feat: Introduce MFA recipe

CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [9.0.0] - 2024-03-13
+
+### Added
+
+- Supports CDI version `5.0`
+- MFA stats in `EEFeatureFlag`
+- Adds `ImportTotpDeviceAPI`
+
+### Changes
+
+- `deviceName` in request body of `CreateOrUpdateTotpDeviceAPI` `POST` is now optional
+- Adds `firstFactors` and `requiredSecondaryFactors` in request body of create or update CUD, App and
+  Tenant APIs
+- Adds `deviceName` in the response of `CreateOrUpdateTotpDeviceAPI` `POST`
+- `VerifyTOTPAPI` changes
+  - Removes `allowUnverifiedDevices` from request body and unverified devices are not allowed
+  - Adds `currentNumberOfFailedAttempts` and `maxNumberOfFailedAttempts` in response when status is 
+    `INVALID_TOTP_ERROR` or `LIMIT_REACHED_ERROR`
+  - Adds status `UNKNOWN_USER_ID_ERROR`
+- `VerifyTotpDeviceAPI` changes
+  - Adds `currentNumberOfFailedAttempts` and `maxNumberOfFailedAttempts` in response when status is
+    `INVALID_TOTP_ERROR` or `LIMIT_REACHED_ERROR`
+- Adds a new required `useDynamicSigningKey` into the request body of `RefreshSessionAPI`
+  - This enables smooth switching between `useDynamicAccessTokenSigningKey` settings by allowing refresh calls to 
+    change the signing key type of a session
+
+### Migration
+
+- TODO - copy once postgres / mysql changelog is done
+
 ## [8.0.1] - 2024-03-11
 
 - Making this version backward compatible. Breaking changes in `8.0.0` can now be ignored.

build.gradle

@@ -19,7 +19,7 @@ compileTestJava { options.encoding = "UTF-8" }
 //    }
 //}
 
-version = "8.0.1"
+version = "9.0.0"
 
 
 repositories {

coreDriverInterfaceSupported.json

@@ -17,6 +17,7 @@
     "2.20",
     "2.21",
     "3.0",
-    "4.0"
+    "4.0",
+    "5.0"
   ]
-}
+}

ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java

@@ -185,43 +185,43 @@ private JsonObject getDashboardLoginStats() throws TenantOrAppNotFoundException,
         return stats;
     }
 
-    private JsonObject getTOTPStats() throws StorageQueryException, TenantOrAppNotFoundException {
-        JsonObject totpStats = new JsonObject();
-        JsonArray totpMauArr = new JsonArray();
+    private boolean isEnterpriseThirdPartyId(String thirdPartyId) {
+        for (String enterpriseThirdPartyId : ENTERPRISE_THIRD_PARTY_IDS) {
+            if (thirdPartyId.startsWith(enterpriseThirdPartyId)) {
+                return true;
+            }
+        }
+        return false;
+    }
 
+    private JsonObject getMFAStats() throws StorageQueryException, TenantOrAppNotFoundException {
+        // TODO: Active users are present only on public tenant and MFA users may be
+        // present on different storages
+        JsonObject result = new JsonObject();
         Storage[] storages = StorageLayer.getStoragesForApp(main, this.appIdentifier);
 
-        // TODO Active users are present only on public tenant and TOTP users may be present on different storages
-        Storage publicTenantStorage = StorageLayer.getStorage(this.appIdentifier.getAsPublicTenantIdentifier(), main);
-        final long now = System.currentTimeMillis();
-        for (int i = 1; i <= 31; i++) {
-            long timestamp = now - (i * 24 * 60 * 60 * 1000L);
-
-            int totpMau = 0;
-            // TODO Need to figure out a way to combine the data from different storages to get the final stats
-            // for (Storage storage : storages) {
-            totpMau += ((ActiveUsersStorage) publicTenantStorage).countUsersEnabledTotpAndActiveSince(this.appIdentifier, timestamp);
-            // }
-            totpMauArr.add(new JsonPrimitive(totpMau));
-        }
+        int totalUserCountWithMoreThanOneLoginMethod = 0;
+        int[] maus = new int[31];
 
-        totpStats.add("maus", totpMauArr);
+        long now = System.currentTimeMillis();
 
-        int totpTotalUsers = 0;
         for (Storage storage : storages) {
-            totpTotalUsers += ((ActiveUsersStorage) storage).countUsersEnabledTotp(this.appIdentifier);
-        }
-        totpStats.addProperty("total_users", totpTotalUsers);
-        return totpStats;
-    }
+            totalUserCountWithMoreThanOneLoginMethod += ((AuthRecipeStorage) storage)
+                    .getUsersCountWithMoreThanOneLoginMethodOrTOTPEnabled(this.appIdentifier);
 
-    private boolean isEnterpriseThirdPartyId(String thirdPartyId) {
-        for (String enterpriseThirdPartyId : ENTERPRISE_THIRD_PARTY_IDS) {
-            if (thirdPartyId.startsWith(enterpriseThirdPartyId)) {
-                return true;
+            for (int i = 1; i <= 31; i++) {
+                long timestamp = now - (i * 24 * 60 * 60 * 1000L);
+
+                // `maus[i-1]` since i starts from 1
+                maus[i - 1] += ((ActiveUsersStorage) storage)
+                        .countUsersThatHaveMoreThanOneLoginMethodOrTOTPEnabledAndActiveSince(appIdentifier, timestamp);
             }
         }
-        return false;
+
+        result.addProperty("totalUserCountWithMoreThanOneLoginMethodOrTOTPEnabled",
+                totalUserCountWithMoreThanOneLoginMethod);
+        result.add("mauWithMoreThanOneLoginMethodOrTOTPEnabled", new Gson().toJsonTree(maus));
+        return result;
     }
 
     private JsonObject getMultiTenancyStats()
@@ -245,6 +245,21 @@ private JsonObject getMultiTenancyStats()
                 hasUsersOrSessions = hasUsersOrSessions || ((SessionSQLStorage) storage).getNumberOfSessions(tenantConfig.tenantIdentifier) > 0;
                 tenantStat.addProperty("usersCount", usersCount);
                 tenantStat.addProperty("hasUsersOrSessions", hasUsersOrSessions);
+                if (tenantConfig.firstFactors != null) {
+                    JsonArray firstFactors = new JsonArray();
+                    for (String firstFactor : tenantConfig.firstFactors) {
+                        firstFactors.add(new JsonPrimitive(firstFactor));
+                    }
+                    tenantStat.add("firstFactors", firstFactors);
+                }
+
+                if (tenantConfig.requiredSecondaryFactors != null) {
+                    JsonArray requiredSecondaryFactors = new JsonArray();
+                    for (String requiredSecondaryFactor : tenantConfig.requiredSecondaryFactors) {
+                        requiredSecondaryFactors.add(new JsonPrimitive(requiredSecondaryFactor));
+                    }
+                    tenantStat.add("requiredSecondaryFactors", requiredSecondaryFactors);
+                }
 
                 try {
                     tenantStat.addProperty("userPoolId", Utils.hashSHA256(storage.getUserPoolId()));
@@ -355,8 +370,8 @@ public JsonObject getPaidFeatureStats() throws StorageQueryException, TenantOrAp
                 usageStats.add(EE_FEATURES.DASHBOARD_LOGIN.toString(), getDashboardLoginStats());
             }
 
-            if (feature == EE_FEATURES.TOTP) {
-                usageStats.add(EE_FEATURES.TOTP.toString(), getTOTPStats());
+            if (feature == EE_FEATURES.MFA) {
+                usageStats.add(EE_FEATURES.MFA.toString(), getMFAStats());
             }
 
             if (feature == EE_FEATURES.MULTI_TENANCY) {

ee/src/test/java/io/supertokens/ee/test/TestMultitenancyStats.java

@@ -78,6 +78,7 @@ public void testPaidStatsIsSentForAllAppsInMultitenancy() throws Exception {
                     new EmailPasswordConfig(true),
                     new ThirdPartyConfig(true, null),
                     new PasswordlessConfig(true),
+                    null, null,
                     config
             ), false);
 
