Initial commit

docs/zagros/2fa/2fa.md

@@ -0,0 +1,104 @@
+#Registration: 2FA
+###### Sprint: 2
+
+### Outcome:
+2 factor authentication is a feature that helps users to secure their activities.
+For critical activities the app needs a code to be completed.
+At first vault creates a code (that showed with QR) to sync with google authenticator.
+After adding code in the user's google authenticator, every time a user needs OTP(one-time-password) can read it in his app.
+
+### Implementation description:
+
+#### Endpoints:
+GET {$domain}/api/v2/barong/resource/otp/generate_qrcode
+
+POST {$domain}/api/v2/barong/resource/otp/enable
+
+POST {$domain}/api/v2/barong/resource/otp/enable_2fa
+
+POST {$domain}/api/v2/barong/resource/otp/disable
+
+POST {$domain}/api/v2/barong/resource/otp/disable_email
+
+#### File destination:
+{$Dalan_Path}/app/api/v2/resource/otp.rb
+
+#### Commits:
+bd7f980596
+dc95b308a6
+b3b5a08d60
+3c170120c1
+a79e06a71b
+8c821f1ba4
+e04a58b012
+99c2552404
+63f69ed0d6
+7010449976
+4d55a48572
+2da71b1097
+
+#### What did we implement:
+
+We add an authorization step to enable/disable 2FA. After entering the google authenticator code, an authorization email is sent to the user containing an OTP . Users only can enable or disable 2FA after entering the correct OTP from the email.
+
+New flow:
+
+System generates the code  → User scan it with mobile →  enters the google code → Receives the email →The user enters the code →  2FA enable/disable
+
+
+```mermaid
+sequenceDiagram
+    title: 2fa activation
+    User->>Ranj: generate Qr Code
+    Ranj-->>Dalan: get /generate_qrcode
+    Dalan->>Ranj: 400, message: '2FA has been enabled for this account'
+    Dalan->>Ranj: 401, message: 'Invalid bearer token'
+    Dalan->>Ranj: 400, message: '2FA has been already sent email for this account(enabling process started)'
+    Dalan->>Ranj: 200, QR params
+    Ranj->>User: QR
+    User->>Ranj: User scan and enter code
+    Ranj-->>Dalan: post /enable params:{code:string}
+    Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing'
+    Dalan->>Ranj: 401, message: 'Invalid bearer token'
+    Dalan->>Ranj: 422, message: 'Validation errors'
+    Dalan->>Ranj: 422, message: 'OTP code is invalid'
+    Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(enabling process started)'
+    Ranj->>User: show result
+    Dalan->>User: send email in case of success
+    User->>Ranj: enter authorization code
+    Ranj-->>Dalan: post '/enable_2fa' params:{code:string}
+    Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing
+    Dalan->>Ranj: 401, message: 'Invalid bearer token'
+    Dalan->>Ranj: 422, message: 'Validation errors'
+    Dalan->>Ranj: 400. message: '2FA has been already enabled for this account'
+    Dalan->>Ranj: 400, message: '2FA hasnt been enable'(didnt start enabling process)
+    Dalan->>Ranj: 422, message: 'OTP code is invalid'
+    Dalan->>Ranj: 200
+    Ranj->>User: success
+```
+
+```mermaid
+sequenceDiagram
+    title: 2fa deactivation
+    User->>Ranj: enter google authentication code
+    Ranj-->>Dalan: post /disable params:{code:string}
+    Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing'
+    Dalan->>Ranj: 401, message: 'Invalid bearer token'
+    Dalan->>Ranj: 422, message: 'Validation errors'
+    Dalan->>Ranj: 422, message: 'OTP code is invalid'
+    Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(disabling process started)'
+    Ranj->>User: show result
+    Dalan->>User: send email in case of success
+    User->>Ranj: enter authorization code
+    Ranj-->>Dalan: post '/disable_email' params:{code:string}
+    Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing
+    Dalan->>Ranj: 401, message: 'Invalid bearer token'
+    Dalan->>Ranj: 422, message: 'Validation errors'
+    Dalan->>Ranj: 400. message: '2FA has been already disabled for this account'
+    Dalan->>Ranj: 400, message: '2FA has been already sent email for this account'(didnt start enabling process)
+    Dalan->>Ranj: 422, message: 'OTP code is invalid'
+    Dalan->>Ranj: 200
+    Ranj->>User: success
+```
+
+