Feature: two-factor authentication

[shamoon]

Proposed change

This pretty much entirely uses allauth's handling of totp and just kinda connects it to our frontend.

Closes #424

Type of change

• Bug fix: non-breaking change which fixes an issue.
• New feature / Enhancement: non-breaking change which adds functionality. Please read the important note above.
• Breaking change: fix or feature that would cause existing functionality to not work as expected.
• Documentation only.
• Other. Please explain:

Checklist:

• I have read & agree with the contributing guidelines.
• If applicable, I have included testing coverage for new code in this PR, for backend and / or front-end changes.
• If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.
• If applicable, I have checked that all tests pass, see documentation.
• I have run all pre-commit hooks, see documentation.
• I have made corresponding changes to the documentation as needed.
• I have checked my modifications for any breaking changes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.52%. Comparing base (36ecb85) to head (f80e85e).

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #8012      +/-   ##
==========================================
+ Coverage   97.50%   97.52%   +0.01%     
==========================================
  Files         475      475              
  Lines       19866    20006     +140     
  Branches     1564     1644      +80     
==========================================
+ Hits        19370    19510     +140     
+ Misses        496      493       -3     
- Partials        0        3       +3     

Flag	Coverage Δ
backend	96.40% <100.00%> (+0.02%)	⬆️
frontend	98.76% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[chwiese]

Thank you for working on this @shamoon. I saw that allauth supports WebAuthn (Passkeys) for MFA. Would you consider supporting that in addition to TOTP please?

[stumpylog]

Need to test it out too, but a couple minor thoughts

[stumpylog]

Did some testing, all seems to work. Anyway we can customize the name? Mine came across as root@localhost. Maybe use the username of the user?

[shamoon]

Hmm, Im not certain where the name comes from, my 2FA app doesn't really show that.

I did try setting the 'issuer':

paperless-ngx/src/paperless/settings.py

Line 462 in f80e85e

MFA_TOTP_ISSUER = "Paperless-ngx"

and it seemed to get the email correctly for me, so for example mine comes out as: otpauth://totp/me%40example.com?secret=PQQ73YEPH3K3QACWY4DHDOZJWMLID5UP&issuer=Paperless-ngx

Is root@localhost your email you were testing with?

[stumpylog]

Ah, that's the source. I don't set the email when I auto create a user

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion or issue for related concerns. See our contributing guidelines for more details.