feat(otp): add notification for when all recovery codes are used

app/src/language/ar/app.po

@@ -106,6 +106,10 @@ msgstr "بعد ذلك، قم بتحديث هذه الصفحة وانقر فوق
 msgid "All"
 msgstr "الكل"
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr ""
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr "عنوان URL الأساسي لAPI"
@@ -1885,6 +1889,12 @@ msgstr ""
 "يرجى أولاً إضافة بيانات الاعتماد في الشهادات > بيانات اعتماد DNS، ثم اختيار "
 "أحد بيانات الاعتماد أدناه لطلب API لمزود DNS."
 
+#: src/language/constants.ts:58
+msgid ""
+"Please generate new recovery codes in the preferences immediately to prevent "
+"lockout."
+msgstr ""
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 msgid "Please input a filename"

app/src/language/constants.ts

@@ -53,4 +53,7 @@ export const msg = [
   $gettext('Enable Remote Site Error'),
   $gettext('Rename Remote Site Success'),
   $gettext('Rename Remote Site Error'),
+
+  $gettext('All Recovery Codes Have Been Used'),
+  $gettext('Please generate new recovery codes in the preferences immediately to prevent lockout.'),
 ]

app/src/language/en/app.po

@@ -108,6 +108,10 @@ msgstr ""
 msgid "All"
 msgstr ""
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr ""
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr ""
@@ -1956,6 +1960,12 @@ msgid ""
 "select one of the credentialsbelow to request the API of the DNS provider."
 msgstr ""
 
+#: src/language/constants.ts:58
+msgid ""
+"Please generate new recovery codes in the preferences immediately to prevent "
+"lockout."
+msgstr ""
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 #, fuzzy

app/src/language/es/app.po

@@ -111,6 +111,10 @@ msgstr ""
 msgid "All"
 msgstr "Todo"
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr ""
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr "URL Base de la API"
@@ -1906,6 +1910,12 @@ msgstr ""
 "luego seleccione una de las credenciales de aquí debajo para llamar a la API "
 "del proveedor de DNS."
 
+#: src/language/constants.ts:58
+msgid ""
+"Please generate new recovery codes in the preferences immediately to prevent "
+"lockout."
+msgstr ""
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 msgid "Please input a filename"

app/src/language/fr_FR/app.po

@@ -109,6 +109,10 @@ msgstr ""
 msgid "All"
 msgstr ""
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr ""
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr "URL de base de l'API"
@@ -1950,6 +1954,12 @@ msgstr ""
 "des informations d'identification ci-dessous pour demander l'API du "
 "fournisseur DNS."
 
+#: src/language/constants.ts:58
+msgid ""
+"Please generate new recovery codes in the preferences immediately to prevent "
+"lockout."
+msgstr ""
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 #, fuzzy

app/src/language/messages.pot

@@ -100,6 +100,10 @@ msgstr ""
 msgid "All"
 msgstr ""
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr ""
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr ""
@@ -1814,6 +1818,10 @@ msgstr ""
 msgid "Please first add credentials in Certification > DNS Credentials, and then select one of the credentialsbelow to request the API of the DNS provider."
 msgstr ""
 
+#: src/language/constants.ts:58
+msgid "Please generate new recovery codes in the preferences immediately to prevent lockout."
+msgstr ""
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 msgid "Please input a filename"

app/src/language/zh_CN/app.po

@@ -106,6 +106,10 @@ msgstr "然后，刷新此页面并再次点击添加 Passkey。"
 msgid "All"
 msgstr "全部"
 
+#: src/language/constants.ts:57
+msgid "All Recovery Codes Have Been Used"
+msgstr "所有恢复码都已被使用"
+
 #: src/views/preference/OpenAISettings.vue:32
 msgid "API Base Url"
 msgstr "API 地址"
@@ -1832,6 +1836,12 @@ msgstr ""
 "请首先在 “证书”> “DNS 凭证” 中添加凭证，然后在下方选择一个凭证，请求 DNS 提供"
 "商的 API。"
 
+#: src/language/constants.ts:58
+msgid ""
+"Please generate new recovery codes in the preferences immediately to prevent "
+"lockout."
+msgstr "请立即在偏好设置中生成新的恢复码，以防止无法访问您的账户。"
+
 #: src/views/config/components/Rename.vue:63
 #: src/views/config/ConfigEditor.vue:249
 msgid "Please input a filename"

internal/user/otp.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/0xJacky/Nginx-UI/internal/cache"
 	"github.com/0xJacky/Nginx-UI/internal/crypto"
+	"github.com/0xJacky/Nginx-UI/internal/notification"
 	"github.com/0xJacky/Nginx-UI/model"
 	"github.com/0xJacky/Nginx-UI/query"
 	"github.com/google/uuid"
@@ -50,13 +51,24 @@ func VerifyOTP(user *model.User, otp, recoveryCode string) (err error) {
 		}
 
 		// check recovery code
+		usedCount := 0
+		verified := false
 		for _, code := range user.RecoveryCodes.Codes {
 			if code.Code == recoveryCode && code.UsedTime == nil {
 				t := time.Now().Unix()
 				code.UsedTime = &t
 				_, err = u.Where(u.ID.Eq(user.ID)).Updates(user)
-				return
+				if err != nil {
+					return err
+				}
+				verified = true
 			}
+			if code.UsedTime != nil {
+				usedCount++
+			}
+		}
+		if verified && usedCount == len(user.RecoveryCodes.Codes) {
+			notification.Warning("All Recovery Codes Have Been Used", "Please generate new recovery codes in the preferences immediately to prevent lockout.")
 		}
 		return ErrRecoveryCode
 	}