Skip to content
This repository was archived by the owner on Apr 6, 2022. It is now read-only.

Conversation

pozylon
Copy link
Contributor

@pozylon pozylon commented Feb 6, 2018

  • Refactor the auth module to allow for token challenge type abstraction
  • DB: Entangle sessions from tokens
  • Add TOTP Challenge Type
  • Adjust the GraphQL API to allow multiple token challenge validation for 2FA
  • DB: Add Flag and Secret to User for 2FA
  • Add GraphQL Operations to manage 2FA activation (store shared secret, toggle 2fa login, ...)
  • Add token expiration logic & extend the error reporting so a UI can behave differently on "token expired", "2fa required", "token not found", "token burned" errors.
  • Verify Phone number
  • Twilio
  • Translations
  • Update Birdsview Documentation with current schema
  • add user.enabledSecondFactorTokenTypes + expose on user instead of isTwoFactorEnabled, allow supporters to read it too
  • change unauthorizedSession to unauthorizedSigninRequest(email: String!, tokenChallenge: SignInTokenChallenge!): unauthorizedSignInResponse!
    unauthorizedSignInResponse contains "availableSecondFactors" (better naming), unauthorizedSession: Session!
  • change authorizeSession(email: String!, tokenChallenge: SignInTokenChallenge!, secondFactor: SignInTokenChallenge): Boolean!
    to: authorizeSession(email: String!, tokens: [SignInToken!]!
  • updateTwoFactorAuthentication(enabled: Boolean!): Boolean! -> updateTwoFactorAuthentication(tokenType: SignInTokenChallenge!, enabled: Boolean!): Boolean!
  • atomically restrict updates based on enabledSecondFactorTokenTypes: avoid changing phoneNumber if phoneNumber is enabled for twoFactor
  • Tests (90%)
  • BONUS: expose API for admins and supporters, which token (types) have been used to authorize a session
  • BONUS: E-Mail on lose of two factor mode (if user.enabledSecondFactorTokenTypes gets empty)
  • Translations
  • Tests: authorizeSession

pozylon and others added 30 commits January 23, 2018 10:40
…er email address

affects: @orbiting/backend-modules-mail
affects: @orbiting/backend-modules-auth, @orbiting/backend-modules-mail
affects: @orbiting/backend-modules-auth
affects: @orbiting/backend-modules-auth, @orbiting/backend-modules-mail
affects: @orbiting/backend-modules-auth, @orbiting/backend-modules-base
affects: @orbiting/backend-modules-auth, @orbiting/backend-modules-base,
@orbiting/backend-modules-mail

BREAKING CHANGE:
mail, auth, base
* master: (30 commits)
  chore(release): releasing component
  fix(assets): remove unnecessary await
  chore(release): releasing component
  feat(assets): buffer instead of stream for content-length
  chore(release): releasing component
  fix(base): clear cf cookie
  chore(release): releasing component
  fix(documents): webp cap. check
  chore(release): releasing component
  chore(release): releasing component
  chore(release): releasing component
  feat(assets): repo.uploadImages: transfers images from github to AWS S3
  feat(documents): add webp suffix to image urls in Document resolvers
  feat(assets): add lib webp url suffixer
  fix(documents): devide processRepoImageUrls in processRepoImageUrlsInContent and -InMeta
  feat(documents): add lib processImageUrls (migrate from publikator-backend)
  feat(assets): add size=WxH to portraitUrl in uploadPortrait
  feat(assets): upload lib, cleanup convertImage
  chore(assets): readme
  fix(assets): readme
  ...
* fix-session-clear:
  fix(auth): fix clearSession
* move-interests:
  fix(auth): fix updateUserEmail
  fix(auth): use the new moveNewsletterSubscriptions from mail
  Revert "fix(auth): remove changeEmail, belongs to republik-backend"
  feat(mail): adds method to move newsletter settings from one to another email address
allows to cancel a session request, will invalidate assigned tokens but no login
patte and others added 26 commits May 18, 2018 16:49
@patte patte removed the needs tests label May 19, 2018
@patte patte merged commit 2f587d9 into master May 19, 2018
@patte patte deleted the totp branch May 19, 2018 02:33
patrickvenetz added a commit that referenced this pull request Dec 25, 2018
Fixes access invitation email subject line take #2
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants