Purpose

Modification  existing WS: Create a user:

• Add handling logic for return different type of tokens by 2FA_Statuses (2fa_access_token, access_token)
• Add logic for process authorization 2 factor via OTP
• Add logic for process resend OTP via create new token (grant_type = resend_otp)

Request parameters

Add handling logic for combinations of request parameters:

ONE OF:  

- grant_type = "password"
- email
- password
- client_id
- scope = "app:authorize"

OR

- grant_type = "authorize_2fa_access_token"
- token = 2fa_access_token
- otp 

OR

- grant_type = "refresh_2fa_access_token" 
- token = 2fa_access_token

Peculiar properties of 2fa_access_token

 An 2FA flow feature implementation, we need restrict ability call WS: Approvals with `2fa_access_token`, and allow call WS: Approvals with `access_token ()`.

It means the following 

Anchor
CREATE_2FA_TOKEN CREATE_2FA_TOKEN

Сase `CREATE_2FA_TOKEN` (grant_type = "password")

Purpose

Add handling logic for return different type of tokens by user 2FA Status.

• if 2FA = disable, return access_token
• if 2FA = enable, return 2fa_access_token , create & send OTP OTP

Check ability login with invalid  password per same period.

Logic WS

• Check login exist
  • If login exist
  • Get user by $.email
  • Validate user `is_blocked` flag
    • if is_blocked = TRUE
    • return 4xx 401 - "User blocked" (!!! TBD)
  • Validate user.password = $.password
  • If invalid -  Update user (set values) by $.user_id
    • Increment `users.priv_settings.login_error_counter` (+1)
    • If `users.priv_settings.login_error_counter` > USER_LOGIN_ERROR_MAX
      • Blocked user - update user (set values) by $.user_id
        • is_blocked = TRUE
        • block_reason = "OTP verify attempts more then USER_LOGIN_ERROR_MAX"
        • updated_at = now()
  • Check ability login (see section on page below) 

• Get active 2FA item for non-blocked user by $.user_id

  Code Block
  language sql
  SELECT * FROM authentication_factors AS 2FA INNER JOIN user AS U ON 2FA.user_id = U.id WHERE U.id = $.user_id AND U.is_active = TRUE AND U.is_blocked = FALSE AND 2FA.is_active = TRUE

  • If exist 2FA active item with empty factor.  
    • Add to response `urgent.next_step` = REQUEST_FACTOR
    • create new & return 2fa_access_token + code 201
  • If  exist 2FA active item for user with non-empty factor - go to new process authentication with 2FA
    
    • invoke OTP timeout procedure
    • If successful - invoke proc `create_OTP()`
    • If OTP successful sending: add to response `urgent.next_step` = REQUEST_OTP
      • else: add to response `urgent.next_step` = RESEND_OTP
    • create new & return 2fa_access_token + code 201
  • If not exist 2FA active item for user  go to standart process without 2FA
    • Add to response `urgent.next_step` = REQUEST_APPS 
    • create new &return access_token+ code 201

Response

• 201 if token successful create & return
• 4xx in other case

Check ability login

Purpose 

We store fail attempts (existing user/login + invalid password) in array at `user.priv_settings.login_hstr` and validate count such logins above limit.

Logic 

• Sort array `login_hstr[]` DESC by `time`
• Get count() items with `type = "password"` from array for period from `now()` to `now() - MAX_FAILED_LOGINS_PERIOD`
• IF count() >= MAX_FAILED_LOGINS THEN
  • return 401 error + message “You reached login attempts limit. Try again later”
• ELSE
  • clear otp_hstr[] for `type = "password"`