Skip to content

feat(security): Add security events for recovery phone, recovery codes#18382

Merged
vbudhram merged 1 commit intomainfrom
fxa-11113
Feb 18, 2025
Merged

feat(security): Add security events for recovery phone, recovery codes#18382
vbudhram merged 1 commit intomainfrom
fxa-11113

Conversation

@vbudhram
Copy link
Copy Markdown
Contributor

Because

  • We want to let the user know when these events happe

This pull request

  • Add the new security events

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-11113

Checklist

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).

Other information (Optional)

On a side note, it feels like the process to add a new security event should be eaiser. Not sure it makes sense to do a database migration everytime we need to add one.

INSERT INTO securityEventNames(name) VALUES ('account.recovery_phone_removed');
INSERT INTO securityEventNames(name) VALUES ('account.recovery_codes_replaced');
INSERT INTO securityEventNames(name) VALUES ('account.recovery_codes_created');
INSERT INTO securityEventNames(name) VALUES ('account.recovery_codes_signin_complete');
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: why not just one INSERT?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, to ensure the order of the inserts?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No reason other than copy pasta heh

RECOVERY_CODE_COUNT
);

accountEventsManager.recordSecurityEvent(db, {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm presuming that you are not awaiting by choice. But just in case: you are not awaiting. :)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, didn't want to block the request on storing this data.

'account.password_reset_otp_sent': 24,
'account.password_reset_otp_verified': 25,
'session.destroy': 26,
'account.recovery_phone_setup_complete': 27,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see `'account.recovery_phone_send_code'.

Copy link
Copy Markdown
Contributor

@chenba chenba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think at least one value is missing from the EVENT_NAMES constant, so those id values are off.

@vbudhram
Copy link
Copy Markdown
Contributor Author

@chenba Made fixes, looks I forgot to add recording that event.

Copy link
Copy Markdown
Contributor

@chenba chenba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📱

@vbudhram vbudhram merged commit f641ada into main Feb 18, 2025
@vbudhram vbudhram deleted the fxa-11113 branch February 18, 2025 19:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants