Support reset password by OTP in Authflow and auth ui

ref #3501
ref #3502

Author: louischan-oursky

pkg/auth/deps.go

@@ -238,7 +238,7 @@ func ProvideUIFeatureConfig() *config.UIFeatureConfig {
 
 func ProvideForgotPasswordConfig() *config.ForgotPasswordConfig {
 	c := &config.ForgotPasswordConfig{}
-	c.SetDefaults()
+	config.SetFieldDefaults(c)
 	return c
 }
 

pkg/auth/handler/webapp/authflow_controller.go

@@ -117,7 +117,13 @@ type AuthflowController struct {
 	OAuthClientResolver AuthflowControllerOAuthClientResolver
 }
 
-func (c *AuthflowController) HandleStartOfFlow(w http.ResponseWriter, r *http.Request, opts webapp.SessionOptions, flowReference authflow.FlowReference, handlers *AuthflowControllerHandlers) {
+func (c *AuthflowController) HandleStartOfFlow(
+	w http.ResponseWriter,
+	r *http.Request,
+	opts webapp.SessionOptions,
+	flowReference authflow.FlowReference,
+	handlers *AuthflowControllerHandlers,
+	input interface{}) {
 	if err := r.ParseForm(); err != nil {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
@@ -135,10 +141,10 @@ func (c *AuthflowController) HandleStartOfFlow(w http.ResponseWriter, r *http.Re
 		handler.ServeHTTP(w, r)
 	}
 
-	screen, err := c.getScreen(s, GetXStepFromQuery(r))
+	screen, err := c.GetScreen(s, GetXStepFromQuery(r))
 	if err != nil {
 		if errors.Is(err, authflow.ErrFlowNotFound) {
-			screen, err := c.createScreen(r, s, flowReference)
+			screen, err := c.createScreen(r, s, flowReference, input)
 			if err != nil {
 				c.Logger.WithError(err).Errorf("failed to create screen")
 				c.renderError(w, r, err)
@@ -183,7 +189,7 @@ func (c *AuthflowController) HandleOAuthCallback(w http.ResponseWriter, r *http.
 		return
 	}
 
-	screen, err := c.getScreen(s, state.XStep)
+	screen, err := c.GetScreen(s, state.XStep)
 	if err != nil {
 		c.Logger.WithError(err).Errorf("failed to get screen")
 		c.renderError(w, r, err)
@@ -251,7 +257,7 @@ func (c *AuthflowController) HandleResumeOfFlow(
 		return
 	}
 
-	screen, err := c.createScreenWithOutput(r, s, output)
+	screen, err := c.createScreenWithOutput(r, s, output, "")
 	if err != nil {
 		c.Logger.WithError(err).Errorf("failed to create screen")
 		handleError(err)
@@ -283,7 +289,7 @@ func (c *AuthflowController) HandleStep(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	screen, err := c.getScreen(s, GetXStepFromQuery(r))
+	screen, err := c.GetScreen(s, GetXStepFromQuery(r))
 	if err != nil {
 		c.Logger.WithError(err).Errorf("failed to get screen")
 		c.renderError(w, r, err)
@@ -345,7 +351,7 @@ func (c *AuthflowController) getOrCreateWebSession(w http.ResponseWriter, r *htt
 	return s, nil
 }
 
-func (c *AuthflowController) getScreen(s *webapp.Session, xStep string) (*webapp.AuthflowScreenWithFlowResponse, error) {
+func (c *AuthflowController) GetScreen(s *webapp.Session, xStep string) (*webapp.AuthflowScreenWithFlowResponse, error) {
 	if s.Authflow == nil {
 		return nil, authflow.ErrFlowNotFound
 	}
@@ -469,11 +475,11 @@ func (c *AuthflowController) createScreenWithOutput(
 	r *http.Request,
 	s *webapp.Session,
 	output *authflow.ServiceOutput,
+	prevXStep string,
 ) (*webapp.AuthflowScreenWithFlowResponse, error) {
 	flowResponse := output.ToFlowResponse()
-	emptyXStep := ""
 	var emptyInput map[string]interface{}
-	screen := webapp.NewAuthflowScreenWithFlowResponse(&flowResponse, emptyXStep, emptyInput)
+	screen := webapp.NewAuthflowScreenWithFlowResponse(&flowResponse, prevXStep, emptyInput)
 	s.RememberScreen(screen)
 
 	output, screen, err := c.takeBranchRecursively(s, screen)
@@ -491,21 +497,42 @@ func (c *AuthflowController) createScreenWithOutput(
 	return screen, nil
 }
 
-func (c *AuthflowController) createScreen(r *http.Request, s *webapp.Session, flowReference authflow.FlowReference) (screen *webapp.AuthflowScreenWithFlowResponse, err error) {
-	output, err := c.createAuthflow(r, s, flowReference)
+func (c *AuthflowController) createScreen(
+	r *http.Request,
+	s *webapp.Session,
+	flowReference authflow.FlowReference,
+	input interface{}) (screen *webapp.AuthflowScreenWithFlowResponse, err error) {
+	output1, err := c.createAuthflow(r, s, flowReference)
 	if err != nil {
 		return
 	}
 
