Push Notification Authentication — 2FA via Push Notifications

const admin = require('firebase-admin');

// Initialize push auth service
class PushAuthService {
  constructor() {
    this.pendingAuths = new Map();
    admin.initializeApp({ credential: admin.credential.applicationDefault() });
  }

  async sendPushAuth(userId, authRequest) {
    const authId = crypto.randomUUID();
    const deviceToken = await this.getUserDeviceToken(userId);

    const message = {
      token: deviceToken,
      notification: {
        title: 'Approve Sign-In',
        body: `${authRequest.location} - ${authRequest.device}`
      },
      data: {
        type: 'auth_request',
        authId,
        timestamp: Date.now().toString(),
        ip: authRequest.ip,
        location: authRequest.location
      },
      android: { priority: 'high', ttl: 120000 },
      apns: { headers: { 'apns-priority': '10' } }
    };

    await admin.messaging().send(message);

    this.pendingAuths.set(authId, {
      userId,
      status: 'pending',
      createdAt: Date.now(),
      expiresAt: Date.now() + 120000
    });

    return authId;
  }

  async handlePushResponse(authId, approved) {
    const auth = this.pendingAuths.get(authId);
    if (!auth || auth.expiresAt < Date.now()) {
      return { success: false, error: 'expired' };
    }

    auth.status = approved ? 'approved' : 'denied';
    return { success: true, approved };
  }

  async pollAuthStatus(authId, timeout = 120000) {
    const start = Date.now();
    while (Date.now() - start < timeout) {
      const auth = this.pendingAuths.get(authId);
      if (!auth) return { status: 'not_found' };
      if (auth.status !== 'pending') return { status: auth.status };
      await delay(1000);
    }
    return { status: 'timeout' };
  }
}