Skip to content

Commit bd343f0

Browse files
lakhansamanilakhansamani
committed
fix: disable totp by default
1 parent ad8bd64 commit bd343f0

File tree

4 files changed

+62
-78
lines changed

4 files changed

+62
-78
lines changed

‎dashboard/src/components/EnvComponents/Features.tsx‎

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ const Features = ({ variables, setVariables }: any) => {
2525
</Flex>
2626
</Flex>
2727

28-
2928
<Flex>
3029
<Flex w="100%" justifyContent="start" alignItems="center">
3130
<Text fontSize="sm">Email Verification:</Text>
@@ -109,15 +108,12 @@ const Features = ({ variables, setVariables }: any) => {
109108
/>
110109
</Flex>
111110
</Flex>
112-
113-
{
114-
!variables.DISABLE_MULTI_FACTOR_AUTHENTICATION &&
111+
{/** TODO enable after final release */}
112+
{/* {!variables.DISABLE_MULTI_FACTOR_AUTHENTICATION && (
115113
<Flex alignItems="center">
116114
<Flex w="100%" alignItems="baseline" flexDir="column">
117115
<Text fontSize="sm">TOTP:</Text>
118-
<Text fontSize="x-small">
119-
Note: to enable totp mfa
120-
</Text>
116+
<Text fontSize="x-small">Note: to enable totp mfa</Text>
121117
</Flex>
122118
123119
<Flex justifyContent="start" mb={3}>
@@ -129,25 +125,24 @@ const Features = ({ variables, setVariables }: any) => {
129125
/>
130126
</Flex>
131127
</Flex>
132-
}
133-
{!variables.DISABLE_MULTI_FACTOR_AUTHENTICATION &&
128+
)} */}
129+
{!variables.DISABLE_MULTI_FACTOR_AUTHENTICATION && (
134130
<Flex alignItems="center">
135-
<Flex w="100%" alignItems="baseline" flexDir="column">
136-
<Text fontSize="sm">EMAIL OTP:</Text>
137-
<Text fontSize="x-small">
138-
Note: to enable email otp mfa
139-
</Text>
140-
</Flex>
131+
<Flex w="100%" alignItems="baseline" flexDir="column">
132+
<Text fontSize="sm">EMAIL OTP:</Text>
133+
<Text fontSize="x-small">Note: to enable email otp mfa</Text>
134+
</Flex>
141135

142-
<Flex justifyContent="start" mb={3}>
143-
<InputField
144-
variables={variables}
145-
setVariables={setVariables}
146-
inputType={SwitchInputType.DISABLE_MAIL_OTP_LOGIN}
147-
hasReversedValue
148-
/>
149-
</Flex>
150-
</Flex>}
136+
<Flex justifyContent="start" mb={3}>
137+
<InputField
138+
variables={variables}
139+
setVariables={setVariables}
140+
inputType={SwitchInputType.DISABLE_MAIL_OTP_LOGIN}
141+
hasReversedValue
142+
/>
143+
</Flex>
144+
</Flex>
145+
)}
151146

152147
<Flex alignItems="center">
153148
<Flex w="100%" alignItems="baseline" flexDir="column">

‎server/env/env.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -834,9 +834,10 @@ func InitAllEnv() error {
834834
envData[constants.EnvKeyDisablePlayGround] = boolValue
835835
}
836836
}
837-
837+
// TODO: remove after beta launch
838+
envData[constants.EnvKeyDisableTOTPLogin] = true
838839
if _, ok := envData[constants.EnvKeyDisableTOTPLogin]; !ok {
839-
envData[constants.EnvKeyDisableTOTPLogin] = osDisableTOTPLogin == "false"
840+
envData[constants.EnvKeyDisableTOTPLogin] = osDisableTOTPLogin == "true"
840841
}
841842
if osDisableTOTPLogin != "" {
842843
boolValue, err := strconv.ParseBool(osDisableTOTPLogin)
@@ -847,6 +848,7 @@ func InitAllEnv() error {
847848
envData[constants.EnvKeyDisableTOTPLogin] = boolValue
848849
}
849850
}
851+
fmt.Println("=> final value", envData[constants.EnvKeyDisableTOTPLogin])
850852

851853
if _, ok := envData[constants.EnvKeyDisableMailOTPLogin]; !ok {
852854
envData[constants.EnvKeyDisableMailOTPLogin] = osDisableMailOTPLogin == "true"