-	screen, err = c.createScreenWithOutput(r, s, output)
+	screen, err = c.createScreenWithOutput(r, s, output1, "")
 	if err != nil {
 		return
 	}
+
+	if input != nil {
+		output2, err := c.feedInput(output1.Flow.StateToken, input)
+		if err != nil {
+			return nil, err
+		}
+		screen, err = c.createScreenWithOutput(r, s, output2, screen.Screen.StateToken.XStep)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	return
 }
 
 // AdvanceWithInput is for feeding an input that would advance the flow.
-func (c *AuthflowController) AdvanceWithInput(r *http.Request, s *webapp.Session, screen0 *webapp.AuthflowScreenWithFlowResponse, input map[string]interface{}) (result *webapp.Result, err error) {
+func (c *AuthflowController) AdvanceWithInput(
+	r *http.Request,
+	s *webapp.Session,
+	screen0 *webapp.AuthflowScreenWithFlowResponse,
+	input map[string]interface{},
+) (result *webapp.Result, err error) {
 	result = &webapp.Result{}
 
 	output1, err := c.feedInput(screen0.Screen.StateToken.StateToken, input)
@@ -540,10 +567,21 @@ func (c *AuthflowController) AdvanceWithInput(r *http.Request, s *webapp.Session
 			return
 		}
 
-		// Forget the session.
-		result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(c.SessionCookie.Def))
-		// Reset visitor ID.
-		result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(webapp.VisitorIDCookieDef))
+		switch flowResponse2.Type {
+		case authflow.FlowTypeLogin:
+			fallthrough
+		case authflow.FlowTypePromote:
+			fallthrough
+		case authflow.FlowTypeSignup:
+			fallthrough
+		case authflow.FlowTypeReauth:
+			// Forget the session.
+			result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(c.SessionCookie.Def))
+			// Reset visitor ID.
+			result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(webapp.VisitorIDCookieDef))
+		default:
+			// Do nothing for other flows
+		}
 	} else {
 		now := c.Clock.NowUTC()
 		s.UpdatedAt = now
@@ -748,7 +786,7 @@ func (c *AuthflowController) makeHTTPHandler(s *webapp.Session, screen *webapp.A
 
 func (c *AuthflowController) takeBranch(w http.ResponseWriter, r *http.Request, s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
 	xStepAtBranch := screen.Screen.BranchStateToken.XStep
-	screen, err := c.getScreen(s, xStepAtBranch)
+	screen, err := c.GetScreen(s, xStepAtBranch)
 	if err != nil {
 		return err
 	}

pkg/auth/handler/webapp/authflow_controller_test.go

@@ -85,7 +85,7 @@ func TestAuthflowControllerGetScreen(t *testing.T) {
 		Convey("return ErrFlowNotFound if session has no authflow", func() {
 			s := &webapp.Session{}
 
-			_, err := c.getScreen(s, "")
+			_, err := c.GetScreen(s, "")
 			So(err, ShouldBeError, authflow.ErrFlowNotFound)
 		})
 
@@ -116,7 +116,7 @@ func TestAuthflowControllerGetScreen(t *testing.T) {
 				},
 			}
 
-			_, err := c.getScreen(s, "")
+			_, err := c.GetScreen(s, "")
 			So(errors.Is(err, authflow.ErrFlowNotFound), ShouldBeTrue)
 		})
 
@@ -154,7 +154,7 @@ func TestAuthflowControllerGetScreen(t *testing.T) {
 				},
 			}, nil)
 
-			actual, err := c.getScreen(s, "step_1")
+			actual, err := c.GetScreen(s, "step_1")
 			So(err, ShouldBeNil)
 			So(actual, ShouldResemble, &webapp.AuthflowScreenWithFlowResponse{
 				Screen: screen1,
@@ -207,7 +207,7 @@ func TestAuthflowControllerCreateScreen(t *testing.T) {
 			screen, err := c.createScreen(r, s, authflow.FlowReference{
 				Type: authflow.FlowTypeLogin,
 				Name: "default",
-			})
+			}, nil)
 			So(err, ShouldBeNil)
 			So(screen, ShouldNotBeNil)
 			So(string(screen.BranchStateTokenFlowResponse.Type), ShouldEqual, "login")

pkg/auth/handler/webapp/authflow_forgot_password.go

@@ -41,13 +41,17 @@ type AuthFlowForgotPasswordViewModel struct {
 	PhoneLoginIDEnabled bool
 	EmailLoginIDEnabled bool
 	LoginIDDisabled     bool
+	OTPForm             string
 }
 
-func NewAuthFlowForgotPasswordViewModel(r *http.Request, screen *webapp.AuthflowScreenWithFlowResponse) AuthFlowForgotPasswordViewModel {
+func NewAuthFlowForgotPasswordViewModel(
+	r *http.Request,
+	initialScreen *webapp.AuthflowScreenWithFlowResponse,
+	selectDestinationScreen *webapp.AuthflowScreenWithFlowResponse) AuthFlowForgotPasswordViewModel {
 	loginIDInputType := r.Form.Get("q_login_id_input_type")
 	loginID := r.Form.Get("q_login_id")
 
