OXDEV-9078 Fix resend cooldown and attempts on OTP page

Author: TitaKoleva

assets/out/src/js/module/resend-otp.js

@@ -10,8 +10,6 @@ export class ResendOtp {
             submitButtonId = 'auth_submit',
             attemptsDisplayId = 'remaining-attempts',
             codeInputId = 'auth_code',
-            // todo-high: use attempts from resend request response
-            maxAttempts = 5,
         } = options;
 
         this.btn = button;
@@ -20,9 +18,7 @@ export class ResendOtp {
         this.attemptsDisplay = document.getElementById(attemptsDisplayId);
         this.codeInput = document.getElementById(codeInputId);
 
-        // todo-low: add admin setting for cooldown seconds
         this.cooldownSeconds = Number(button.dataset.cooldown || 60);
-        this.maxAttempts = maxAttempts;
         this.url = button.dataset.url;
         this.textDefault = button.dataset.textDefault;
         this.textSending = button.dataset.textSending;
@@ -55,16 +51,24 @@ export class ResendOtp {
                 headers: { 'Content-Type': 'application/json' }
             });
 
+            if (response.status === 429) {
+                const until = Date.now() + this.cooldownSeconds * 1000;
+                this.storeUntil(until);
+                this.startCooldown(until);
+                return;
+            }
+
             if (!response.ok) {
                 this.unlock();
+                this.setHint(this.textError);
                 return;
             }
 
+            const data = await response.json();
             const until = Date.now() + this.cooldownSeconds * 1000;
             this.storeUntil(until);
             this.startCooldown(until);
-
-            this.resetAttempts();
+            this.resetAttempts(data.remainingAttempts);
 
         } catch (e) {
             console.error(e);
@@ -73,9 +77,9 @@ export class ResendOtp {
         }
     }
 
-    resetAttempts() {
+    resetAttempts(count) {
         if (this.attemptsDisplay) {
-            this.attemptsDisplay.textContent = this.maxAttempts;
+            this.attemptsDisplay.textContent = count;
         }
         this.enableSubmit();
     }
@@ -143,8 +147,16 @@ export class ResendOtp {
     }
 
     restoreOnRefresh() {
-        const until = this.getStoredUntil();
-        if (until && until > Date.now()) {
+        const stored = this.getStoredUntil();
+        if (stored && stored > Date.now()) {
+            this.startCooldown(stored);
+            return;
+        }
+
+        const serverRemaining = Number(this.btn.dataset.cooldownRemaining || 0);
+        if (serverRemaining > 0) {
+            const until = Date.now() + serverRemaining * 1000;
+            this.storeUntil(until);
             this.startCooldown(until);
         }
     }

src/Authentication/TwoFactorAuth/Controller/TwoFactorAuthController.php

@@ -11,7 +11,7 @@
 
 use OxidEsales\Eshop\Application\Controller\FrontendController;
 use OxidEsales\Eshop\Core\UtilsView;
-use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\InvalidCodeException;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\CodeValidationException;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\ResendCooldownException;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAResendableInterface;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAServiceInterface;
@@ -47,7 +47,7 @@ public function handleOTP(): ?string
         try {
             $this->twoFAService->verify($userId, $code);
             $this->twoFAUserService->loginUser($userId);
-        } catch (InvalidCodeException $e) {
+        } catch (CodeValidationException $e) {
             $this->utilsView->addErrorToDisplay($e);
         }
 
@@ -64,15 +64,12 @@ public function resendCode(): void
         $userId = $this->twoFAUserService->getPendingUserId();
         try {
             $this->twoFAService->resend($userId);
-            $this->jsonResponse->send(['success' => true]);
+            $this->jsonResponse->send([
+                'success' => true,
+                'remainingAttempts' => $this->twoFAService->getRemainingAttempts($userId),
+            ]);
         } catch (ResendCooldownException) {
             $this->jsonResponse->send(['success' => false], 429);
         }
     }
-
-    public function render()
-    {
-        // todo-high: send attempts left for the user
-        return parent::render();
-    }
 }

src/Authentication/TwoFactorAuth/Factory/services.yaml

@@ -11,3 +11,4 @@ services:
 
   OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAServiceInterface:
     factory: ['@OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Factory\TwoFAServiceFactoryInterface', 'create']
+    public: true

src/Authentication/TwoFactorAuth/OTP/OtpFacade.php

@@ -80,4 +80,9 @@ public function getRemainingAttempts(string $userId): int
 
         return max(0, $this->codeValidator->getMaxAttempts() - $attempts);
     }
+
+    public function getCooldownRemaining(string $userId): int
+    {
+        return $this->sendPolicy->getCooldownRemaining($userId);
+    }
 }

src/Authentication/TwoFactorAuth/OTP/Service/OtpSendPolicyService.php

@@ -23,20 +23,25 @@ public function __construct(
     }
 
     public function canSend(string $userId): bool
+    {
+        return $this->getCooldownRemaining($userId) === 0;
+    }
+
+    public function getCooldownRemaining(string $userId): int
     {
         $state = $this->stateRepository->findByUserId($userId);
 
         if ($state === null) {
-            return true;
+            return 0;
         }
 
