OTP recovery and verification strategy

cmd/clidoc/main.go

@@ -69,6 +69,7 @@ func init() {
 		"NewErrorValidationVerificationFlowExpired":               text.NewErrorValidationVerificationFlowExpired(-time.Second),
 		"NewInfoSelfServiceVerificationSuccessful":                text.NewInfoSelfServiceVerificationSuccessful(),
 		"NewVerificationEmailSent":                                text.NewVerificationEmailSent(),
+		"NewVerificationOTPSent":                                  text.NewVerificationOTPSent(),
 		"NewErrorValidationVerificationTokenInvalidOrAlreadyUsed": text.NewErrorValidationVerificationTokenInvalidOrAlreadyUsed(),
 		"NewErrorValidationVerificationRetrySuccess":              text.NewErrorValidationVerificationRetrySuccess(),
 		"NewErrorValidationVerificationStateFailure":              text.NewErrorValidationVerificationStateFailure(),
@@ -111,6 +112,7 @@ func init() {
 		"NewErrorValidationRecoveryFlowExpired":                   text.NewErrorValidationRecoveryFlowExpired(time.Second),
 		"NewRecoverySuccessful":                                   text.NewRecoverySuccessful(inAMinute),
 		"NewRecoveryEmailSent":                                    text.NewRecoveryEmailSent(),
+		"NewRecoveryOTPSent":                                      text.NewRecoveryOTPSent(),
 		"NewErrorValidationRecoveryTokenInvalidOrAlreadyUsed":     text.NewErrorValidationRecoveryTokenInvalidOrAlreadyUsed(),
 		"NewErrorValidationRecoveryRetrySuccess":                  text.NewErrorValidationRecoveryRetrySuccess(),
 		"NewErrorValidationRecoveryStateFailure":                  text.NewErrorValidationRecoveryStateFailure(),

courier/email_templates.go

@@ -24,12 +24,13 @@ type (
 )
 
 const (
-	TypeRecoveryInvalid     TemplateType = "recovery_invalid"
-	TypeRecoveryValid       TemplateType = "recovery_valid"
-	TypeVerificationInvalid TemplateType = "verification_invalid"
-	TypeVerificationValid   TemplateType = "verification_valid"
-	TypeOTP                 TemplateType = "otp"
-	TypeTestStub            TemplateType = "stub"
+	TypeRecoveryInvalid      TemplateType = "recovery_invalid"
+	TypeRecoveryValid        TemplateType = "recovery_valid"
+	TypeRecoveryValidOTP     TemplateType = "recovery_valid_otp"
+	TypeVerificationInvalid  TemplateType = "verification_invalid"
+	TypeVerificationValid    TemplateType = "verification_valid"
+	TypeVerificationValidOTP TemplateType = "verification_valid_otp"
+	TypeTestStub             TemplateType = "stub"
 )
 
 func GetEmailTemplateType(t EmailTemplate) (TemplateType, error) {
@@ -42,6 +43,10 @@ func GetEmailTemplateType(t EmailTemplate) (TemplateType, error) {
 		return TypeVerificationInvalid, nil
 	case *email.VerificationValid:
 		return TypeVerificationValid, nil
+	case *email.RecoveryValidOTP:
+		return TypeRecoveryValidOTP, nil
+	case *email.VerificationValidOTP:
+		return TypeVerificationValidOTP, nil
 	case *email.TestStub:
 		return TypeTestStub, nil
 	default:
@@ -75,6 +80,18 @@ func NewEmailTemplateFromMessage(d template.Dependencies, msg Message) (EmailTem
 			return nil, err
 		}
 		return email.NewVerificationValid(d, &t), nil
+	case TypeRecoveryValidOTP:
+		var t email.RecoveryValidOTPModel
+		if err := json.Unmarshal(msg.TemplateData, &t); err != nil {
+			return nil, err
+		}
+		return email.NewRecoveryValidOTP(d, &t), nil
+	case TypeVerificationValidOTP:
+		var t email.VerificationValidOTPModel
+		if err := json.Unmarshal(msg.TemplateData, &t); err != nil {
+			return nil, err
+		}
+		return email.NewVerificationValidOTP(d, &t), nil
 	case TypeTestStub:
 		var t email.TestStubModel
 		if err := json.Unmarshal(msg.TemplateData, &t); err != nil {

courier/sms_templates.go

@@ -17,8 +17,10 @@ type SMSTemplate interface {
 
 func SMSTemplateType(t SMSTemplate) (TemplateType, error) {
 	switch t.(type) {
-	case *sms.OTPMessage:
-		return TypeOTP, nil
+	case *sms.RecoveryMessage:
+		return TypeRecoveryValidOTP, nil
+	case *sms.VerificationMessage:
+		return TypeVerificationValidOTP, nil
 	case *sms.TestStub:
 		return TypeTestStub, nil
 	default:
@@ -28,12 +30,18 @@ func SMSTemplateType(t SMSTemplate) (TemplateType, error) {
 
 func NewSMSTemplateFromMessage(d Dependencies, m Message) (SMSTemplate, error) {
 	switch m.TemplateType {
-	case TypeOTP:
-		var t sms.OTPMessageModel
+	case TypeRecoveryValidOTP:
+		var t sms.RecoveryMessageModel
 		if err := json.Unmarshal(m.TemplateData, &t); err != nil {
 			return nil, err
 		}
-		return sms.NewOTPMessage(d, &t), nil
+		return sms.NewRecoveryOTPMessage(d, &t), nil
+	case TypeVerificationValidOTP:
+		var t sms.VerificationMessageModel
+		if err := json.Unmarshal(m.TemplateData, &t); err != nil {
+			return nil, err
+		}
+		return sms.NewVerificationOTPMessage(d, &t), nil
 	case TypeTestStub:
 		var t sms.TestStubModel
 		if err := json.Unmarshal(m.TemplateData, &t); err != nil {

courier/sms_templates_test.go

@@ -15,8 +15,9 @@ import (
 
 func TestSMSTemplateType(t *testing.T) {
 	for expectedType, tmpl := range map[courier.TemplateType]courier.SMSTemplate{
-		courier.TypeOTP:      &sms.OTPMessage{},
-		courier.TypeTestStub: &sms.TestStub{},
+		courier.TypeVerificationValidOTP: &sms.VerificationMessage{},
+		courier.TypeRecoveryValidOTP:     &sms.RecoveryMessage{},
+		courier.TypeTestStub:             &sms.TestStub{},
 	} {
 		t.Run(fmt.Sprintf("case=%s", expectedType), func(t *testing.T) {
 			actualType, err := courier.SMSTemplateType(tmpl)
@@ -31,8 +32,9 @@ func TestNewSMSTemplateFromMessage(t *testing.T) {
 	ctx := context.Background()
 
 	for tmplType, expectedTmpl := range map[courier.TemplateType]courier.SMSTemplate{
-		courier.TypeOTP:      sms.NewOTPMessage(reg, &sms.OTPMessageModel{To: "+12345678901"}),
-		courier.TypeTestStub: sms.NewTestStub(reg, &sms.TestStubModel{To: "+12345678901", Body: "test body"}),
+		courier.TypeVerificationValidOTP: sms.NewVerificationOTPMessage(reg, &sms.VerificationMessageModel{To: "+12345678901"}),
+		courier.TypeRecoveryValidOTP:     sms.NewRecoveryOTPMessage(reg, &sms.RecoveryMessageModel{To: "+12345678901"}),
+		courier.TypeTestStub:             sms.NewTestStub(reg, &sms.TestStubModel{To: "+12345678901", Body: "test body"}),
 	} {
 		t.Run(fmt.Sprintf("case=%s", tmplType), func(t *testing.T) {
 			tmplData, err := json.Marshal(expectedTmpl)

courier/template/courier/builtin/templates/otp/recovery/valid/email.body.gotmpl

@@ -0,0 +1,5 @@
+Hi,
+
+please recover access to your account by entering following code:
+
+{{ .Code }}

courier/template/courier/builtin/templates/otp/recovery/valid/email.body.plaintext.gotmpl

@@ -0,0 +1,5 @@
+Hi,
+
+please recover access to your account by entering following code:
+
+{{ .Code }}

courier/template/courier/builtin/templates/otp/recovery/valid/email.subject.gotmpl

@@ -0,0 +1 @@
+Recover access to your account

courier/template/courier/builtin/templates/otp/recovery/valid/sms.body.gotmpl

@@ -0,0 +1,2 @@
+Your recovery code is: {{ .Code }}.
+Don't share this code with anyone.

courier/template/courier/builtin/templates/otp/verification/valid/email.body.gotmpl

@@ -0,0 +1,5 @@
+Hi,
+
+please verify your account by entering following code:
+
+{{ .Code }}

courier/template/courier/builtin/templates/otp/verification/valid/email.body.plaintext.gotmpl

@@ -0,0 +1,5 @@
+Hi,
+
+please verify your account by entering following code:
+
+{{ .Code }}

courier/template/courier/builtin/templates/otp/verification/valid/email.subject.gotmpl

@@ -0,0 +1 @@
+Please verify your email address

courier/template/courier/builtin/templates/otp/verification/valid/sms.body.gotmpl

@@ -0,0 +1,2 @@
+Your verification code is: {{ .Code }}.
+Don't share this code with anyone.

