feat(api): add and remove OTP (SMS and email) (#6295)

* refactor: rename otp to totp * feat: add otp sms and email * implement tests
2025-08-12 01:47:33 +00:00 · 2023-08-02 18:57:53 +02:00
parent ca13e70c92
commit a1942ecdaa
44 changed files with 2253 additions and 215 deletions
--- a/internal/query/projection/user_auth_method.go
+++ b/internal/query/projection/user_auth_method.go
@@ -89,6 +89,14 @@ func (p *userAuthMethodProjection) reducers() []handler.AggregateReducer {
 					Event:  user.HumanMFAOTPVerifiedType,
 					Reduce: p.reduceActivateEvent,
 				},
+				{
+					Event:  user.HumanOTPSMSAddedType,
+					Reduce: p.reduceAddAuthMethod,
+				},
+				{
+					Event:  user.HumanOTPEmailAddedType,
+					Reduce: p.reduceAddAuthMethod,
+				},
 				{
 					Event:  user.HumanPasswordlessTokenRemovedType,
 					Reduce: p.reduceRemoveAuthMethod,
@@ -101,6 +109,14 @@ func (p *userAuthMethodProjection) reducers() []handler.AggregateReducer {
 					Event:  user.HumanMFAOTPRemovedType,
 					Reduce: p.reduceRemoveAuthMethod,
 				},
+				{
+					Event:  user.HumanOTPSMSRemovedType,
+					Reduce: p.reduceRemoveAuthMethod,
+				},
+				{
+					Event:  user.HumanOTPEmailRemovedType,
+					Reduce: p.reduceRemoveAuthMethod,
+				},
 			},
 		},
 		{
@@ -135,7 +151,7 @@ func (p *userAuthMethodProjection) reduceInitAuthMethod(event eventstore.Event)
 		methodType = domain.UserAuthMethodTypeU2F
 		tokenID = e.WebAuthNTokenID
 	case *user.HumanOTPAddedEvent:
-		methodType = domain.UserAuthMethodTypeOTP
+		methodType = domain.UserAuthMethodTypeTOTP
 	default:
 		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-f92f", "reduce.wrong.event.type %v", []eventstore.EventType{user.HumanPasswordlessTokenAddedType, user.HumanU2FTokenAddedType})
 	}
@@ -178,7 +194,7 @@ func (p *userAuthMethodProjection) reduceActivateEvent(event eventstore.Event) (
 		tokenID = e.WebAuthNTokenID
 		name = e.WebAuthNTokenName
 	case *user.HumanOTPVerifiedEvent:
-		methodType = domain.UserAuthMethodTypeOTP
+		methodType = domain.UserAuthMethodTypeTOTP

 	default:
 		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-f92f", "reduce.wrong.event.type %v", []eventstore.EventType{user.HumanPasswordlessTokenAddedType, user.HumanU2FTokenAddedType})
@@ -202,6 +218,34 @@ func (p *userAuthMethodProjection) reduceActivateEvent(event eventstore.Event) (
 	), nil
 }

+func (p *userAuthMethodProjection) reduceAddAuthMethod(event eventstore.Event) (*handler.Statement, error) {
+	var methodType domain.UserAuthMethodType
+	switch event.(type) {
+	case *user.HumanOTPSMSAddedEvent:
+		methodType = domain.UserAuthMethodTypeOTPSMS
+	case *user.HumanOTPEmailAddedEvent:
+		methodType = domain.UserAuthMethodTypeOTPEmail
+	default:
+		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-DS4g3", "reduce.wrong.event.type %v", []eventstore.EventType{user.HumanOTPSMSAddedType, user.HumanOTPEmailAddedType})
+	}
+
+	return crdb.NewCreateStatement(
+		event,
+		[]handler.Column{
+			handler.NewCol(UserAuthMethodTokenIDCol, ""),
+			handler.NewCol(UserAuthMethodCreationDateCol, event.CreationDate()),
+			handler.NewCol(UserAuthMethodChangeDateCol, event.CreationDate()),
+			handler.NewCol(UserAuthMethodResourceOwnerCol, event.Aggregate().ResourceOwner),
+			handler.NewCol(UserAuthMethodInstanceIDCol, event.Aggregate().InstanceID),
+			handler.NewCol(UserAuthMethodUserIDCol, event.Aggregate().ID),
+			handler.NewCol(UserAuthMethodSequenceCol, event.Sequence()),
+			handler.NewCol(UserAuthMethodStateCol, domain.MFAStateReady),
+			handler.NewCol(UserAuthMethodTypeCol, methodType),
+			handler.NewCol(UserAuthMethodNameCol, ""),
+		},
+	), nil
+}
+
 func (p *userAuthMethodProjection) reduceRemoveAuthMethod(event eventstore.Event) (*handler.Statement, error) {
 	var tokenID string
 	var methodType domain.UserAuthMethodType
@@ -213,10 +257,17 @@ func (p *userAuthMethodProjection) reduceRemoveAuthMethod(event eventstore.Event
 		methodType = domain.UserAuthMethodTypeU2F
 		tokenID = e.WebAuthNTokenID
 	case *user.HumanOTPRemovedEvent:
-		methodType = domain.UserAuthMethodTypeOTP
+		methodType = domain.UserAuthMethodTypeTOTP
+	case *user.HumanOTPSMSRemovedEvent,
+		*user.HumanPhoneRemovedEvent:
+		methodType = domain.UserAuthMethodTypeOTPSMS
+	case *user.HumanOTPEmailRemovedEvent:
+		methodType = domain.UserAuthMethodTypeOTPEmail

