OXDEV-9078 Add two FA settings in user account

Author: TitaKoleva

metadata.php

@@ -35,6 +35,7 @@
     'extend'      => [
         \OxidEsales\Eshop\Application\Controller\NewsletterController::class => \OxidEsales\SecurityModule\Captcha\Shop\NewsletterController::class,
         \OxidEsales\Eshop\Application\Controller\ForgotPasswordController::class => \OxidEsales\SecurityModule\Shared\Controller\ForgotPasswordController::class,
+        \OxidEsales\Eshop\Application\Controller\AccountPasswordController::class => \OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller\AccountPasswordController::class,
         \OxidEsales\Eshop\Application\Model\User::class => \OxidEsales\SecurityModule\Shared\Model\User::class,
         \OxidEsales\Eshop\Core\InputValidator::class    => \OxidEsales\SecurityModule\Shared\Core\InputValidator::class,
         \OxidEsales\Eshop\Core\ViewConfig::class        => \OxidEsales\SecurityModule\Shared\Core\ViewConfig::class

src/Authentication/TwoFactorAuth/Controller/AccountPasswordController.php

@@ -0,0 +1,42 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller;
+
+use OxidEsales\Eshop\Core\Registry;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserSettingsServiceInterface;
+
+/**
+ *  todo-critical: remove it if we go with new Security section
+ * @mixin \OxidEsales\Eshop\Application\Controller\AccountPasswordController
+ * @eshopExtension
+ */
+class AccountPasswordController extends AccountPasswordController_parent
+{
+    public function saveTwoFactorAuth(): void
+    {
+        $user = $this->getUser();
+        if (!$user) {
+            return;
+        }
+
+        $enabled = (bool) Registry::getRequest()->getRequestParameter('twofa_enabled');
+        $this->getService(TwoFAUserSettingsServiceInterface::class)->setEnabledForUser($user->getId(), $enabled);
+    }
+
+    public function isTwoFAEnabled(): bool
+    {
+        $user = $this->getUser();
+        if (!$user) {
+            return false;
+        }
+
+        return $this->getService(TwoFAUserSettingsServiceInterface::class)->isEnabledForUser($user->getId());
+    }
+}

src/Authentication/TwoFactorAuth/Controller/AccountSecurityController.php

@@ -0,0 +1,51 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller;
+
+use OxidEsales\Eshop\Application\Controller\FrontendController;
+use OxidEsales\Eshop\Core\Registry;
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserSettingsServiceInterface;
+
+// todo-critical: remove if we go with Change Password extension
+class AccountSecurityController extends FrontendController
+{
+    /**
+     * @var string
+     * @SuppressWarnings("PHPMD.CamelCasePropertyName")
+     */
+    protected $_sThisTemplate = '@oe_security_module/templates/account_security';
+
+    public function __construct(
+        private readonly TwoFAUserSettingsServiceInterface $userSettingsService,
+    ) {
+        parent::__construct();
+    }
+
+    public function saveTwoFactorAuth(): void
+    {
+        $user = $this->getUser();
+        if (!$user) {
+            return;
+        }
+
+        $enabled = (bool) Registry::getRequest()->getRequestParameter('twofa_enabled');
+        $this->userSettingsService->setEnabledForUser($user->getId(), $enabled);
+    }
+
+    public function isTwoFAEnabled(): bool
+    {
+        $user = $this->getUser();
+        if (!$user) {
+            return false;
+        }
+
+        return $this->userSettingsService->isEnabledForUser($user->getId());
+    }
+}

src/Authentication/TwoFactorAuth/Controller/services.yaml

@@ -9,3 +9,8 @@ services:
     public: true
     tags:
         - { name: 'oxid.view_controller', controller_key: 'twofactorauth' }
+
+  OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller\AccountSecurityController:
+    public: true
+    tags:
+        - { name: 'oxid.view_controller', controller_key: 'account_security' }

src/Authentication/TwoFactorAuth/Infrastructure/Repository/UserRepository.php

@@ -32,4 +32,16 @@ public function getUserById(string $userId): UserInterface
 
         return $this->userDtoFactory->createFromModel($userModel);
     }
+
+    public function setTwoFAEnabled(string $userId, bool $enabled): void
+    {
+        $userModel = $this->userFactory->create();
+
+        if (!$userModel->load($userId)) {
+            throw new UserNotFoundException();
+        }
+
+        $userModel->assign(['oe2faenabled' => (int) $enabled]);
+        $userModel->save();
+    }
 }

src/Authentication/TwoFactorAuth/Infrastructure/Repository/UserRepositoryInterface.php

@@ -16,4 +16,7 @@ interface UserRepositoryInterface
 {
     /** @throws UserNotFoundException */
     public function getUserById(string $userId): UserInterface;
+
+    /** @throws UserNotFoundException */
+    public function setTwoFAEnabled(string $userId, bool $enabled): void;
 }

src/Authentication/TwoFactorAuth/Service/TwoFAUserSettingsService.php

@@ -0,0 +1,30 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service;
+
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Infrastructure\Repository\UserRepositoryInterface;
+
+class TwoFAUserSettingsService implements TwoFAUserSettingsServiceInterface
+{
+    public function __construct(
+        private UserRepositoryInterface $userRepository,
+    ) {
+    }
+
+    public function isEnabledForUser(string $userId): bool
+    {
+        return $this->userRepository->getUserById($userId)->isTwoFAEnabled();
+    }
+
+    public function setEnabledForUser(string $userId, bool $enabled): void
+    {
+        $this->userRepository->setTwoFAEnabled($userId, $enabled);
+    }
+}

src/Authentication/TwoFactorAuth/Service/TwoFAUserSettingsServiceInterface.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service;
+
+use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Exception\UserNotFoundException;
+
+interface TwoFAUserSettingsServiceInterface
+{
+    /** @throws UserNotFoundException */
+    public function isEnabledForUser(string $userId): bool;
+
+    /** @throws UserNotFoundException */
+    public function setEnabledForUser(string $userId, bool $enabled): void;
+}

src/Authentication/TwoFactorAuth/Service/services.yaml

@@ -8,3 +8,7 @@ services:
   OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserServiceInterface:
     class: OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserService
     public: true
+
+  OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserSettingsServiceInterface:
+    class: OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Service\TwoFAUserSettingsService
+    public: true

tests/PhpStan/phpstan-bootstrap.php

@@ -29,5 +29,10 @@ class_alias(
 
 class_alias(
     \OxidEsales\Eshop\Application\Controller\ForgotPasswordController::class,
+    \OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Controller\AccountPasswordController_parent::class
+);
+
+class_alias(
+    \OxidEsales\Eshop\Application\Controller\AccountPasswordController::class,
     \OxidEsales\SecurityModule\Shared\Controller\ForgotPasswordController_parent::class
 );