OXDEV-9078 Guard the triggerChallenge with resend timeouts

Signed-off-by: Anton Fedurtsya <anton@fedurtsya.com>

Author: Sieg

src/Authentication/TwoFactorAuth/OTP/OtpFacade.php

@@ -43,10 +43,11 @@ public function isVerified(string $userId): bool
 
     public function triggerChallenge(string $userId): void
     {
-        $code = $this->codeGenerator->generateCode();
-
-        // todo-critical: check if we can trigger the notification
+        if (!$this->sendPolicy->canSend($userId)) {
+            return;
+        }
 
+        $code = $this->codeGenerator->generateCode();
         $this->stateService->createChallengeState($userId, $code);
         $this->notifierFactory->create($userId)->notify($userId, $code);
     }

tests/Unit/Authentication/TwoFactorAuth/OTP/OtpFacadeTest.php

@@ -154,6 +154,9 @@ public function verifyDoesNotMarkVerifiedWhenValidationFails(): void
     #[Test]
     public function triggerChallengeGeneratesCodeCreatesStateAndNotifies(): void
     {
+        $sendPolicyStub = $this->createStub(OtpSendPolicyServiceInterface::class);
+        $sendPolicyStub->method('canSend')->willReturn(true);
+
         $codeGeneratorStub = $this->createStub(OtpCodeGeneratorServiceInterface::class);
         $codeGeneratorStub->method('generateCode')->willReturn($code = uniqid());
 
@@ -174,11 +177,33 @@ public function triggerChallengeGeneratesCodeCreatesStateAndNotifies(): void
             stateService: $stateServiceSpy,
             codeGenerator: $codeGeneratorStub,
             notifierFactory: $notifierFactoryStub,
+            sendPolicy: $sendPolicyStub,
         );
 
         $sut->triggerChallenge(userId: $userId);
     }
 
+    #[Test]
+    public function triggerChallengeDoesNothingWhenCooldownActive(): void
+    {
+        $sendPolicyStub = $this->createStub(OtpSendPolicyServiceInterface::class);
+        $sendPolicyStub->method('canSend')->willReturn(false);
+
+        $stateServiceSpy = $this->createMock(OtpChallengeStateServiceInterface::class);
+        $stateServiceSpy->expects($this->never())->method('createChallengeState');
+
+        $notifierFactorySpy = $this->createMock(OtpNotifierFactoryInterface::class);
+        $notifierFactorySpy->expects($this->never())->method('create');
+
+        $sut = $this->getSut(
+            stateService: $stateServiceSpy,
+            notifierFactory: $notifierFactorySpy,
+            sendPolicy: $sendPolicyStub,
+        );
+
+        $sut->triggerChallenge(userId: uniqid());
+    }
+
     #[Test]
     public function resendThrowsCooldownExceptionWhenSendNotAllowed(): void
     {