105 lines
4.0 KiB
Markdown
105 lines
4.0 KiB
Markdown
#Registration: 2FA
|
|
###### Sprint: 2
|
|
|
|
### Outcome:
|
|
2 factor authentication is a feature that helps users to secure their activities.
|
|
For critical activities the app needs a code to be completed.
|
|
At first vault creates a code (that showed with QR) to sync with google authenticator.
|
|
After adding code in the user's google authenticator, every time a user needs OTP(one-time-password) can read it in his app.
|
|
|
|
### Implementation description:
|
|
|
|
#### Endpoints:
|
|
GET {$domain}/api/v2/barong/resource/otp/generate_qrcode
|
|
|
|
POST {$domain}/api/v2/barong/resource/otp/enable
|
|
|
|
POST {$domain}/api/v2/barong/resource/otp/enable_2fa
|
|
|
|
POST {$domain}/api/v2/barong/resource/otp/disable
|
|
|
|
POST {$domain}/api/v2/barong/resource/otp/disable_email
|
|
|
|
#### File destination:
|
|
{$Dalan_Path}/app/api/v2/resource/otp.rb
|
|
|
|
#### Commits:
|
|
bd7f980596
|
|
dc95b308a6
|
|
b3b5a08d60
|
|
3c170120c1
|
|
a79e06a71b
|
|
8c821f1ba4
|
|
e04a58b012
|
|
99c2552404
|
|
63f69ed0d6
|
|
7010449976
|
|
4d55a48572
|
|
2da71b1097
|
|
|
|
#### What did we implement:
|
|
|
|
We add an authorization step to enable/disable 2FA. After entering the google authenticator code, an authorization email is sent to the user containing an OTP . Users only can enable or disable 2FA after entering the correct OTP from the email.
|
|
|
|
New flow:
|
|
|
|
System generates the code → User scan it with mobile → enters the google code → Receives the email →The user enters the code → 2FA enable/disable
|
|
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
title: 2fa activation
|
|
User->>Ranj: generate Qr Code
|
|
Ranj-->>Dalan: get /generate_qrcode
|
|
Dalan->>Ranj: 400, message: '2FA has been enabled for this account'
|
|
Dalan->>Ranj: 401, message: 'Invalid bearer token'
|
|
Dalan->>Ranj: 400, message: '2FA has been already sent email for this account(enabling process started)'
|
|
Dalan->>Ranj: 200, QR params
|
|
Ranj->>User: QR
|
|
User->>Ranj: User scan and enter code
|
|
Ranj-->>Dalan: post /enable params:{code:string}
|
|
Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing'
|
|
Dalan->>Ranj: 401, message: 'Invalid bearer token'
|
|
Dalan->>Ranj: 422, message: 'Validation errors'
|
|
Dalan->>Ranj: 422, message: 'OTP code is invalid'
|
|
Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(enabling process started)'
|
|
Ranj->>User: show result
|
|
Dalan->>User: send email in case of success
|
|
User->>Ranj: enter authorization code
|
|
Ranj-->>Dalan: post '/enable_2fa' params:{code:string}
|
|
Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing
|
|
Dalan->>Ranj: 401, message: 'Invalid bearer token'
|
|
Dalan->>Ranj: 422, message: 'Validation errors'
|
|
Dalan->>Ranj: 400. message: '2FA has been already enabled for this account'
|
|
Dalan->>Ranj: 400, message: '2FA hasnt been enable'(didnt start enabling process)
|
|
Dalan->>Ranj: 422, message: 'OTP code is invalid'
|
|
Dalan->>Ranj: 200
|
|
Ranj->>User: success
|
|
```
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
title: 2fa deactivation
|
|
User->>Ranj: enter google authentication code
|
|
Ranj-->>Dalan: post /disable params:{code:string}
|
|
Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing'
|
|
Dalan->>Ranj: 401, message: 'Invalid bearer token'
|
|
Dalan->>Ranj: 422, message: 'Validation errors'
|
|
Dalan->>Ranj: 422, message: 'OTP code is invalid'
|
|
Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(disabling process started)'
|
|
Ranj->>User: show result
|
|
Dalan->>User: send email in case of success
|
|
User->>Ranj: enter authorization code
|
|
Ranj-->>Dalan: post '/disable_email' params:{code:string}
|
|
Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing
|
|
Dalan->>Ranj: 401, message: 'Invalid bearer token'
|
|
Dalan->>Ranj: 422, message: 'Validation errors'
|
|
Dalan->>Ranj: 400. message: '2FA has been already disabled for this account'
|
|
Dalan->>Ranj: 400, message: '2FA has been already sent email for this account'(didnt start enabling process)
|
|
Dalan->>Ranj: 422, message: 'OTP code is invalid'
|
|
Dalan->>Ranj: 200
|
|
Ranj->>User: success
|
|
```
|
|
|
|
|