feat(login): additionally use email/phone for authentication (#4563)

* feat: add ability to disable login by email and phone

* feat: check login by email and phone

* fix: set verified email / phone correctly on notify users

* update projection version

* fix merge

* fix email/phone verified reduce tests

* fix user tests

* loginname check

* cleanup

* fix: update user projection version to handle fixed statement

console/src/app/modules/policies/login-policy/login-policy.component.html

@@ -329,6 +329,50 @@
     </mat-checkbox>
   </div>
 
+  <div class="login-policy-row">
+    <mat-checkbox
+      class="login-policy-toggle"
+      color="primary"
+      ngDefaultControl
+      [(ngModel)]="loginData.disableLoginWithEmail"
+      [disabled]="
+        ([
+          serviceType === PolicyComponentServiceType.ADMIN
+            ? 'iam.policy.write'
+            : serviceType === PolicyComponentServiceType.MGMT
+            ? 'policy.write'
+            : ''
+        ]
+          | hasRole
+          | async) === false
+      "
+    >
+      {{ 'POLICY.DATA.DISABLELOGINWITHEMAIL' | translate }}
+    </mat-checkbox>
+  </div>
+
+  <div class="login-policy-row">
+    <mat-checkbox
+      class="login-policy-toggle"
+      color="primary"
+      ngDefaultControl
+      [(ngModel)]="loginData.disableLoginWithPhone"
+      [disabled]="
+        ([
+          serviceType === PolicyComponentServiceType.ADMIN
+            ? 'iam.policy.write'
+            : serviceType === PolicyComponentServiceType.MGMT
+            ? 'policy.write'
+            : ''
+        ]
+          | hasRole
+          | async) === false
+      "
+    >
+      {{ 'POLICY.DATA.DISABLELOGINWITHPHONE' | translate }}
+    </mat-checkbox>
+  </div>
+
   <div class="login-policy-row">
     <cnsl-form-field class="form-field" label="Access Code" required="true">
       <cnsl-label>{{ 'POLICY.DATA.DEFAULTREDIRECTURI' | translate }}</cnsl-label>

console/src/app/modules/policies/login-policy/login-policy.component.ts

@@ -155,6 +155,8 @@ export class LoginPolicyComponent implements OnInit {
             mgmtreq.setHidePasswordReset(this.loginData.hidePasswordReset);
             mgmtreq.setMultiFactorsList(this.loginData.multiFactorsList);
             mgmtreq.setSecondFactorsList(this.loginData.secondFactorsList);
+            mgmtreq.setDisableLoginWithEmail(this.loginData.disableLoginWithEmail);
+            mgmtreq.setDisableLoginWithPhone(this.loginData.disableLoginWithPhone);
 
             const pcl = new Duration().setSeconds((this.passwordCheckLifetime?.value ?? 240) * 60 * 60);
             mgmtreq.setPasswordCheckLifetime(pcl);
@@ -184,6 +186,8 @@ export class LoginPolicyComponent implements OnInit {
             mgmtreq.setForceMfa(this.loginData.forceMfa);
             mgmtreq.setPasswordlessType(this.loginData.passwordlessType);
             mgmtreq.setHidePasswordReset(this.loginData.hidePasswordReset);
+            mgmtreq.setDisableLoginWithEmail(this.loginData.disableLoginWithEmail);
+            mgmtreq.setDisableLoginWithPhone(this.loginData.disableLoginWithPhone);
 
             const pcl = new Duration().setSeconds((this.passwordCheckLifetime?.value ?? 240) * 60 * 60);
             mgmtreq.setPasswordCheckLifetime(pcl);
@@ -214,6 +218,8 @@ export class LoginPolicyComponent implements OnInit {
           adminreq.setForceMfa(this.loginData.forceMfa);
           adminreq.setPasswordlessType(this.loginData.passwordlessType);
           adminreq.setHidePasswordReset(this.loginData.hidePasswordReset);
+          adminreq.setDisableLoginWithEmail(this.loginData.disableLoginWithEmail);
+          adminreq.setDisableLoginWithPhone(this.loginData.disableLoginWithPhone);
 
           const admin_pcl = new Duration().setSeconds((this.passwordCheckLifetime?.value ?? 240) * 60 * 60);
           adminreq.setPasswordCheckLifetime(admin_pcl);

console/src/assets/i18n/de.json

@@ -1173,6 +1173,8 @@
       "IGNOREUNKNOWNUSERNAMES_DESC": "Ist die Option gewählt, wird der Passwort Schritt im Login auch angezeigt wenn der User nicht gefunden wurde. Dem Benutzer wird auf bei der Passwortprüfung nicht angezeigt ob der Username oder das Passwort falsch war.",
       "ALLOWDOMAINDISCOVERY": "Domänenentdeckung erlauben",
       "ALLOWDOMAINDISCOVERY_DESC": "Ist die Option gewählt, wird die Endung (@domain.com) eines unbekannten Benutzernamens im Login mit den Organisationsdomänen verglichen. Bei Übereinstimmung wird der Benutzer auf die Registrierung dieser Organisation weitergeleitet.",
+      "DISABLELOGINWITHEMAIL": "Login mittels E-Mailadresse deaktivieren",
+      "DISABLELOGINWITHPHONE": "Login mittels Telefonnummer deaktivieren",
       "DEFAULTREDIRECTURI": "Default Redirect URI",
       "DEFAULTREDIRECTURI_DESC": "Definiert, wohin der Benutzer umgeleitet wird, wenn die Anmeldung ohne App-Kontext gestartet wurde (z. B. von Mail)",
       "ERRORMSGPOPUP": "Fehler als Dialog Fenster",

