Tanmay Deep SharmaandGitHub
51eb626b88
## Linear Ticket - https://linear.app/chatwoot/issue/CW-6883/allow-disabling-2fa-using-a-backup-code ## Description When a user loses access to their authenticator app, they can now disable 2FA using one of their saved backup codes (in addition to their password), so they can re-enroll a new authenticator. The disable dialog includes a toggle to switch between entering a verification code and a backup code. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? - Via UI flows <img width="495" height="423" alt="Screenshot 2026-04-20 at 2 17 21 PM" src="https://github.com/user-attachments/assets/cc6b3dc5-39e6-4104-b5b9-cdabdc46947e" /> <img width="475" height="409" alt="Screenshot 2026-04-20 at 2 17 36 PM" src="https://github.com/user-attachments/assets/97c7304d-4adb-42ed-b7b4-50f5b38585a3" /> ## Checklist: - [ ] My code follows the style guidelines of this project - [ ] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules
70 lines
1.7 KiB
Ruby
70 lines
1.7 KiB
Ruby
class Api::V1::Profile::MfaController < Api::BaseController
|
|
before_action :check_mfa_feature_available
|
|
before_action :check_mfa_enabled, only: [:destroy, :backup_codes]
|
|
before_action :check_mfa_disabled, only: [:create, :verify]
|
|
before_action :validate_password, only: [:destroy]
|
|
before_action :validate_otp, only: [:verify, :backup_codes, :destroy]
|
|
|
|
def show; end
|
|
|
|
def create
|
|
mfa_service.enable_two_factor!
|
|
end
|
|
|
|
def verify
|
|
@backup_codes = mfa_service.verify_and_activate!
|
|
end
|
|
|
|
def destroy
|
|
mfa_service.disable_two_factor!
|
|
end
|
|
|
|
def backup_codes
|
|
@backup_codes = mfa_service.generate_backup_codes!
|
|
end
|
|
|
|
private
|
|
|
|
def mfa_service
|
|
@mfa_service ||= Mfa::ManagementService.new(user: current_user)
|
|
end
|
|
|
|
def check_mfa_enabled
|
|
render_could_not_create_error(I18n.t('errors.mfa.not_enabled')) unless current_user.mfa_enabled?
|
|
end
|
|
|
|
def check_mfa_feature_available
|
|
return if Chatwoot.mfa_enabled?
|
|
|
|
render json: {
|
|
error: I18n.t('errors.mfa.feature_unavailable')
|
|
}, status: :forbidden
|
|
end
|
|
|
|
def check_mfa_disabled
|
|
render_could_not_create_error(I18n.t('errors.mfa.already_enabled')) if current_user.mfa_enabled?
|
|
end
|
|
|
|
def validate_otp
|
|
authenticated = Mfa::AuthenticationService.new(
|
|
user: current_user,
|
|
otp_code: mfa_params[:otp_code],
|
|
backup_code: mfa_params[:backup_code]
|
|
).authenticate
|
|
|
|
return if authenticated
|
|
|
|
render_could_not_create_error(I18n.t('errors.mfa.invalid_code'))
|
|
end
|
|
|
|
def validate_password
|
|
return if current_user.valid_password?(mfa_params[:password])
|
|
|
|
render_could_not_create_error(I18n.t('errors.mfa.invalid_credentials'))
|
|
end
|
|
|
|
def mfa_params
|
|
params.permit(:otp_code, :backup_code, :password)
|
|
end
|
|
end
|