SudoSOS Back-end API / authentication / QRAuthenticator

Class: QRAuthenticator

The QR Authenticator enables QR code-based authentication in SudoSOS. This authentication method allows users to authenticate by scanning a QR code with their mobile device, providing a convenient and secure authentication flow.

QR Authentication is a session-based authentication method. It creates temporary sessions that can be confirmed by authenticated users, allowing for secure authentication flows without requiring direct credential input.

QR Authentication Flow

1. Client requests a QR code via /authentication/qr/generate.
2. QR Service creates a QRAuthenticator with a unique session ID and expiration time.
3. Client displays the QR code to the user.
4. User scans the QR code with their mobile device.
5. Mobile App opens the confirmation URL with the session ID.
6. Authenticated User confirms the session via /authentication/qr/{sessionId}/confirm.
7. System generates a JWT token and notifies the original client via WebSocket.

Session States

• PENDING: Session is waiting for user confirmation
• CONFIRMED: Session has been confirmed by an authenticated user
• EXPIRED: Session has exceeded its expiration time
• CANCELLED: Session was explicitly cancelled

Security Features

• Sessions have a configurable expiration time (default: 5 minutes)
• Each session has a unique UUID that cannot be guessed
• Sessions can be cancelled to prevent unauthorized access
• JWT tokens are only delivered via WebSocket, making them difficult to intercept

Extends

• BaseEntityWithoutId

Constructors

Constructor

new QRAuthenticator(): QRAuthenticator;

Returns

QRAuthenticator

Overrides

BaseEntityWithoutId.constructor

Properties

Property	Modifier	Type	Description	Inherited from
cancelled	public	boolean	-	-
confirmedAt	public	Date	When the session was confirmed	-
createdAt	readonly	Date	The creation date of the object.	BaseEntityWithoutId.createdAt
expiresAt	public	Date	-	-
sessionId	public	string	-	-
updatedAt	readonly	Date	The last update date of the object.	BaseEntityWithoutId.updatedAt
user	public	User	The user that confirmed the session (null if pending)	-
version	readonly	number	The current version of the object.	BaseEntityWithoutId.version

Accessors

status

Get Signature

get status(): QRAuthenticatorStatus;

Returns

QRAuthenticatorStatus

Methods

response()

response(): QRCodeResponse;

Returns

QRCodeResponse