@@ -86,6 +87,7 @@ public void testPaidStatsIsSentForAllAppsInMultitenancy() throws Exception {
                     new EmailPasswordConfig(true),
                     new ThirdPartyConfig(true, null),
                     new PasswordlessConfig(true),
+                    null, null,
                     config
             ), false);
 
@@ -94,6 +96,7 @@ public void testPaidStatsIsSentForAllAppsInMultitenancy() throws Exception {
                     new EmailPasswordConfig(true),
                     new ThirdPartyConfig(true, null),
                     new PasswordlessConfig(true),
+                    null, null,
                     config
             ), false);
         }

pluginInterfaceSupported.json

@@ -1,6 +1,6 @@
 {
   "_comment": "contains a list of plugin interfaces branch names that this core supports",
   "versions": [
-    "5.0"
+    "6.0"
   ]
 }

src/main/java/io/supertokens/ActiveUsers.java

@@ -1,8 +1,8 @@
 package io.supertokens;
 
+import io.supertokens.pluginInterface.ActiveUsersSQLStorage;
 import io.supertokens.pluginInterface.Storage;
 import io.supertokens.pluginInterface.StorageUtils;
-import io.supertokens.pluginInterface.authRecipe.sqlStorage.AuthRecipeSQLStorage;
 import io.supertokens.pluginInterface.exceptions.StorageQueryException;
 import io.supertokens.pluginInterface.exceptions.StorageTransactionLogicException;
 import io.supertokens.pluginInterface.multitenancy.AppIdentifier;
@@ -37,6 +37,20 @@ public static int countUsersActiveSince(Main main, AppIdentifier appIdentifier,
         return StorageUtils.getActiveUsersStorage(storage).countUsersActiveSince(appIdentifier, time);
     }
 
+    public static void updateLastActiveAfterLinking(Main main, AppIdentifier appIdentifier, String primaryUserId,
+                                                    String recipeUserId)
+            throws StorageQueryException, TenantOrAppNotFoundException, StorageTransactionLogicException {
+        ActiveUsersSQLStorage activeUsersStorage =
+                (ActiveUsersSQLStorage) StorageUtils.getActiveUsersStorage(StorageLayer.getStorage(appIdentifier.getAsPublicTenantIdentifier(), main));
+
+        activeUsersStorage.startTransaction(con -> {
+            activeUsersStorage.deleteUserActive_Transaction(con, appIdentifier, recipeUserId);
+            return null;
+        });
+
+        updateLastActive(appIdentifier, main, primaryUserId);
+    }
+
     @TestOnly
     public static int countUsersActiveSince(Main main, long time)
             throws StorageQueryException, TenantOrAppNotFoundException {

src/main/java/io/supertokens/Main.java

@@ -157,6 +157,9 @@ private void init() throws IOException, StorageQueryException {
             throw new QuitProgramException(e);
         }
 
+        // loading version file
+        Version.loadVersion(this, CLIOptions.get(this).getInstallationPath() + "version.yaml");
+
         Logging.info(this, TenantIdentifier.BASE_TENANT, "Completed config.yaml loading.", true);
 
         // loading storage layer
@@ -167,9 +170,6 @@ private void init() throws IOException, StorageQueryException {
             throw new QuitProgramException(e);
         }
 
