wip

[vpomerleau]

Because:

• We want to hook up the BackupCodeManager to the front end

This commit:

• Add new /recoveryCodes/exists route
• Add new handler method that uses the BackupCodeManager to retrieve the count of remaining codes
• Add backup codes to account resolver
• Update fxa-settings account model to include backup codes count

Closes #FXA-10231

Because

This pull request

Issue that this pull request solves

Closes: # (issue number)

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[vbudhram]

@vpomerleau I think this might be the first time we have used libs in the auth-server that uses the database. Below is a patch that loads the settings page with the additional details

diff --git a/packages/fxa-auth-server/lib/routes/recovery-codes.js b/packages/fxa-auth-server/lib/routes/recovery-codes.js
index b06dd9d515..4ba74c5d5f 100644
--- a/packages/fxa-auth-server/lib/routes/recovery-codes.js
+++ b/packages/fxa-auth-server/lib/routes/recovery-codes.js
@@ -4,6 +4,8 @@
 
 'use strict';
 
+import { AppConfig } from '../types';
+
 const errors = require('../error');
 const isA = require('joi');
 const validators = require('./validators');
@@ -12,7 +14,8 @@ const RECOVERY_CODES_DOCS =
   require('../../docs/swagger/recovery-codes-api').default;
 const {
   BackupCodeManager,
-} = require('../../../../libs/accounts/two-factor/src/');
+} = require('@fxa/accounts/two-factor');
+import { setupAccountDatabase } from '@fxa/shared/db/mysql/account';
 
 const RECOVERY_CODE_SANE_MAX_LENGTH = 20;
 
@@ -20,7 +23,15 @@ module.exports = (log, db, config, customs, mailer, glean) => {
   const codeConfig = config.recoveryCodes;
   const RECOVERY_CODE_COUNT = (codeConfig && codeConfig.count) || 8;
 
-  const backupCodeManager = Container.get(BackupCodeManager);
+  let backupCodeManager;
+  (async () => {
+    const appConfig = Container.get(AppConfig);
+    const kyselyDb = await setupAccountDatabase(appConfig.database.mysql.auth);
+    if (!Container.has(BackupCodeManager)) {
+      Container.set(BackupCodeManager, new BackupCodeManager(kyselyDb));
+    }
+    backupCodeManager = Container.get(BackupCodeManager);
+  })();
 
   // Validate backup authentication codes
   const recoveryCodesSchema = validators.recoveryCodes(
@@ -146,11 +157,11 @@ module.exports = (log, db, config, customs, mailer, glean) => {
       async handler(request) {
         log.begin('checkRecoveryCodesExist', request);
 
-        const { sessionToken, uid } = request.auth.credentials;
+        const { email, uid } = request.auth.credentials;
 
         await customs.check(
           request,
-          sessionToken.email,
+          email,
           'checkRecoveryCodesExist'
         );
 

We could probably improve this code a bit.

[vbudhram]

I would be hesistant to introduce a new term. These are technically recoveryCodes.

[vpomerleau]

I wasn't certain here since in the libs and in the ux we call them backup codes...

[vbudhram]

The credentials object is the sessionToken. You could do something like this

const { email, uid } = request.auth.credentials;

[vpomerleau]

@vbudhram This is proving difficult to mock for tests, wondering if there might be a better way to set this up 🤔