courier/template/email/recovery_valid_otp.go

@@ -0,0 +1,57 @@
+package email
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"strings"
+
+	"github.com/ory/kratos/courier/template"
+)
+
+type (
+	RecoveryValidOTP struct {
+		d template.Dependencies
+		m *RecoveryValidOTPModel
+	}
+	RecoveryValidOTPModel struct {
+		To       string
+		Code     string
+		Identity map[string]interface{}
+	}
+)
+
+func NewRecoveryValidOTP(d template.Dependencies, m *RecoveryValidOTPModel) *RecoveryValidOTP {
+	return &RecoveryValidOTP{d: d, m: m}
+}
+
+func (t *RecoveryValidOTP) EmailRecipient() (string, error) {
+	return t.m.To, nil
+}
+
+func (t *RecoveryValidOTP) EmailSubject(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	subject := t.d.CourierConfig().CourierTemplatesRecoveryValid(ctx).Subject
+
+	subject, err := template.LoadText(ctx, t.d, templatesDir, "otp/recovery/valid/email.subject.gotmpl", "otp/recovery/valid/email.subject*", t.m, subject)
+
+	return strings.TrimSpace(subject), err
+}
+
+func (t *RecoveryValidOTP) EmailBody(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	body := t.d.CourierConfig().CourierTemplatesRecoveryValid(ctx).Body.HTML
+
+	return template.LoadHTML(ctx, t.d, templatesDir, "otp/recovery/valid/email.body.gotmpl", "otp/recovery/valid/email.body*", t.m, body)
+}
+
+func (t *RecoveryValidOTP) EmailBodyPlaintext(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	bodyPlaintext := t.d.CourierConfig().CourierTemplatesRecoveryValid(ctx).Body.PlainText
+
+	return template.LoadText(ctx, t.d, templatesDir, "otp/recovery/valid/email.body.plaintext.gotmpl", "otp/recovery/valid/email.body.plaintext*", t.m, bodyPlaintext)
+}
+
+func (t *RecoveryValidOTP) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.m)
+}

courier/template/email/recovery_valid_otp_test.go

@@ -0,0 +1,27 @@
+package email_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/ory/kratos/courier"
+	"github.com/ory/kratos/courier/template/email"
+	"github.com/ory/kratos/courier/template/testhelpers"
+	"github.com/ory/kratos/internal"
+)
+
+func TestRecoverValidOTP(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	t.Run("test=with courier templates directory", func(t *testing.T) {
+		_, reg := internal.NewFastRegistryWithMocks(t)
+		tpl := email.NewRecoveryValidOTP(reg, &email.RecoveryValidOTPModel{})
+
+		testhelpers.TestRendered(t, ctx, tpl)
+	})
+
+	t.Run("test=with remote resources", func(t *testing.T) {
+		testhelpers.TestRemoteTemplates(t, "../courier/builtin/templates/otp/recovery/valid", courier.TypeRecoveryValid)
+	})
+}

courier/template/email/verification_valid_otp.go

@@ -0,0 +1,57 @@
+package email
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"strings"
+
+	"github.com/ory/kratos/courier/template"
+)
+
+type (
+	VerificationValidOTP struct {
+		d template.Dependencies
+		m *VerificationValidOTPModel
+	}
+	VerificationValidOTPModel struct {
+		To       string
+		Code     string
+		Identity map[string]interface{}
+	}
+)
+
+func NewVerificationValidOTP(d template.Dependencies, m *VerificationValidOTPModel) *VerificationValidOTP {
+	return &VerificationValidOTP{d: d, m: m}
+}
+
+func (t *VerificationValidOTP) EmailRecipient() (string, error) {
+	return t.m.To, nil
+}
+
+func (t *VerificationValidOTP) EmailSubject(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	subject := t.d.CourierConfig().CourierTemplatesVerificationValid(ctx).Subject
+
+	subject, err := template.LoadText(ctx, t.d, templatesDir, "otp/verification/valid/email.subject.gotmpl", "otp/verification/valid/email.subject*", t.m, subject)
+
+	return strings.TrimSpace(subject), err
+}
+
+func (t *VerificationValidOTP) EmailBody(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	body := t.d.CourierConfig().CourierTemplatesVerificationValid(ctx).Body.HTML
+
+	return template.LoadHTML(ctx, t.d, templatesDir, "otp/verification/valid/email.body.gotmpl", "otp/verification/valid/email.body*", t.m, body)
+}
+
+func (t *VerificationValidOTP) EmailBodyPlaintext(ctx context.Context) (string, error) {
+	templatesDir := os.DirFS(t.d.CourierConfig().CourierTemplatesRoot(ctx))
+	plaintextBody := t.d.CourierConfig().CourierTemplatesVerificationValid(ctx).Body.PlainText
+
+	return template.LoadText(ctx, t.d, templatesDir, "otp/verification/valid/email.body.plaintext.gotmpl", "otp/verification/valid/email.body.plaintext*", t.m, plaintextBody)
+}
+
+func (t *VerificationValidOTP) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.m)
+}

courier/template/email/verification_valid_otp_test.go

@@ -0,0 +1,27 @@
+package email_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/ory/kratos/courier"
+	"github.com/ory/kratos/courier/template/email"
+	"github.com/ory/kratos/courier/template/testhelpers"
+	"github.com/ory/kratos/internal"
+)
+
+func TestVerifyValidOTP(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	t.Run("test=with courier templates directory", func(t *testing.T) {
+		_, reg := internal.NewFastRegistryWithMocks(t)
+		tpl := email.NewVerificationValidOTP(reg, &email.VerificationValidOTPModel{})
+
+		testhelpers.TestRendered(t, ctx, tpl)
+	})
+
+	t.Run("test=with remote resources", func(t *testing.T) {
+		testhelpers.TestRemoteTemplates(t, "../courier/builtin/templates/otp/verification/valid", courier.TypeVerificationValid)
+	})
+}