-	data, ok := screen.StateTokenFlowResponse.Action.Data.(declarative.IntentAccountRecoveryFlowStepIdentifyData)
+	data, ok := initialScreen.StateTokenFlowResponse.Action.Data.(declarative.IntentAccountRecoveryFlowStepIdentifyData)
 	if !ok {
 		panic("authflow webapp: unexpected data")
 	}
@@ -66,12 +70,22 @@ func NewAuthFlowForgotPasswordViewModel(r *http.Request, screen *webapp.Authflow
 
 	loginIDDisabled := !phoneLoginIDEnabled && !emailLoginIDEnabled
 
+	otpForm := ""
+	if selectDestinationScreen != nil {
+		data2, ok := selectDestinationScreen.StateTokenFlowResponse.Action.
+			Data.(declarative.IntentAccountRecoveryFlowStepSelectDestinationData)
+		if ok && len(data2.Options) > 0 {
+			otpForm = string(data2.Options[0].OTPForm)
+		}
+	}
+
 	return AuthFlowForgotPasswordViewModel{
 		LoginIDInputType:    loginIDInputType,
 		LoginID:             loginID,
 		PhoneLoginIDEnabled: phoneLoginIDEnabled,
 		EmailLoginIDEnabled: emailLoginIDEnabled,
 		LoginIDDisabled:     loginIDDisabled,
+		OTPForm:             otpForm,
 	}
 }
 
@@ -81,13 +95,18 @@ type AuthflowForgotPasswordHandler struct {
 	Renderer      Renderer
 }
 
-func (h *AuthflowForgotPasswordHandler) GetData(w http.ResponseWriter, r *http.Request, s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) (map[string]interface{}, error) {
+func (h *AuthflowForgotPasswordHandler) GetData(
+	w http.ResponseWriter,
+	r *http.Request,
+	s *webapp.Session,
+	initialScreen *webapp.AuthflowScreenWithFlowResponse,
+	selectDestinationScreen *webapp.AuthflowScreenWithFlowResponse) (map[string]interface{}, error) {
 	data := make(map[string]interface{})
 
 	baseViewModel := h.BaseViewModel.ViewModelForAuthFlow(r, w)
 	viewmodels.Embed(data, baseViewModel)
 
-	screenViewModel := NewAuthFlowForgotPasswordViewModel(r, screen)
+	screenViewModel := NewAuthFlowForgotPasswordViewModel(r, initialScreen, selectDestinationScreen)
 	viewmodels.Embed(data, screenViewModel)
 
 	return data, nil
@@ -96,16 +115,34 @@ func (h *AuthflowForgotPasswordHandler) GetData(w http.ResponseWriter, r *http.R
 func (h *AuthflowForgotPasswordHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	flowName := "default"
 	var handlers AuthflowControllerHandlers
+
 	handlers.Get(func(s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
 
-		data, err := h.GetData(w, r, s, screen)
+		var screenIdentify *webapp.AuthflowScreenWithFlowResponse
+		var screenSelectDestination *webapp.AuthflowScreenWithFlowResponse
+
+		// screen can be identity or select_destination according to the query
+		switch config.AuthenticationFlowStepType(screen.StateTokenFlowResponse.Action.Type) {
+		case config.AuthenticationFlowStepTypeIdentify:
+			screenIdentify = screen
+		case config.AuthenticationFlowStepTypeSelectDestination:
+			screenSelectDestination = screen
+			var err error
+			screenIdentify, err = h.Controller.GetScreen(s, screen.Screen.PreviousXStep)
+			if err != nil {
+				return err
+			}
+		}
+
+		data, err := h.GetData(w, r, s, screenIdentify, screenSelectDestination)
 		if err != nil {
 			return err
 		}
 
 		h.Renderer.RenderHTML(w, r, TemplateWebAuthflowForgotPasswordHTML, data)
 		return nil
 	})
+
 	handlers.PostAction("", func(s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
 		err := AuthflowForgotPasswordSchema.Validator().ValidateValue(FormToJSON(r.Form))
 		if err != nil {
@@ -129,8 +166,20 @@ func (h *AuthflowForgotPasswordHandler) ServeHTTP(w http.ResponseWriter, r *http
 		return nil
 	})
 
+	identification := r.URL.Query().Get("q_login_id_input_type")
+	loginID := r.URL.Query().Get("q_login_id")
+
+	var input interface{} = nil
+
+	if identification != "" && loginID != "" {
+		input = map[string]interface{}{
+			"identification": identification,
+			"login_id":       loginID,
+		}
+	}
+
 	h.Controller.HandleStartOfFlow(w, r, webapp.SessionOptions{}, authflow.FlowReference{
 		Type: authflow.FlowTypeAccountRecovery,
 		Name: flowName,
-	}, &handlers)
+	}, &handlers, input)
 }