console/src/assets/i18n/en.json

@@ -1173,6 +1173,8 @@
       "IGNOREUNKNOWNUSERNAMES_DESC": "If the option is selected, the password screen will be displayed in the login process even if the user was not found. The error on the password check will not disclose if the username or password was wrong.",
       "ALLOWDOMAINDISCOVERY": "Domain discovery allowed",
       "ALLOWDOMAINDISCOVERY_DESC": "If the option is selected, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the organization domains and will redirect to the registration of that organisation on success.",
+      "DISABLELOGINWITHEMAIL": "Disable login with email address",
+      "DISABLELOGINWITHPHONE": "Disable login with phone number",
       "DEFAULTREDIRECTURI": "Default Redirect URI",
       "DEFAULTREDIRECTURI_DESC": "Defines where the user will be redirected to if the login has started without an app context (e.g. from mail)",
       "ERRORMSGPOPUP": "Show Error in Dialog",

console/src/assets/i18n/fr.json

@@ -1173,6 +1173,8 @@
       "IGNOREUNKNOWNUSERNAMES_DESC": "Si l'option est sélectionnée, l'écran du mot de passe sera affiché dans le processus de connexion même si l'utilisateur n'a pas été trouvé. L'erreur sur la vérification du mot de passe ne révélera pas si le nom d'utilisateur ou le mot de passe était erroné.",
       "ALLOWDOMAINDISCOVERY": "Découverte du domaine autorisée",
       "ALLOWDOMAINDISCOVERY_DESC": "Si l'option est sélectionnée, le suffixe (@domain.com) d'un nom d'utilisateur inconnu saisi sur l'écran de connexion sera comparé aux domaines organisation et redirigera vers l'enregistrement de cette organisation en cas de succès.",
+      "DISABLELOGINWITHEMAIL": "Désactiver la connexion avec l'adresse e-mail",
+      "DISABLELOGINWITHPHONE": "Désactiver la connexion avec le numéro de téléphone",
       "DEFAULTREDIRECTURI": "URI de redirection par défaut",
       "DEFAULTREDIRECTURI_DESC": "Définit l'endroit où l'utilisateur sera redirigé si la connexion a commencé sans contexte d'application (par exemple, à partir du courrier électronique).",
       "ERRORMSGPOPUP": "Afficher l'erreur dans la boîte de dialogue",

console/src/assets/i18n/it.json

@@ -1173,6 +1173,8 @@
       "IGNOREUNKNOWNUSERNAMES_DESC": "Se l'opzione \u00e8 selezionata, l'inserimento della password viene mostrato anche se nessun utente è stato trovato. Nota che dopo il controllo della password, non viene mostrato se il nome utente o la password erano errati.",
       "ALLOWDOMAINDISCOVERY": "Scoperta del dominio consentita",
       "ALLOWDOMAINDISCOVERY_DESC": "Se l'opzione è selezionata, il suffisso (@domain.com) di un nome utente sconosciuto inserito nel login verrà confrontato con i domini organizzazione e, in caso di successo, verrà reindirizzato alla registrazione di tale organizzazione",
+      "DISABLELOGINWITHEMAIL": "Disabilita il login con l'indirizzo e-mail",
+      "DISABLELOGINWITHPHONE": "Disabilita l'accesso con il numero di telefono",
       "DEFAULTREDIRECTURI": "Default Redirect URI",
       "DEFAULTREDIRECTURI_DESC": "Definisce dove verrà reindirizzato l'utente se l'accesso è stato avviato senza un contesto dell'app (ad es. dall' email)",
       "ERRORMSGPOPUP": "Mostra l'errore nella finestra di dialogo",

console/src/assets/i18n/zh.json

@@ -1172,6 +1172,8 @@
       "IGNOREUNKNOWNUSERNAMES_DESC": "如果选择该选项，即使未找到用户，登录过程中也会显示密码屏幕。如果用户名或密码错误，密码检查的错误不会透露。",
       "ALLOWDOMAINDISCOVERY": "允许域名发现",
       "ALLOWDOMAINDISCOVERY_DESC": "如果选择该选项，在登录屏幕上输入的未知用户名的后缀（@domain.com）将与组织的域名进行匹配，成功后将重定向到组织的注册。",
+      "DISABLELOGINWITHEMAIL": "禁止用电子邮件地址登录",
+      "DISABLELOGINWITHPHONE": "禁止用电话号码登录",
       "DEFAULTREDIRECTURI": "默认重定向 URI",
       "DEFAULTREDIRECTURI_DESC": "定义如果在没有应用程序上下文的情况下开始登录（例如来自邮件），用户将被重定向到哪里。",
       "ERRORMSGPOPUP": "在对话框中显示错误",