-        // loading version file
-        Version.loadVersion(this, CLIOptions.get(this).getInstallationPath() + "version.yaml");
-
         // init file logging
         Logging.initFileLogging(this);
 

src/main/java/io/supertokens/authRecipe/AuthRecipe.java

@@ -25,11 +25,7 @@
 import io.supertokens.featureflag.FeatureFlag;
 import io.supertokens.featureflag.exceptions.FeatureNotEnabledException;
 import io.supertokens.multitenancy.exception.BadPermissionException;
-import io.supertokens.pluginInterface.RECIPE_ID;
-import io.supertokens.pluginInterface.STORAGE_TYPE;
-import io.supertokens.pluginInterface.Storage;
-import io.supertokens.pluginInterface.StorageUtils;
-import io.supertokens.pluginInterface.authRecipe.AuthRecipeStorage;
+import io.supertokens.pluginInterface.*;
 import io.supertokens.pluginInterface.authRecipe.AuthRecipeUserInfo;
 import io.supertokens.pluginInterface.authRecipe.LoginMethod;
 import io.supertokens.pluginInterface.authRecipe.sqlStorage.AuthRecipeSQLStorage;
@@ -126,7 +122,7 @@ public static AuthRecipeUserInfo getUserById(Main main, String userId)
 
     public static AuthRecipeUserInfo getUserById(AppIdentifier appIdentifier, Storage storage, String userId)
             throws StorageQueryException {
-        return  StorageUtils.getAuthRecipeStorage(storage).getPrimaryUserById(appIdentifier, userId);
+        return StorageUtils.getAuthRecipeStorage(storage).getPrimaryUserById(appIdentifier, userId);
     }
 
     public static class CreatePrimaryUserResult {
@@ -325,22 +321,22 @@ public static LinkAccountsResult linkAccounts(Main main, String recipeUserId, St
     }
 
     public static LinkAccountsResult linkAccounts(Main main, AppIdentifier appIdentifier,
-                                       Storage storage, String _recipeUserId, String _primaryUserId)
+                                                  Storage storage, String _recipeUserId, String _primaryUserId)
             throws StorageQueryException,
             AccountInfoAlreadyAssociatedWithAnotherPrimaryUserIdException,
             RecipeUserIdAlreadyLinkedWithAnotherPrimaryUserIdException, InputUserIdIsNotAPrimaryUserException,
             UnknownUserIdException, TenantOrAppNotFoundException, FeatureNotEnabledException {
 
         if (Arrays.stream(FeatureFlag.getInstance(main, appIdentifier).getEnabledFeatures())
-                .noneMatch(t -> t == EE_FEATURES.ACCOUNT_LINKING)) {
+                .noneMatch(t -> t == EE_FEATURES.ACCOUNT_LINKING || t == EE_FEATURES.MFA)) {
             throw new FeatureNotEnabledException(
                     "Account linking feature is not enabled for this app. Please contact support to enable it.");
         }
 
         AuthRecipeSQLStorage authRecipeStorage = StorageUtils.getAuthRecipeStorage(storage);
         try {
-            LinkAccountsResult result = authRecipeStorage.startTransaction(con -> {
 
+            LinkAccountsResult result = authRecipeStorage.startTransaction(con -> {
                 try {
                     CanLinkAccountsResult canLinkAccounts = canLinkAccountsHelper(con, appIdentifier,
                             authRecipeStorage, _recipeUserId, _primaryUserId);
@@ -537,7 +533,7 @@ public static CreatePrimaryUserResult createPrimaryUser(Main main,
             FeatureNotEnabledException {
 
         if (Arrays.stream(FeatureFlag.getInstance(main, appIdentifier).getEnabledFeatures())
-                .noneMatch(t -> t == EE_FEATURES.ACCOUNT_LINKING)) {
+                .noneMatch(t -> t == EE_FEATURES.ACCOUNT_LINKING || t == EE_FEATURES.MFA)) {
             throw new FeatureNotEnabledException(
                     "Account linking feature is not enabled for this app. Please contact support to enable it.");
         }
@@ -911,7 +907,7 @@ public static void deleteUser(AppIdentifier appIdentifier, Storage storage, Stri
     }
 
