TwoFAContext

interface TwoFAState {
  isEnabled: boolean;
  primaryMethod: 'totp' | 'webauthn' | null;
  totp: {
    enabled: boolean;
    configuredAt: string | null;
  };
  webauthn: {
    enabled: boolean;
    credentials: WebAuthnCredential[];
  };
  backupCodes: {
    remaining: number;
    generatedAt: string | null;
  };
  loading: boolean;
  error: string | null;
}

// Actions
type TwoFAAction =
  | { type: 'SET_STATUS'; payload: TwoFAStatus }
  | { type: 'TOTP_ENABLED' }
  | { type: 'TOTP_DISABLED' }
  | { type: 'PASSKEY_ADDED'; payload: WebAuthnCredential }
  | { type: 'PASSKEY_REMOVED'; payload: string }
  | { type: 'BACKUP_CODES_REGENERATED'; payload: number }
  | { type: 'SET_LOADING'; payload: boolean }
  | { type: 'SET_ERROR'; payload: string | null };

// Provider wraps entire app — populated on login
// Refreshed via GET /2fa/status on each settings screen visit

Login Flow State (in AuthContext)

interface LoginState {
  step: 'credentials' | '2fa_required' | '2fa_input' | 'authenticated';
  tempToken: string | null;
  requires2FA: boolean;
  availableMethods: ('totp' | 'webauthn' | 'backup')[];
  selectedMethod: string | null;
  attemptsRemaining: number;
  lockoutUntil: number | null;  // Unix timestamp
}

otpauth:// URI Format

otpauth://totp/eToro:user@email.com?secret=JBSWY3DPEHPK3PXP&issuer=eToro&algorithm=SHA1&digits=6&period=30

The app registers as a handler for otpauth:// URIs. When a user taps the URI (e.g., from an email), the app opens directly to the TOTP verification step.

App Deep Links

react-native-keychain Usage

import * as Keychain from 'react-native-keychain';

// Store 2FA preference securely
await Keychain.setGenericPassword(
  'twofa_preference',
  JSON.stringify({ method: 'webauthn', skipUntil: Date.now() + 30 * 86400000 }),
  { service: 'com.etoro.plus.2fa', accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_ANY }
);

// Check if biometric is available
const biometryType = await Keychain.getSupportedBiometryType();
// Returns: 'TouchID' | 'FaceID' | 'Fingerprint' | 'Face' | null