Merge branch 'b-7.4.x-implement-otp-OXDEV-9927' into b-7.4.x-2fa-OXDEV-9078

Author: tkcreateit

metadata.php

@@ -9,6 +9,8 @@
  * Metadata version
  */
 
+use OxidEsales\SecurityModule\Authentication\OAuth2\Service\ModuleSettingsService;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\ModuleSettingsService as TwoFactorAuthModuleSettings;
 use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsService as PasswordPolicyModuleSettings;
 use OxidEsales\SecurityModule\Captcha\Service\ModuleSettingsService as CaptchaModuleSettings;
 use OxidEsales\SecurityModule\Authentication\OAuth2\Service\ModuleSettingsService as OAuthModuleSettings;
@@ -41,7 +43,8 @@
     'controllers' => [
         'captcha' => \OxidEsales\SecurityModule\Captcha\Controller\CaptchaController::class,
         'password' => \OxidEsales\SecurityModule\PasswordPolicy\Controller\PasswordAjaxController::class,
-        'oauth' => \OxidEsales\SecurityModule\Authentication\OAuth2\Controller\OAuthController::class
+        'oauth' => \OxidEsales\SecurityModule\Authentication\OAuth2\Controller\OAuthController::class,
+        'twofactorauth' => \OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller\TwoFactorAuthController::class,
     ],
     'templates'   => [
     ],
@@ -161,6 +164,21 @@
             'name'  => OAuthModuleSettings::GOOGLE_REDIRECT_URL,
             'type'  => 'str',
             'value' => ''
-        ]
+        ],
+
+        //TwoFactorAuth settings
+        [
+            'group' => 'two_factor_auth',
+            'name'  => TwoFactorAuthModuleSettings::ACTIVE,
+            'type'  => 'bool',
+            'value' => false
+        ],
+        [
+            'group' => 'two_factor_auth',
+            'name'  => TwoFactorAuthModuleSettings::TWO_FACTOR_TYPE,
+            'type'  => 'select',
+            'constraints' => 'otp|totp',
+            'value' => ''
+        ],
     ],
 ];

migration/data/Version20251128093245.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+namespace OxidEsales\SecurityModule\Migrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20251128093245 extends AbstractMigration
+{
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE `oxuser` ADD column `OESMOTPCODE` VARCHAR(128) default NULL COMMENT "OTP code"');
+        $this->addSql('ALTER TABLE `oxuser` ADD column `OESMOTPEXPTIME` DATETIME default NULL COMMENT "OTP code expiration time"');
+        $this->addSql('ALTER TABLE `oxuser` ADD column `OESMOTPATTEMPTS` INT NOT NULL default 0 COMMENT "OTP code attempts"');
+    }
+
+    public function down(Schema $schema): void
+    {
+    }
+}

migration/migrations.yml

@@ -0,0 +1,4 @@
+table_storage:
+    table_name: oxmigrations_oe_security_module
+migrations_paths:
+    'OxidEsales\SecurityModule\Migrations': data

src/Authentication/OAuth2/Infrastructure/Factory/OAuth2UserDTOFactory.php

@@ -25,7 +25,6 @@ public function createFromFacebookUser(FacebookUser $facebookUser): OAuth2UserDT
         );
     }
 
-    //TODO: use one factory for all providers
     public function createFromGoogleUser(GoogleUser $googleUser): OAuth2UserDTOInterface
     {
         return new OAuth2UserDTO(

src/Authentication/OAuth2/Service/ProviderCollector.php

@@ -9,10 +9,8 @@
 
 namespace OxidEsales\SecurityModule\Authentication\OAuth2\Service;
 
-use OxidEsales\SecurityModule\Authentication\OAuth2\Exception\ProviderNotActiveException;
 use OxidEsales\SecurityModule\Authentication\OAuth2\Exception\ProviderNotFoundException;
 use OxidEsales\SecurityModule\Authentication\OAuth2\Infrastructure\Provider\ProviderAdapterInterface;
-use OxidEsales\SecurityModule\Authentication\OAuth2\Service\Exception\ProviderNotActive;
 use Symfony\Component\Translation\Provider\ProviderInterface;
 
 class ProviderCollector implements ProviderCollectorInterface

src/Authentication/TwoFactorAuth/Controller/TwoFactorAuthController.php

@@ -0,0 +1,54 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller;
+
+use OxidEsales\Eshop\Application\Controller\FrontendController;
+use OxidEsales\Eshop\Core\Registry;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\AuthorizeServiceInterface;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Transput\AuthCodeRequestInterface;
+
+class TwoFactorAuthController extends FrontendController
+{
+    /**
+     * Current view template
+     *
+     * @var string
+     * @SuppressWarnings("PHPMD.CamelCasePropertyName")
+     */
+    protected $_sThisTemplate = '@oe_security_module/templates/two_factor_auth';
+
+    public function handleOTP(): void
+    {
+        $OTPRequest = $this->getService(AuthCodeRequestInterface::class);
+
+        //todo: catch only OTP exception that will be shown to user, maybe some abstract OTP exception?
+        try {
+            $authorizeService = $this->getService(AuthorizeServiceInterface::class);
+            $authorizeService->validate(
+                $OTPRequest->getCode()
+            );
+
+            //todo: redirect to originally requested page after successful OTP validation
+            //todo: create correct session for logged in user (from service, handleLogin?)
+        } catch (\Exception $e) {
+            //todo: display translated error message to user
+            Registry::getUtilsView()->addErrorToDisplay($e->getMessage());
+        }
+    }
+
+    public function generate(): void
+    {
+        //todo: stop execution if not ajax
+        //todo: prevent spam by rate limiting
+        //todo: should return json response with success or error message
+        $authorizeService = $this->getService(AuthorizeServiceInterface::class);
+        $authorizeService->generate();
+    }
+}

src/Authentication/TwoFactorAuth/DTO/User.php

@@ -0,0 +1,43 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\DTO;
+
+use DateTimeInterface;
+
+class User implements UserInterface
+{
+    public function __construct(
+        private readonly string $userId,
+        private readonly int $attempts,
+        private readonly ?string $code,
+        private readonly ?DateTimeInterface $expiresAt,
+    ) {
+    }
+
+    public function getId(): string
+    {
+        return $this->userId;
+    }
+
+    public function getCode(): ?string
+    {
+        return $this->code;
+    }
+
+    public function getAttempts(): int
+    {
+        return $this->attempts;
+    }
+
+    public function getExpiresAt(): ?DateTimeInterface
+    {
+        return $this->expiresAt;
+    }
+}

src/Authentication/TwoFactorAuth/DTO/UserInterface.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\DTO;
+
+use DateTimeInterface;
+
+interface UserInterface
+{
+    public function getId(): string;
+
+    public function getCode(): ?string;
+
+    public function getAttempts(): int;
+
+    public function getExpiresAt(): ?DateTimeInterface;
+}

src/Authentication/TwoFactorAuth/Exception/AttemptLimitExceededException.php

@@ -0,0 +1,18 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception;
+
+class AttemptLimitExceededException extends \Exception
+{
+    public function __construct()
+    {
+        parent::__construct('ERROR_ATTEMPT_LIMIT_EXCEEDED');
+    }
+}

src/Authentication/TwoFactorAuth/Exception/InvalidCodeException.php

@@ -0,0 +1,18 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception;
+
+class InvalidCodeException extends \Exception
+{
+    public function __construct()
+    {
+        parent::__construct('ERROR_INVALID_CODE');
+    }
+}