AC-9797: 2FA functionality enhancement

Rizwan Khan · Rizwan Khan · commit a8f42f16cb4b · 2024-05-20T14:44:41.000+05:30
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Authpost.php
@@ -19,6 +19,8 @@
 use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
 use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
 use Magento\User\Model\User;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\User\Model\ResourceModel\User as UserResource;
 
 /**
  * @SuppressWarnings(PHPMD.CamelCaseMethodName)
@@ -60,6 +62,26 @@ class Authpost extends AbstractAction implements HttpPostActionInterface
      */
     private $alert;
 
+    /**
+     * Config path for the 2FA Attempts
+     */
+    private const XML_PATH_2FA_RETRY_ATTEMPTS = 'twofactorauth/general/twofactorauth_retry';
+
+    /**
+     * Config path for the 2FA Attempts
+     */
+    private const XML_PATH_2FA_LOCK_EXPIRE = 'twofactorauth/general/auth_lock_expire';
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @var UserResource
+     */
+    protected $userResource;
+
     /**
      * @param Action\Context $context
      * @param Session $session
@@ -69,6 +91,8 @@ class Authpost extends AbstractAction implements HttpPostActionInterface
      * @param TfaInterface $tfa
      * @param AlertInterface $alert
      * @param DataObjectFactory $dataObjectFactory
+     * @param UserResource $userResource
+     * @param ScopeConfigInterface $scopeConfig
      */
     public function __construct(
         Action\Context $context,
@@ -78,7 +102,9 @@ public function __construct(
         TfaSessionInterface $tfaSession,
         TfaInterface $tfa,
         AlertInterface $alert,
-        DataObjectFactory $dataObjectFactory
+        DataObjectFactory $dataObjectFactory,
+        UserResource $userResource,
+        ScopeConfigInterface $scopeConfig
     ) {
         parent::__construct($context);
         $this->tfa = $tfa;
@@ -88,6 +114,8 @@ public function __construct(
         $this->authy = $authy;
         $this->dataObjectFactory = $dataObjectFactory;
         $this->alert = $alert;
+        $this->userResource = $userResource;
+        $this->scopeConfig = $scopeConfig;
     }
 
     /**
@@ -109,11 +137,20 @@ public function execute()
         $result = $this->jsonFactory->create();
 
         try {
-            $this->authy->verify($user, $this->dataObjectFactory->create([
-                'data' => $this->getRequest()->getParams(),
-            ]));
-            $this->tfaSession->grantAccess();
-            $result->setData(['success' => true]);
+            $maxRetries = $this->scopeConfig->getValue(self::XML_PATH_2FA_RETRY_ATTEMPTS);
+            $retries = $this->verifyRetryAttempts();
+            if ($retries > $maxRetries) { //locked the user
+                $lockThreshold = $this->scopeConfig->getValue(self::XML_PATH_2FA_LOCK_EXPIRE);
+                if ($this->userResource->lock($user->getId(),0, $lockThreshold)) {
+                    $result->setData(['success' => false, 'message' => "User is disabled temporarily!"]);
+                }
+            } else {
+                $this->authy->verify($user, $this->dataObjectFactory->create([
+                    'data' => $this->getRequest()->getParams(),
+                ]));
+                $this->tfaSession->grantAccess();
+                $result->setData(['success' => true]);
+            }
         } catch (Exception $e) {
             $this->alert->event(
                 'Magento_TwoFactorAuth',
@@ -141,4 +178,17 @@ protected function _isAllowed()
             $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
             $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
     }
+
+    /**
+     * Get retry attempt count
+     *
+     * @return int
+     */
+    private function verifyRetryAttempts() : int
+    {
+        $verifyAttempts = $this->session->getOtpAttempt();
+        $verifyAttempts = is_null($verifyAttempts) ? 0 : $verifyAttempts+1;
+        $this->session->setOtpAttempt($verifyAttempts);
+        return $verifyAttempts;
+    }
 }
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/Google/Authpost.php
@@ -19,6 +19,8 @@
 use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
 use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
 use Magento\User\Model\User;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\User\Model\ResourceModel\User as UserResource;
 
