!!! Major Rework

This is a preparation for version 2.0 of this package.
It changes most of the APIs and comes with some new features:

* Dependencies:
  *  `neos/flow` 5.2 compatibility
  *  updated `pragmarx/google2fa` and `bacon/bacon-qr-code` packages
* Persistence:
  *  2FA state is no longer stored in the `neos_flow_security_account` table
     but in a separate table `yeebase_twofactorauthentication_secret` for
     greater compatibility/extensibility
* Security:
  * OTPs can only be used once now!
  * QR Code is created locally in order to avoid the secret to be sent over
    the wire (note: The QR Code is a SVG by default that can be used inline)

Author: bwaidelich

.gitignore

@@ -0,0 +1,57 @@
+<?php
+declare(strict_types=1);
+namespace Yeebase\TwoFactorAuthentication\Domain\ValueObjects;
+
+use BaconQrCode\Renderer\Image\SvgImageBackEnd;
+use BaconQrCode\Renderer\ImageRenderer;
+use BaconQrCode\Renderer\RendererStyle\RendererStyle;
+use BaconQrCode\Writer;
+use Neos\Flow\Annotations as Flow;
+
+/**
+ * A QR Code that encodes a given secret and can be used to activate 2FA with an authenticator app
+ *
+ * @Flow\Proxy(false)
+ */
+final class ActivationQrCode
+{
+    /**
+     * @var Secret
+     */
+    private $secret;
+
+    /**
+     * @var string
+     */
+    private $qrCodeUrl;
+
+    private function __construct(Secret $secret, string $qrCodeUrl)
+    {
+        $this->secret = $secret;
+        $this->qrCodeUrl = $qrCodeUrl;
+    }
+
+    public static function fromSecretAndUrl(Secret $secret, string $qrCodeUrl): self
+    {
+        return new static($secret, $qrCodeUrl);
+    }
+
+    public function getSecret(): Secret
+    {
+        return $this->secret;
+    }
+
+    public function renderSvg(int $width): string
+    {
+        $renderer = new ImageRenderer(
+            new RendererStyle($width),
+            new SvgImageBackEnd()
+        );
+        $bacon = new Writer($renderer);
+        return $bacon->writeString(
+            $this->qrCodeUrl,
+            'utf-8'
+        );
+    }
+
+}

Classes/Controller/AbstractTwoFactorAuthenticationController.php

@@ -0,0 +1,40 @@
+<?php
+declare(strict_types=1);
+namespace Yeebase\TwoFactorAuthentication\Domain\ValueObjects;
+
+use Neos\Flow\Annotations as Flow;
+
+/**
+ * A Code (aka OTP) returned from an 2FA device or app
+ *
+ * @Flow\Proxy(false)
+ */
+final class OneTimePassword
+{
+    /**
+     * @var string
+     */
+    private $value;
+
+    /**
+     * @internal This constructor is only public so that this VO can be property-mapped
+     */
+    public function __construct(string $otp)
+    {
+        if (preg_match('/^\d{6}$/', $otp) !== 1) {
+            throw new \InvalidArgumentException('OTP must consist of 6 digits', 1549978113);
+        }
+        $this->value = $otp;
+    }
+
+    public static function fromString(string $otp): self
+    {
+        return new static($otp);
+    }
+
+    public function toString(): string
+    {
+        return $this->value;
+    }
+
+}

Classes/Controller/AbstractTwoFactorAuthenticationManagementController.php

@@ -0,0 +1,38 @@
+<?php
+declare(strict_types=1);
+namespace Yeebase\TwoFactorAuthentication\Domain\ValueObjects;
+
+use Neos\Flow\Annotations as Flow;
+
+/**
+ * The user specific 2FA secret
+ *
+ * @Flow\Proxy(false)
+ */
+final class Secret
+{
+    /**
+     * @var string
+     */
+    private $value;
+
+    private function __construct(string $secret)
+    {
+        $secret = trim($secret);
+        if ($secret === '') {
+            throw new \InvalidArgumentException('Secret must not be empty', 1549978555);
+        }
+        $this->value = $secret;
+    }
+
+    public static function fromString(string $secret): self
+    {
+        return new static($secret);
+    }
+
+    public function toString(): string
+    {
+        return $this->value;
+    }
+
+}

Classes/Domain/Dto/TwoFactorAuthenticationCredentialsSource.php

@@ -0,0 +1,68 @@
+<?php
+declare(strict_types=1);
+namespace Yeebase\TwoFactorAuthentication\Domain\ValueObjects;
+
+use Neos\Flow\Annotations as Flow;
+use Neos\Flow\Security\Cryptography\HashService;
+use Neos\Flow\Security\Exception\InvalidArgumentForHashGenerationException;
+use Neos\Flow\Security\Exception\InvalidHashException;
+
+/**
+ * The user specific 2FA secret - with an appended HMAC
+ *
+ * @Flow\Proxy(false)
+ */
+final class SecretWithHmac
+{
+    /**
+     * @var Secret
+     */
+    private $secret;
+
+    /**
+     * @var string
+     */
+    private $hmac;
+
+    /**
+     * @internal This constructor is only public so that this VO can be property-mapped
+     * @throws InvalidArgumentForHashGenerationException | InvalidHashException
+     */
+    public function __construct(string $secretWithHmac)
+    {
+        $hashService = new HashService();
+        $this->secret = Secret::fromString($hashService->validateAndStripHmac($secretWithHmac));
+        $this->hmac = substr($secretWithHmac, -40);
+    }
+
+    /**
+     * @throws InvalidArgumentForHashGenerationException | InvalidHashException
+     */
+    public static function fromString(string $secretWithHmac): self
+    {
+        return new static($secretWithHmac);
+    }
+
+    public static function fromSecret(Secret $secret): self
+    {
+        $hashService = new HashService();
+        $secretWithHmac = $hashService->appendHmac($secret->toString());
+        return new static($secretWithHmac);
+    }
+
+    public function getSecret(): Secret
+    {
+        return $this->secret;
+    }
+
+    public function toString(): string
+    {
+        return $this->secret->toString() . $this->hmac;
+    }
+
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
+}

Classes/Domain/ValueObjects/ActivationQrCode.php

@@ -0,0 +1,8 @@
+<?php
+declare(strict_types=1);
+namespace Yeebase\TwoFactorAuthentication\Exception;
+
+final class InvalidOtpException extends \Exception
+{
+
+}