "@radix-ui/react-dropdown-menu": "^2.0.5",
@@ -73,6 +74,7 @@
     "eslint-plugin-remix-react-routes": "^1.0.5",
     "execa": "^7.1.1",
     "express": "^4.18.2",
+    "express-rate-limit": "^6.8.1",
     "get-port": "^7.0.0",
     "helmet": "^7.0.0",
     "intl-parse-accept-language": "^1.0.0",