‎server/resolvers/login.go‎

Lines changed: 38 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -182,45 +182,6 @@ func LoginResolver(ctx context.Context, params model.LoginInput) (*model.AuthRes
182182
}
183183
return otpData, nil
184184
}
185-
// If mfa enabled and also totp enabled
186-
// first priority is given to totp
187-
if refs.BoolValue(user.IsMultiFactorAuthEnabled) && !isMFADisabled && !isTOTPLoginDisabled {
188-
expiresAt := time.Now().Add(3 * time.Minute).Unix()
189-
if err := setOTPMFaSession(expiresAt); err != nil {
190-
log.Debug("Failed to set mfa session: ", err)
191-
return nil, err
192-
}
193-
authenticator, err := db.Provider.GetAuthenticatorDetailsByUserId(ctx, user.ID, constants.EnvKeyTOTPAuthenticator)
194-
// Check if it's the first time user or if their TOTP is not verified
195-
if err != nil || ((authenticator == nil) || (authenticator != nil && authenticator.VerifiedAt == nil)) {
196-
// Generate a base64 URL and initiate the registration for TOTP
197-
authConfig, err := authenticators.Provider.Generate(ctx, user.ID)
198-
if err != nil {
199-
log.Debug("error while generating base64 url: ", err)
200-
return nil, err
201-
}
202-
recoveryCodes := []*string{}
203-
for _, code := range authConfig.RecoveryCodes {
204-
recoveryCodes = append(recoveryCodes, refs.NewStringRef(code))
205-
}
206-
// when user is first time registering for totp
207-
res = &model.AuthResponse{
208-
Message: `Proceed to totp verification screen`,
209-
ShouldShowTotpScreen: refs.NewBoolRef(true),
210-
AuthenticatorScannerImage: refs.NewStringRef(authConfig.ScannerImage),
211-
AuthenticatorSecret: refs.NewStringRef(authConfig.Secret),
212-
AuthenticatorRecoveryCodes: recoveryCodes,
213-
}
214-
return res, nil
215-
} else {
216-
//when user is already register for totp
217-
res = &model.AuthResponse{
218-
Message: `Proceed to totp screen`,
219-
ShouldShowTotpScreen: refs.NewBoolRef(true),
220-
}
221-
return res, nil
222-
}
223-
}
224185
// If multi factor authentication is enabled and is email based login and email otp is enabled
225186
if refs.BoolValue(user.IsMultiFactorAuthEnabled) && !isMFADisabled && !isMailOTPDisabled && isEmailServiceEnabled && isEmailLogin {
226187
expiresAt := time.Now().Add(1 * time.Minute).Unix()
@@ -275,6 +236,44 @@ func LoginResolver(ctx context.Context, params model.LoginInput) (*model.AuthRes
275236
ShouldShowMobileOtpScreen: refs.NewBoolRef(isMobileLogin),
276237
}, nil
277238
}
239+
// If mfa enabled and also totp enabled
240+
if refs.BoolValue(user.IsMultiFactorAuthEnabled) && !isMFADisabled && !isTOTPLoginDisabled {
241+
expiresAt := time.Now().Add(3 * time.Minute).Unix()
242+
if err := setOTPMFaSession(expiresAt); err != nil {
243+
log.Debug("Failed to set mfa session: ", err)
244+
return nil, err
245+
}
246+
authenticator, err := db.Provider.GetAuthenticatorDetailsByUserId(ctx, user.ID, constants.EnvKeyTOTPAuthenticator)
247+
// Check if it's the first time user or if their TOTP is not verified
248+
if err != nil || ((authenticator == nil) || (authenticator != nil && authenticator.VerifiedAt == nil)) {
249+
// Generate a base64 URL and initiate the registration for TOTP
250+
authConfig, err := authenticators.Provider.Generate(ctx, user.ID)
251+
if err != nil {
252+
log.Debug("error while generating base64 url: ", err)
253+
return nil, err
254+
}
255+
recoveryCodes := []*string{}
256+
for _, code := range authConfig.RecoveryCodes {
257+
recoveryCodes = append(recoveryCodes, refs.NewStringRef(code))
258+
}
259+
// when user is first time registering for totp
260+
res = &model.AuthResponse{
261+
Message: `Proceed to totp verification screen`,
262+
ShouldShowTotpScreen: refs.NewBoolRef(true),
263+
AuthenticatorScannerImage: refs.NewStringRef(authConfig.ScannerImage),
264+
AuthenticatorSecret: refs.NewStringRef(authConfig.Secret),
265+
AuthenticatorRecoveryCodes: recoveryCodes,
266+
}
267+
return res, nil
268+
} else {
269+
//when user is already register for totp
270+
res = &model.AuthResponse{
271+
Message: `Proceed to totp screen`,
272+
ShouldShowTotpScreen: refs.NewBoolRef(true),
273+
}
274+
return res, nil
275+
}
276+
}
278277

279278
code := ""
280279
codeChallenge := ""

‎server/resolvers/update_env.go‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,6 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
261261
}
262262
if !updatedData[constants.EnvKeyDisableMagicLinkLogin].(bool) {
263263
updatedData[constants.EnvKeyDisableMailOTPLogin] = true
264-
updatedData[constants.EnvKeyDisableTOTPLogin] = false
265264
}
266265
}
267266

@@ -276,19 +275,8 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
276275
}
277276
}
278277

279-
if updatedData[constants.EnvKeyDisableMultiFactorAuthentication].(bool) {
280-
updatedData[constants.EnvKeyDisableTOTPLogin] = true
278+
if updatedData[constants.EnvKeyDisableMultiFactorAuthentication].(bool) && updatedData[constants.EnvKeyIsEmailServiceEnabled].(bool) {
281279
updatedData[constants.EnvKeyDisableMailOTPLogin] = true
282-
} else {
283-
if !updatedData[constants.EnvKeyDisableMailOTPLogin].(bool) && !updatedData[constants.EnvKeyDisableTOTPLogin].(bool) {
284-
errors.New("can't enable both mfa methods at same time")
285-
updatedData[constants.EnvKeyDisableMailOTPLogin] = true
286-
updatedData[constants.EnvKeyDisableTOTPLogin] = false
287-
} else if updatedData[constants.EnvKeyDisableMailOTPLogin].(bool) && updatedData[constants.EnvKeyDisableTOTPLogin].(bool) {
288-
errors.New("can't disable both mfa methods at same time")
289-
updatedData[constants.EnvKeyDisableMailOTPLogin] = true
290-
updatedData[constants.EnvKeyDisableTOTPLogin] = false
291-
}
292280
}
293281

294282
if !currentData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) && updatedData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) && !updatedData[constants.EnvKeyDisableMultiFactorAuthentication].(bool) {

0 commit comments

Comments
 (0)