Commit Graph
4 Commits
Author SHA1 Message Date
17def223b6 Feat/2fa (#9634)
# Description
Closes #7003 
Implements 2FA with TOTP. 

>[!WARNING]
> This is a draft PR, with only partial changes, made as a mean of
discussion about #7003 (it's easier to reason about real code)

## Behaviour
- a `totpSecret` is stored for each user
- use [`otplib`](https://github.com/yeojz/otplib/tree/master) to create
a QR code and to validate an `otp` against an `totpSecret` (great [demo
website](https://otplib.yeojz.dev/) by `otplib`)
- OTP is asked upon each login attempt

## Source
Inspired by:
- [RFC 6238](https://datatracker.ietf.org/doc/html/rfc6238)
- Cal.com's implementation of 2FA, namely
- [raising a
401](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/packages/features/auth/lib/next-auth-options.ts#L188-L190)
when missing OTP and 2FA is enabled, with a [specific error
code](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/packages/features/auth/lib/ErrorCode.ts#L9)
- [catching the
401](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/apps/web/modules/auth/login-view.tsx#L160)
in the frontend and
[displaying](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/apps/web/modules/auth/login-view.tsx#L276)
the OTP input

## Remaining
- [ ] encrypt `totpSecret` at rest using a symetric algorithm

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-01-24 18:23:57 +01:00
Nicolas Rouanne 07fa58b042 docs(server-commands): fix typo in command to generate migrations (#9545)
- the command had `--migration:generate` instead of `migration:generate`
written in the doc
- when copy pasting it we got this error
```
Not enough non-option arguments: got 0, need at least 1
```
- after removing the extra `--` it worked as expected
2025-01-10 17:21:15 +01:00
Nicolas RouanneandFélix Malfait dc42315f12 fix(SingleEntitySelectMenuItems): extract Add New button from entitiesToSelect (#8474)
# Description
Closes #8169

Extract Add New button from entitiesToSelect and add it as a separate
element .
There doesn't seem to be a point in having Add New as part of a list, it
seems better off in its own component, apart from list items

## Rationale
There already is #8353 addressing the same issue, but it seems it
doesn't really remove the duplicate "Add New" in the list, leaving a
duplicate "Add New" in `SingleEntitySelect`

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
2024-11-16 06:49:55 +01:00
Nicolas Rouanne cde96cf526 Fix/validate access token user not found (#8484)
# Description
Closes #7244 

See details about implementation:
https://github.com/twentyhq/twenty/issues/7244#issuecomment-2473845859
and
https://github.com/twentyhq/twenty/issues/7244#issuecomment-2473905514

# Changes
- return a `USER_NOT_FOUND` error instead of `INVALID_INPUT` error
- tweak unit tests to correctly test `AuthExceptionCode`, as it wasn't
properly tested; it was actually a _false positive_. This is because
[`toThrow`](https://jestjs.io/docs/expect#tothrowerror) from jest only
checks the `message`, and not any other method / attributes from the
`Error`. It's a know behaviour and not considered a bug, see
https://github.com/jestjs/jest/issues/13232#issuecomment-1252392845
2024-11-13 18:50:30 +01:00