OXDEV-9927 Create Transput and add resend code

Author: NikolaIvanovski

src/Authentication/TwoFactorAuth/Controller/TwoFactorAuthController.php

@@ -3,28 +3,35 @@
 namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller;
 
 use OxidEsales\Eshop\Application\Controller\FrontendController;
-use OxidEsales\Eshop\Core\Registry;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\AuthorizeServiceInterface;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput\OTPRequestInterface;
 
 class TwoFactorAuthController extends FrontendController
 {
     protected $_sThisTemplate = '@oe_security_module/templates/two_factor_auth';
 
-    private function handleOTP(): void
+    public function handleOTP(): void
     {
-        $code = Registry::getRequest()->getRequestEscapedParameter('code');
-        $sessionUser =  Registry::getSession()->getVariable('usr');
-        $user = oxNew(User::class);
-        $user->load($sessionUser);
+        $OTPRequest = $this->getService(OTPRequestInterface::class);
 
-        $this->getService(OTPServiceInterface::class)->validateCode($user, $code);
+        //todo: catch only OTP exception that will be shown to user, maybe some abstract OTP exception?
+        try {
+            $authorizeService = $this->getService(AuthorizeServiceInterface::class);
+            $authorizeService->validate(
+                $OTPRequest->getOTPCode()
+            );
+        } catch (\Exception $e) {
+            //todo: display error message to user
+        }
     }
 
-    public function render()
+    public function generate(): void
     {
+        //todo: stop execution if not ajax
+        //todo: prevent spam by rate limiting
+        //todo: should return json response with success or error message
+
         $authorizeService = $this->getService(AuthorizeServiceInterface::class);
         $authorizeService->generate();
-
-        exit;
     }
 }

src/Authentication/TwoFactorAuth/DTO/User.php

@@ -38,8 +38,11 @@ public function getAttempts(): ?int
 
     public function getExpiresAt(): ?DateTimeImmutable
     {
+        //todo: possible bug - should be null if not set
+        $expireAt = $this->expiresAt ?? time();
+
         $dateTime = new DateTimeImmutable();
 
-        return $dateTime->setTimestamp($this->expiresAt);
+        return $dateTime->setTimestamp($expireAt);
     }
 }

src/Authentication/TwoFactorAuth/Infrastructure/Repository/UserRepository.php

@@ -17,7 +17,7 @@
 class UserRepository implements UserRepositoryInterface
 {
     public function __construct(
-        private UserFactoryInterface $userFactory,
+        private readonly UserFactoryInterface $userFactory,
         private readonly QueryBuilderFactoryInterface $queryBuilderFactory,
     ) {
     }
@@ -31,9 +31,9 @@ public function getUserOTPData(string $userId): UserDTO
 
         return new UserDTO(
             $userModel->getId(),
-            $userModel->getFieldData('OTPCODE'),
-            (int) $userModel->getFieldData('OTPATTEMPTS'),
-            new DateTime($userModel->getFieldData('OTPEXPIRETIME'))
+            $userModel->getFieldData('OESMOTPCODE'),
+            (int) $userModel->getFieldData('OESMOTPATTEMPTS'),
+            (int) $userModel->getFieldData('OESMOTPEXPTIME')
         );
     }
 
@@ -66,21 +66,21 @@ public function resetCodeFields(string $userId): void
         $userModel = $this->userFactory->create();
         $userModel->load($userId);
         $userModel->assign([
-            'OESMOTPCODE'       => '',
-            'OESMOTPEXPTIME' => 0,
-            'OESMOTPATTEMPTS'   => 0,
+            'OESMOTPCODE'     => '',
+            'OESMOTPEXPTIME'  => 0,
+            'OESMOTPATTEMPTS' => 0,
         ]);
         $userModel->save();
     }
 
     public function getUserPasswordHash(string $userName): string
     {
-        $qb = $this->queryBuilderFactory->create();
-        $qb->select('OXPASSWORD')
+        $builder = $this->queryBuilderFactory->create();
+        $builder->select('OXPASSWORD')
             ->from('oxuser')
             ->where('oxusername = :userName')
             ->setParameter('userName', $userName);
 
-        return $qb->execute()->fetchOne();
+        return $builder->execute()->fetchOne();
     }
 }

src/Authentication/TwoFactorAuth/Service/AuthorizeService.php

@@ -18,16 +18,16 @@ public function __construct(
     ) {
     }
 
-    public function validate(): void
+    public function validate(string $inputCode): void
     {
         $activeVerificator = $this->moduleSettings->getTwoFactorAuthType();
 
         $verificator = $this->verificationCollectorService->getVerificator(
             $activeVerificator
         );
-        //todo: use transput to get the code from request
+
         //todo: use session to get user id
-        $verificator->validateCode(uniqid(), uniqid());
+        $verificator->validateCode('7b4dfcca4669a8bbfcbd29c77cbc82f3', $inputCode);
     }
 
     public function generate(): void

src/Authentication/TwoFactorAuth/Service/AuthorizeServiceInterface.php

@@ -9,7 +9,7 @@
 
 interface AuthorizeServiceInterface
 {
-    public function validate(): void;
+    public function validate(string $inputCode): void;
 
     public function generate(): void;
 }

src/Authentication/TwoFactorAuth/Service/Verificator/OTP/OTPVerificator.php

@@ -49,6 +49,11 @@ public function validateCode(string $userId, string $inputCode): void
 
     public function generate(string $userId): string
     {
+        //todo: stop if user not found?
+        //todo: wait time between generations, in case of abuse like
+        //spamming the generate button or
+        //user hit limit and try to generate new code to bypass it
+
         return $this->otpGenerator->generateCode($userId);
     }
 }

src/Authentication/TwoFactorAuth/Service/Verificator/OTP/Validator/OTPValidator.php

@@ -12,7 +12,6 @@
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\AttemptLimitExceededException;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\InvalidCodeException;
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\TimeExpiredException;
-use DateTime;
 
 readonly class OTPValidator implements OTPValidatorInterface
 {

src/Authentication/TwoFactorAuth/Transput/OTPRequest.php

@@ -0,0 +1,25 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput;
+
+use OxidEsales\EshopCommunity\Internal\Framework\Request\RequestInterface;
+
+readonly class OTPRequest implements OTPRequestInterface
+{
+    public function __construct(
+        private RequestInterface $request,
+    ) {
+    }
+
+    public function getOTPCode(): string
+    {
+        return $this->request->get('auth_code');
+    }
+}

src/Authentication/TwoFactorAuth/Transput/OTPRequestInterface.php

@@ -0,0 +1,13 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput;
+
+interface OTPRequestInterface
+{
+    public function getOTPCode(): string;
+}

src/Authentication/TwoFactorAuth/Transput/services.yaml

@@ -0,0 +1,8 @@
+services:
+  _defaults:
+    autowire: true
+    public: false
+
+  OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput\OTPRequestInterface:
+    class: OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput\OTPRequest
+    public: true