 /**
  * Google authenticator post controller
@@ -61,6 +63,26 @@ class Authpost extends AbstractAction implements HttpPostActionInterface
      */
     private $alert;
 
+    /**
+     * Config path for the 2FA Attempts
+     */
+    private const XML_PATH_2FA_RETRY_ATTEMPTS = 'twofactorauth/general/twofactorauth_retry';
+
+    /**
+     * Config path for the 2FA Attempts
+     */
+    private const XML_PATH_2FA_LOCK_EXPIRE = 'twofactorauth/general/auth_lock_expire';
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @var UserResource
+     */
+    protected $userResource;
+
     /**
      * @param Action\Context $context
      * @param Session $session
@@ -70,6 +92,8 @@ class Authpost extends AbstractAction implements HttpPostActionInterface
      * @param TfaInterface $tfa
      * @param AlertInterface $alert
      * @param DataObjectFactory $dataObjectFactory
+     * @param UserResource $userResource
+     * @param ScopeConfigInterface $scopeConfig
      */
     public function __construct(
         Action\Context $context,
@@ -79,7 +103,9 @@ public function __construct(
         TfaSessionInterface $tfaSession,
         TfaInterface $tfa,
         AlertInterface $alert,
-        DataObjectFactory $dataObjectFactory
+        DataObjectFactory $dataObjectFactory,
+        UserResource $userResource,
+        ScopeConfigInterface $scopeConfig
     ) {
         parent::__construct($context);
         $this->tfa = $tfa;
@@ -89,6 +115,8 @@ public function __construct(
         $this->tfaSession = $tfaSession;
         $this->dataObjectFactory = $dataObjectFactory;
         $this->alert = $alert;
+        $this->userResource = $userResource;
+        $this->scopeConfig = $scopeConfig;
     }
 
     /**
@@ -103,18 +131,27 @@ public function execute()
         /** @var \Magento\Framework\DataObject $request */
         $request = $this->dataObjectFactory->create(['data' => $this->getRequest()->getParams()]);
 
-        if ($this->google->verify($user, $request)) {
-            $this->tfaSession->grantAccess();
-            $response->setData(['success' => true]);
+        $maxRetries = $this->scopeConfig->getValue(self::XML_PATH_2FA_RETRY_ATTEMPTS);
+        $retries = $this->verifyRetryAttempts();
+        if ($retries > $maxRetries) { //locked the user
+            $lockThreshold = $this->scopeConfig->getValue(self::XML_PATH_2FA_LOCK_EXPIRE);
+            if ($this->userResource->lock($user->getId(),0, $lockThreshold)) {
+                $response->setData(['success' => false, 'message' => "User is disabled temporarily!"]);
+            }
         } else {
-            $this->alert->event(
-                'Magento_TwoFactorAuth',
-                'Google auth invalid token',
-                AlertInterface::LEVEL_WARNING,
-                $user->getUserName()
-            );
-
-            $response->setData(['success' => false, 'message' => 'Invalid code']);
+            if ($this->google->verify($user, $request)) {
+                $this->tfaSession->grantAccess();
+                $response->setData(['success' => true]);
+            } else {
+                $this->alert->event(
+                    'Magento_TwoFactorAuth',
+                    'Google auth invalid token',
+                    AlertInterface::LEVEL_WARNING,
+                    $user->getUserName()
+                );
+
+                $response->setData(['success' => false, 'message' => 'Invalid code']);
+            }
         }
 
