Repository: logto-io/logto
File: packages/core/src/routes/account/logto-config.ts (TypeScript)

Code before:
import { UserScope } from '@logto/core-kit';
import { AccountCenterControlValue, userMfaDataGuard, userMfaDataKey } from '@logto/schemas';
import { z } from 'zod';

import koaGuard from '#src/middleware/koa-guard.js';

import { EnvSet } from '../../env-set/index.js';
import RequestError from '../../errors/RequestError/index.js';
import assertThat from '../../utils/assert-that.js';
import type { UserRouter, RouterInitArgs } from '../types.js';

import { accountApiPrefix } from './constants.js';

export default function logtoConfigRoutes<T extends UserRouter>(...args: RouterInitArgs<T>) {
  if (!EnvSet.values.isDevFeaturesEnabled) {
    return;
  }

  const [router, { queries }] = args;
  const {
    users: { updateUserById, findUserById },
  } = queries;

  router.get(
    `${accountApiPrefix}/logto-config`,
    koaGuard({
      response: z.object({
        mfa: z.object({
          skipped: z.boolean(),
        }),
      }),
      status: [200, 400, 401],
    }),
    async (ctx, next) => {
      const { id: userId, scopes } = ctx.auth;

      assertThat(
        scopes.has(UserScope.Identities),
        new RequestError({ code: 'auth.unauthorized', status: 401 })
      );

      const { fields } = ctx.accountCenter;
      // Currently, only the MFA skip state is exposed in logto_config
      // so we only need to check the MFA field
      assertThat(
        fields.mfa === AccountCenterControlValue.Edit ||
          fields.mfa === AccountCenterControlValue.ReadOnly,
        new RequestError({ code: 'account_center.field_not_enabled', status: 400 })
      );


Review comment (suggestion):
```suggestion
    `${accountApiPrefix}/logto-configs`,
```

Code after:
import { UserScope } from '@logto/core-kit';
import { AccountCenterControlValue, userMfaDataGuard, userMfaDataKey } from '@logto/schemas';
import { z } from 'zod';

import koaGuard from '#src/middleware/koa-guard.js';

import { EnvSet } from '../../env-set/index.js';
import RequestError from '../../errors/RequestError/index.js';
import assertThat from '../../utils/assert-that.js';
import type { UserRouter, RouterInitArgs } from '../types.js';

import { accountApiPrefix } from './constants.js';

export default function logtoConfigRoutes<T extends UserRouter>(...args: RouterInitArgs<T>) {
  if (!EnvSet.values.isDevFeaturesEnabled) {
    return;
  }

  const [router, { queries }] = args;
  const {
    users: { updateUserById, findUserById },
  } = queries;

  router.get(
    `${accountApiPrefix}/logto-configs`,
    koaGuard({
      response: z.object({
        mfa: z.object({
          skipped: z.boolean(),
        }),
      }),
      status: [200, 400, 401],
    }),
    async (ctx, next) => {
      const { id: userId, scopes } = ctx.auth;

      assertThat(
        scopes.has(UserScope.Identities),
        new RequestError({ code: 'auth.unauthorized', status: 401 })
      );

      const { fields } = ctx.accountCenter;
      // Currently, only the MFA skip state is exposed in logto_config
      // so we only need to check the MFA field
      assertThat(
        fields.mfa === AccountCenterControlValue.Edit ||
          fields.mfa === AccountCenterControlValue.ReadOnly,
        new RequestError({ code: 'account_center.field_not_enabled', status: 400 })
      );