     private static void deleteNonAuthRecipeUser(TransactionConnection con, AppIdentifier appIdentifier,
-            Storage storage, String userId)
+                                                Storage storage, String userId)
             throws StorageQueryException {
         StorageUtils.getUserMetadataStorage(storage)
                 .deleteUserMetadata_Transaction(con, appIdentifier, userId);
@@ -921,6 +917,7 @@ private static void deleteNonAuthRecipeUser(TransactionConnection con, AppIdenti
                 .deleteEmailVerificationUserInfo_Transaction(con, appIdentifier, userId);
         StorageUtils.getUserRolesStorage(storage)
                 .deleteAllRolesForUser_Transaction(con, appIdentifier, userId);
+
         StorageUtils.getActiveUsersStorage(storage)
                 .deleteUserActive_Transaction(con, appIdentifier, userId);
         StorageUtils.getTOTPStorage(storage)
@@ -977,4 +974,4 @@ public UnlinkResult(String userId, boolean wasLinked) {
             this.wasLinked = wasLinked;
         }
     }
-}
+}

src/main/java/io/supertokens/emailpassword/EmailPassword.java

@@ -38,6 +38,7 @@
 import io.supertokens.pluginInterface.emailpassword.exceptions.DuplicateUserIdException;
 import io.supertokens.pluginInterface.emailpassword.exceptions.UnknownUserIdException;
 import io.supertokens.pluginInterface.emailpassword.sqlStorage.EmailPasswordSQLStorage;
+import io.supertokens.pluginInterface.emailverification.sqlStorage.EmailVerificationSQLStorage;
 import io.supertokens.pluginInterface.exceptions.StorageQueryException;
 import io.supertokens.pluginInterface.exceptions.StorageTransactionLogicException;
 import io.supertokens.pluginInterface.multitenancy.AppIdentifier;
@@ -110,14 +111,37 @@ public static AuthRecipeUserInfo signUp(TenantIdentifier tenantIdentifier, Stora
                 .createHashWithSalt(tenantIdentifier.toAppIdentifier(), password);
 
         while (true) {
-
             String userId = Utils.getUUID();
             long timeJoined = System.currentTimeMillis();
 
             try {
-                return StorageUtils.getEmailPasswordStorage(storage)
+                AuthRecipeUserInfo newUser = StorageUtils.getEmailPasswordStorage(storage)
                         .signUp(tenantIdentifier, userId, email, hashedPassword, timeJoined);
 
+                if (Utils.isFakeEmail(email)) {
+                    try {
+                        EmailVerificationSQLStorage evStorage = StorageUtils.getEmailVerificationStorage(storage);
+                        evStorage.startTransaction(con -> {
+                            try {
+                                evStorage.updateIsEmailVerified_Transaction(tenantIdentifier.toAppIdentifier(), con,
+                                                newUser.getSupertokensUserId(), email, true);
+                                evStorage.commitTransaction(con);
+
+                                return null;
+                            } catch (TenantOrAppNotFoundException e) {
+                                throw new StorageTransactionLogicException(e);
+                            }
+                        });
+                        newUser.loginMethods[0].setVerified(); // newly created user has only one loginMethod
+                    } catch (StorageTransactionLogicException e) {
+                        if (e.actualException instanceof TenantOrAppNotFoundException) {
+                            throw (TenantOrAppNotFoundException) e.actualException;
+                        }
+                        throw new StorageQueryException(e);
+                    }
+                }
+
+                return newUser;
             } catch (DuplicateUserIdException ignored) {
                 // we retry with a new userId (while loop)
             }

src/main/java/io/supertokens/featureflag/EE_FEATURES.java

@@ -18,8 +18,7 @@
 
 public enum EE_FEATURES {
     ACCOUNT_LINKING("account_linking"), MULTI_TENANCY("multi_tenancy"), TEST("test"),
-    DASHBOARD_LOGIN("dashboard_login"),
-    TOTP("totp");
+    DASHBOARD_LOGIN("dashboard_login"), MFA("mfa");
 
     private final String name;