         return $response;
@@ -133,4 +170,17 @@ protected function _isAllowed()
             && $this->tfa->getProviderIsAllowed((int)$user->getId(), Google::CODE)
             && $this->tfa->getProvider(Google::CODE)->isActive((int)$user->getId());
     }
+
+    /**
+     * Get retry attempt count
+     *
+     * @return int
+     */
+    private function verifyRetryAttempts() : int
+    {
+        $verifyAttempts = $this->session->getOtpAttempt();
+        $verifyAttempts = is_null($verifyAttempts) ? 0 : $verifyAttempts+1;
+        $this->session->setOtpAttempt($verifyAttempts);
+        return $verifyAttempts;
+    }
 }
diff --git a/TwoFactorAuth/etc/adminhtml/system.xml b/TwoFactorAuth/etc/adminhtml/system.xml
@@ -34,11 +34,16 @@
                        showInDefault="1" showInWebsite="0" showInStore="0">
                     <label>Configuration Email URL for Web API</label>
                     <comment>This can be used to override the default email configuration link that is sent when using the Magento Web API's to authenticate. Use the placeholder :tfat to indicate where the token should be injected</comment>
-                </field>
+                </field>x
                 <field canRestore="1" id="twofactorauth_retry" translate="label" type="text" sortOrder="40"
                        showInDefault="1" showInWebsite="0" showInStore="0">
                     <label>Configuration for 2FA retry attempts</label>
-                    <comment>Security configurations for TowFatcorAuth page. To avoid the bruteforce of twofactorauth API</comment>
+                    <comment>Security configurations for TowFatcorAuth page.</comment>
+                </field>
+                <field canRestore="1" id="auth_lock_expire" translate="label" type="text" sortOrder="40"
+                       showInDefault="1" showInWebsite="0" showInStore="0">
+                    <label>Configuration for 2FA lock expire time</label>
+                    <comment>TwoFactor Authentation Configuration.</comment>
                 </field>
             </group>
             <group id="google" translate="label" type="text" sortOrder="30" showInDefault="1" showInWebsite="0"
diff --git a/TwoFactorAuth/etc/config.xml b/TwoFactorAuth/etc/config.xml
@@ -12,6 +12,7 @@
             <general>
                 <force_providers></force_providers>
                 <twofactorauth_retry>10</twofactorauth_retry>
+                <auth_lock_expire>300</auth_lock_expire>
             </general>
             <authy>
                 <onetouch_message>Login request to your Magento Admin</onetouch_message>
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/auth.js b/TwoFactorAuth/view/adminhtml/web/js/authy/auth.js
@@ -12,8 +12,6 @@ define([
 ], function ($, ko, Component, error) {
     'use strict';
 
-    let attempts = 0;
-
     return Component.extend({
         selectedMethod: ko.observable(''),
         waitingText: ko.observable(''),
@@ -192,27 +190,12 @@ define([
             this.success(false);
         },
 
-        /**
-         * Get Retry Attempts
-         * @returns {int}
-         */
-        getRetryAttempts: function () {
-            return this.attempts;
-        },
-
         /**
          * Verify authy code
          */
         verifyCode: function () {
             var me = this;
 
-            attempts++;
-            if (attempts > this.getRetryAttempts()) {
-                console.log('Maximum otp retries are done.');
-                location.href = $('.tfa-logout-link').attr('href');
-                return;
-            }
-
             this.waitingText('Please wait...');
 
             $.post(this.getPostUrl(), {
diff --git a/TwoFactorAuth/view/adminhtml/web/js/google/auth.js b/TwoFactorAuth/view/adminhtml/web/js/google/auth.js
@@ -11,8 +11,6 @@ define([
 ], function ($, ko, Component, error) {
     'use strict';
 
-    let attempts = 0;
-
     return Component.extend({
         currentStep: ko.observable('register'),
         waitText: ko.observable(''),
@@ -42,14 +40,6 @@ define([
             return this.postUrl;
         },
 
-        /**
-         * Get Retry Attempts
-         * @returns {int}
-         */
-        getRetryAttempts: function () {
-            return this.attempts;
-        },
-
         /**
          * Get plain Secret Code
          * @returns {String}
@@ -72,13 +62,6 @@ define([
         doVerify: function () {
             var me = this;
 
-            attempts++;
-            if (attempts > this.getRetryAttempts()) {
-                console.log('Maximum otp retries are done.');
-                location.href = $('.tfa-logout-link').attr('href');
-                return;
-            }
-
             this.waitText('Please wait...');
             $.post(this.getPostUrl(), {
                 'tfa_code': this.verifyCode()