 	default:
-		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-f92f", "reduce.wrong.event.type %v", []eventstore.EventType{user.HumanPasswordlessTokenAddedType, user.HumanU2FTokenAddedType})
+		return nil, errors.ThrowInvalidArgumentf(nil, "PROJE-f92f", "reduce.wrong.event.type %v",
+			[]eventstore.EventType{user.HumanPasswordlessTokenAddedType, user.HumanU2FTokenAddedType, user.HumanMFAOTPRemovedType,
+				user.HumanOTPSMSRemovedType, user.HumanPhoneRemovedType, user.HumanOTPEmailRemovedType})
 	}
 	conditions := []handler.Condition{
 		handler.NewCond(UserAuthMethodUserIDCol, event.Aggregate().ID),
--- a/internal/query/projection/user_auth_method_test.go
+++ b/internal/query/projection/user_auth_method_test.go
@@ -98,7 +98,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "reduceAddedOTP",
+			name: "reduceAddedTOTP",
 			args: args{
 				event: getEvent(testEvent(
 					repository.EventType(user.HumanMFAOTPAddedType),
@@ -125,7 +125,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 								"agg-id",
 								uint64(15),
 								domain.MFAStateNotReady,
-								domain.UserAuthMethodTypeOTP,
+								domain.UserAuthMethodTypeTOTP,
 								"",
 							},
 						},
@@ -208,7 +208,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "reduceVerifiedOTP",
+			name: "reduceVerifiedTOTP",
 			args: args{
 				event: getEvent(testEvent(
 					repository.EventType(user.HumanMFAOTPVerifiedType),
@@ -232,7 +232,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 								"",
 								domain.MFAStateReady,
 								"agg-id",
-								domain.UserAuthMethodTypeOTP,
+								domain.UserAuthMethodTypeTOTP,
 								"ro-id",
 								"",
 								"instance-id",
@@ -242,6 +242,256 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "reduceAddedOTPSMS",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanOTPSMSAddedType),
+					user.AggregateType,
+					nil,
+				), eventstore.GenericEventMapper[user.HumanOTPSMSAddedEvent]),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceAddAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "INSERT INTO projections.user_auth_methods4 (token_id, creation_date, change_date, resource_owner, instance_id, user_id, sequence, state, method_type, name) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+							expectedArgs: []interface{}{
+								"",
+								anyArg{},
+								anyArg{},
+								"ro-id",
+								"instance-id",
+								"agg-id",
+								uint64(15),
+								domain.MFAStateReady,
+								domain.UserAuthMethodTypeOTPSMS,
+								"",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceAddedOTPEmail",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanOTPEmailAddedType),
+					user.AggregateType,
+					nil,
+				), eventstore.GenericEventMapper[user.HumanOTPEmailAddedEvent]),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceAddAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "INSERT INTO projections.user_auth_methods4 (token_id, creation_date, change_date, resource_owner, instance_id, user_id, sequence, state, method_type, name) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+							expectedArgs: []interface{}{
+								"",
+								anyArg{},
+								anyArg{},
+								"ro-id",
+								"instance-id",
+								"agg-id",
+								uint64(15),
+								domain.MFAStateReady,
+								domain.UserAuthMethodTypeOTPEmail,
+								"",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemoveOTPPasswordless",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanPasswordlessTokenRemovedType),
+					user.AggregateType,
+					[]byte(`{
+						"webAuthNTokenId": "token-id"
+					}`),
+				), user.HumanPasswordlessRemovedEventMapper),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4) AND (token_id = $5)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypePasswordless,
+								"ro-id",
+								"instance-id",
+								"token-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemoveOTPU2F",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanU2FTokenRemovedType),
+					user.AggregateType,
+					[]byte(`{
+						"webAuthNTokenId": "token-id"
+					}`),
+				), user.HumanU2FRemovedEventMapper),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4) AND (token_id = $5)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypeU2F,
+								"ro-id",
+								"instance-id",
+								"token-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemoveTOTP",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanMFAOTPRemovedType),
+					user.AggregateType,
+					nil,
+				), user.HumanOTPRemovedEventMapper),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypeTOTP,
+								"ro-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemoveOTPSMS",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanOTPSMSRemovedType),
+					user.AggregateType,
+					nil,
+				), eventstore.GenericEventMapper[user.HumanOTPSMSRemovedEvent]),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypeOTPSMS,
+								"ro-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemovePhone",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanPhoneRemovedType),
+					user.AggregateType,
+					nil,
+				), user.HumanPhoneRemovedEventMapper),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypeOTPSMS,
+								"ro-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceRemoveOTPEmail",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(user.HumanOTPEmailRemovedType),
+					user.AggregateType,
+					nil,
+				), eventstore.GenericEventMapper[user.HumanOTPEmailRemovedEvent]),
+			},
+			reduce: (&userAuthMethodProjection{}).reduceRemoveAuthMethod,
+			want: wantReduce{
+				aggregateType:    user.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "DELETE FROM projections.user_auth_methods4 WHERE (user_id = $1) AND (method_type = $2) AND (resource_owner = $3) AND (instance_id = $4)",
+							expectedArgs: []interface{}{
+								"agg-id",
+								domain.UserAuthMethodTypeOTPEmail,
+								"ro-id",
+								"instance-id",
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			name:   "org reduceOwnerRemoved",
 			reduce: (&userAuthMethodProjection{}).reduceOwnerRemoved,