Initial commit

app/api/v2/management/otp.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module API
+  module V2
+    module Management
+      class Otp < Grape::API
+        helpers do
+          def sign_request(jwt)
+            JWT::Multisig.add_jws(jwt, :barong, Barong::App.config.keystore.private_key, 'RS256')
+          rescue StandardError => e
+            error!("JWT is invalid by the reason \"#{e.message}\"", 422)
+          end
+        end
+
+        desc 'OTP related routes'
+        resource :otp do
+          desc 'Sign request with barong signature' do
+            @settings[:scope] = :otp_sign
+          end
+          params do
+            requires :user_uid, type: String, allow_blank: false, desc: 'Account UID'
+            requires :otp_code, type: String, allow_blank: false, desc: 'Code from Google Authenticator'
+            requires :jwt, type: Hash, allow_blank: false, desc: 'RFC 7516 jwt with applogic signature'
+          end
+          post '/sign' do
+            declared_params = declared(params)
+            user = User.active.find_by!(uid: declared_params[:user_uid])
+            error!('Account has not enabled 2FA', 422) unless user.otp
+
+            unless TOTPService.validate?(user.uid, declared_params[:otp_code])
+              error!('OTP code is invalid', 422)
+            end
+
+            sign_request(declared_params[:jwt])
+          end
+        end
+      end
+    end
+  end
+end