Add SMS 2FA to Your App
in Under an Hour

import { randomInt } from 'crypto';

// STEP 1 — Initiate 2FA after password check
export async function initiate2FA(userId, phone) {
  const code = String(randomInt(100000, 999999));
  
  // STEP 2 — Store with TTL and attempt counter
  await redis.set(
    `2fa:${userId}`,
    JSON.stringify({ code, attempts: 0 }),
    { EX: 600 }  // 10 minutes
  );

  // STEP 3 — Send via SMSPM
  const params = new URLSearchParams({
    hash: process.env.SMSPM_HASH,
    token: process.env.SMSPM_TOKEN,
    toNumber: phone,
    fromNumber: 'MyApp',
    text: `Your MyApp login code: ${code}. Valid 10 min.`
  });
  await fetch(`https://api.smspm.com?${params}`);
}

// STEP 4+5 — Verify the submitted code
export async function verify2FA(userId, submitted) {
  const raw = await redis.get(`2fa:${userId}`);
  if (!raw) return { ok: false, reason: 'expired' };
  
  const record = JSON.parse(raw);
  if (record.attempts >= 3)
    return { ok: false, reason: 'too_many_attempts' };
  
  if (submitted !== record.code) {
    record.attempts++;
    await redis.set(`2fa:${userId}`,
      JSON.stringify(record), { EX: 600 });
    return { ok: false, reason: 'wrong_code' };
  }
  
  await redis.del(`2fa:${userId}`); // consume
  return { ok: true };
}