         $lastSentAt = $state->getLastSentAt();
         if ($lastSentAt === null) {
-            return true;
+            return 0;
         }
 
         $elapsed = (new DateTimeImmutable())->getTimestamp() - $lastSentAt->getTimestamp();
 
-        return $elapsed >= self::RESEND_COOLDOWN_SECONDS;
+        return max(0, self::RESEND_COOLDOWN_SECONDS - $elapsed);
     }
 }

src/Authentication/TwoFactorAuth/OTP/Service/OtpSendPolicyServiceInterface.php

@@ -10,4 +10,6 @@
 interface OtpSendPolicyServiceInterface
 {
     public function canSend(string $userId): bool;
+
+    public function getCooldownRemaining(string $userId): int;
 }

src/Authentication/TwoFactorAuth/Service/TwoFAResendableInterface.php

@@ -17,4 +17,6 @@ interface TwoFAResendableInterface
     public function resend(string $userId): void;
 
     public function getRemainingAttempts(string $userId): int;
+
+    public function getCooldownRemaining(string $userId): int;
 }

src/Shared/Core/ViewConfig.php

@@ -10,6 +10,9 @@
 namespace OxidEsales\SecurityModule\Shared\Core;
 
 use OxidEsales\SecurityModule\Authentication\OAuth2\Service\ProviderCollectorInterface;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAResendableInterface;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAServiceInterface;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserServiceInterface;
 use OxidEsales\SecurityModule\Captcha\Captcha\Image\Service\ImageCaptchaService;
 use OxidEsales\SecurityModule\Captcha\Service\CaptchaServiceInterface;
 use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsServiceInterface as PasswordSettingsServiceInterface;
@@ -61,8 +64,24 @@ public function getActiveProviders(): iterable
 
     public function getRemainingAttempts(): int
     {
-        // todo-critical: implement
-        return 5;
+        $twoFAService = $this->getService(TwoFAServiceInterface::class);
+        if (!$twoFAService instanceof TwoFAResendableInterface) {
+            return 0;
+        }
+
+        $userId = $this->getService(TwoFAUserServiceInterface::class)->getPendingUserId();
+        return $twoFAService->getRemainingAttempts($userId);
+    }
+
+    public function getResendCooldownRemaining(): int
+    {
+        $twoFAService = $this->getService(TwoFAServiceInterface::class);
+        if (!$twoFAService instanceof TwoFAResendableInterface) {
+            return 0;
+        }
+
+        $userId = $this->getService(TwoFAUserServiceInterface::class)->getPendingUserId();
+        return $twoFAService->getCooldownRemaining($userId);
     }
 
     public function isExternalAuthUser(): bool

tests/Unit/Authentication/TwoFactorAuth/Controller/TwoFactorAuthControllerTest.php

@@ -87,11 +87,14 @@ public function resendCodeSendsSuccessResponse(): void
         $twoFAServiceSpy->expects($this->once())
             ->method('resend')
             ->with($userId);
+        $twoFAServiceSpy->method('getRemainingAttempts')
+            ->with($userId)
+            ->willReturn($remaining = 3);
 
         $jsonResponseSpy = $this->createMock(JsonResponseInterface::class);
         $jsonResponseSpy->expects($this->once())
             ->method('send')
-            ->with(['success' => true]);
+            ->with(['success' => true, 'remainingAttempts' => $remaining]);
 
         $this->getSut(
             twoFAService: $twoFAServiceSpy,

tests/Unit/Authentication/TwoFactorAuth/OTP/OtpFacadeTest.php

@@ -260,6 +260,17 @@ public function getRemainingAttemptsSubtractsCurrentAttempts(): void
         $this->assertSame(2, $sut->getRemainingAttempts(uniqid()));
     }
 
+    #[Test]
+    public function getCooldownRemainingDelegatesToSendPolicy(): void
+    {
+        $sendPolicyMock = $this->createMock(OtpSendPolicyServiceInterface::class);
+        $sendPolicyMock->method('getCooldownRemaining')
+            ->with($userId = uniqid())
+            ->willReturn(42);
+
+        $this->assertSame(42, $this->getSut(sendPolicy: $sendPolicyMock)->getCooldownRemaining($userId));
+    }
+
     #[Test]
     public function getRemainingAttemptsReturnsZeroWhenAttemptsExceedMax(): void
     {