MFA v1 - TOTP #2830
MFA v1 - TOTP #2830
Conversation
… store encrypted secrets
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #2830 +/- ##
===========================================
- Coverage 56.21% 55.97% -0.24%
===========================================
Files 215 219 +4
Lines 10231 10454 +223
Branches 1046 1061 +15
===========================================
+ Hits 5751 5852 +101
- Misses 4464 4586 +122
Partials 16 16 ☔ View full report in Codecov by Sentry. |
care/emr/api/viewsets/totp.py
Outdated
| return Response({"backup_codes": backup_codes}) | ||
|
|
||
| @staticmethod | ||
| def _check_totp_enabled(mfa_settings: dict): |
There was a problem hiding this comment.
This function should return either true or false and let the implementer write the exception.
There was a problem hiding this comment.
This function should return either true or false and let the implementer write the exception.
Yeah, I thought this was the expected way when writting this method but wrote the exception inside the_check_totp_enabled as the exception is same for all three methods which are calling this so trying to not repeat the code made me write this way and also this will make understanding the code little tough and also misleading with its method name.
Will fix it 👍
care/emr/api/viewsets/totp.py
Outdated
| user = User.objects.get(external_id=token["user_id"]) | ||
| totp = TOTP(decrypt_string(user.totp_secret)) | ||
|
|
||
| if totp.verify(request_data.code): |
There was a problem hiding this comment.
How is the backup code used here? the backup codes are maintained by us or the package?
There was a problem hiding this comment.
By us, pyotp does not provide out of the box
- Add rate limiting to login - 5 min expiry to the temp token - Use proper Errors instead of Response - Add valid window to TOTP.verify - Remove Blacklisting of temp token
Proposed Changes
This pull request introduces a new feature for Two-Factor Authentication (2FA) using Time-based One-Time Password (TOTP). The changes include updates to various files to support TOTP setup, verification, and login processes.
New TOTP Feature Implementation:
care/emr/api/viewsets/totp.py: Added a newTOTPViewSetclass to handle TOTP setup, verification, and login. This includes methods for generating backup codes, encrypting/decrypting TOTP secrets, and handling TOTP-related requests.care/users/migrations/0022_user_mfa_settings_user_totp_secret.py: Added a migration to includemfa_settingsandtotp_secretfields in theUsermodel.care/users/models.py: Updated theUsermodel to includetotp_secretandmfa_settingsfields.care/utils/encryption.py: Added utility functions for encrypting and decrypting strings using Fernet.config/api_router.py: Registered the newTOTPViewSetin the API router. [1] [2]Configuration and Dependencies:
.env.example: AddedTOTP_SECRET_ENCRYPTION_KEYto the environment variables.Pipfile: Added thepyotplibrary as a dependency for TOTP functionality.config/settings/base.py: AddedTOTP_SECRET_ENCRYPTION_KEYto the settings.docker/.local.env: AddedTOTP_SECRET_ENCRYPTION_KEYto the local environment variables.docker/.prebuilt.env: AddedTOTP_SECRET_ENCRYPTION_KEYto the prebuilt environment variables.Authentication Updates:
config/auth_views.py: Updated theTokenObtainPairSerializerandTokenRefreshSerializerto handle temporary tokens for TOTP verification during login. [1] [2] [3]Associated Issue
TOTP Feature Implementation:
care/emr/api/viewsets/totp.py: Added a newTOTPViewSetclass with endpoints for TOTP setup, verification, login, disabling, and backup code management.care/emr/tasks/totp.py: Added tasks to send email notifications when TOTP is enabled or disabled.care/templates/email/totp_enabled.html: Created an email template for TOTP enabled notifications.care/templates/email/totp_disabled.html: Created an email template for TOTP disabled notifications.User Model and Migration:
care/users/models.py: Addedtotp_secretandmfa_settingsfields to theUsermodel.care/users/migrations/0022_user_mfa_settings_user_totp_secret.py: Created a migration to add the new fields to theUsermodel.Encryption Utilities:
care/utils/encryption.py: Added utility functions for encrypting and decrypting strings using Fernet.Configuration and Environment Variables:
.env.example,docker/.local.env,docker/.prebuilt.env,config/settings/base.py: AddedTOTP_SECRET_ENCRYPTION_KEYto environment variables and settings. [1] [2] [3] [4]API Router and Authentication:
config/api_router.py: Registered the newTOTPViewSetwith the API router. [1] [2]config/auth_views.py: Updated token serializers to handle temporary tokens for TOTP verification during login. [1] [2] [3]Dependency Updates:
Pipfile: Addedpyotpdependency for TOTP functionality.Merge Checklist
/docsOnly PR's with test cases included and passing lint and test pipelines will be reviewed
@ohcnetwork/care-backend-maintainers @ohcnetwork/care-backend-admins