Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: enforce uniqueness on verified phone numbers #1693

Merged
merged 10 commits into from
Aug 5, 2024
Merged

fix: enforce uniqueness on verified phone numbers #1693

merged 10 commits into from
Aug 5, 2024

Conversation

J0
Copy link
Contributor

@J0 J0 commented Jul 31, 2024 •
edited
Loading

What kind of change does this PR introduce?

With this change:

  • Multiple verified phone mfa factors can exist so long as they have distinct phone numbers (see discussion below)
  • Enrolling a factor with a number that is the same as the existing verified factor will result in a 422 status code
  • Enrolling a factor with a number that is the same as another existing unverified factor will result in the deletion of the older factor.

Also includes:

  • A refactor to check for duplicate constraints at application level then at the Postgres layer.
  • A narrowing of deletion so that only unverified factors of the same type are deleted upon first successful verification

Follow up to #1687 to support the unique constraint on phone factors.

@coveralls
Copy link

coveralls commented Jul 31, 2024 •
edited
Loading

Pull Request Test Coverage Report for Build 10246916294

Details

  • 26 of 36 (72.22%) changed or added relevant lines in 2 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage increased (+0.04%) to 58.368%
Changes Missing Coverage Covered Lines Changed/Added Lines %
internal/api/mfa.go 18 28 64.29%
Totals Coverage Status
Change from base Build 10238217910: 0.04%
Covered Lines: 9200
Relevant Lines: 15762
💛 - Coveralls

J0
J0 commented Jul 31, 2024
View reviewed changes
internal/api/mfa.go Outdated Show resolved Hide resolved
kangmingtay
kangmingtay reviewed Jul 31, 2024
View reviewed changes
internal/api/errorcodes.go Outdated Show resolved Hide resolved
internal/api/mfa.go Outdated Show resolved Hide resolved
J0
J0 commented Aug 2, 2024
View reviewed changes
internal/api/mfa.go Show resolved Hide resolved
@J0 J0 force-pushed the j0/allow_only_one_phone_factor branch from 3405e53 to d6e0bca Compare August 3, 2024 10:17
J0
J0 commented Aug 3, 2024
View reviewed changes
internal/api/mfa_test.go Outdated Show resolved Hide resolved
@J0 J0 force-pushed the j0/allow_only_one_phone_factor branch from baef1a4 to 8a6a489 Compare August 4, 2024 20:33
@J0 J0 changed the title fix: update checks on challenge to allow for only one phone factor fix: update checks on enroll to allow for only one phone factor Aug 4, 2024
J0
J0 commented Aug 4, 2024
View reviewed changes
internal/api/mfa.go Show resolved Hide resolved
@J0 J0 marked this pull request as ready for review August 4, 2024 22:40
@J0 J0 requested a review from a team as a code owner August 4, 2024 22:40
@J0 J0 changed the title fix: update checks on enroll to allow for only one phone factor fix: allow enrollment of only one verified phone factor Aug 4, 2024
@J0 J0 changed the title fix: allow enrollment of only one verified phone factor fix: restrict enrollment to only one verified phone factor Aug 4, 2024
J0
J0 commented Aug 4, 2024
View reviewed changes
internal/api/mfa.go Show resolved Hide resolved
@J0 J0 mentioned this pull request Aug 5, 2024
Merged
hf
hf approved these changes Aug 5, 2024
View reviewed changes
Copy link
Contributor

@hf hf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems OK except for the limitation about enrolling multiple phone numbers.

internal/api/mfa.go Outdated Show resolved Hide resolved
@J0 J0 changed the title fix: restrict enrollment to only one verified phone factor fix: enforce uniqueness on verified phone numbers Aug 5, 2024
@J0 J0 merged commit 70446cc into master Aug 5, 2024
4 checks passed
@J0 J0 deleted the j0/allow_only_one_phone_factor branch August 5, 2024 10:27
@github-actions github-actions bot mentioned this pull request Aug 4, 2024
Merged
J0 added a commit that referenced this pull request Aug 5, 2024
@J0
fix: add last_challenged_at field to mfa factors (#1705)
29cbeb7 
## What kind of change does this PR introduce?

Deprecates `sent_at` on Challenge in favour of the `last_challenged_at`
field on factors. We use this to calculate whether it's appropriate to
allow for more SMS-es to be sent.

Base is pointed to #1693 as it depends on the PR and diffs are smaller
when pointed against #1693
J0 pushed a commit that referenced this pull request Aug 5, 2024
@github-actions
chore(master): release 2.158.1 (#1699)
499f6fc 
🤖 I have created a release *beep* *boop*
---


##
[2.158.1](v2.158.0...v2.158.1)
(2024-08-05)


### Bug Fixes

* add last_challenged_at field to mfa factors
([#1705](#1705))
([29cbeb7](29cbeb7))
* allow enabling sms hook without setting up sms provider
([#1704](#1704))
([575e88a](575e88a))
* drop the MFA_ENABLED config
([#1701](#1701))
([078c3a8](078c3a8))
* enforce uniqueness on verified phone numbers
([#1693](#1693))
([70446cc](70446cc))
* expose `X-Supabase-Api-Version` header in CORS
([#1612](#1612))
([6ccd814](6ccd814))
* include factor_id in query
([#1702](#1702))
([ac14e82](ac14e82))
* move is owned by check to load factor
([#1703](#1703))
([701a779](701a779))
* refactor TOTP MFA into separate methods
([#1698](#1698))
([250d92f](250d92f))
* remove check for content-length
([#1700](#1700))
([81b332d](81b332d))
* remove FindFactorsByUser
([#1707](#1707))
([af8e2dd](af8e2dd))
* update openapi spec for MFA (Phone)
([#1689](#1689))
([a3da4b8](a3da4b8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@J0
fix: enforce uniqueness on verified phone numbers (supabase#1693)
f17407b 
## What kind of change does this PR introduce?

With this change:
- Multiple verified phone mfa factors can exist so long as they have
distinct phone numbers (see discussion below)
- Enrolling a factor with a number that is the same as the existing
verified factor will result in a 422 status code
- Enrolling a factor with a number that is the same as another existing
unverified factor will result in the deletion of the older factor.

Also includes:
- A refactor to check for duplicate constraints at application level
then at the Postgres layer.
- A narrowing of deletion so that only unverified factors of the same
type are deleted upon first successful verification

Follow up to supabase#1687 to support the unique constraint on phone factors.
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@J0
fix: add last_challenged_at field to mfa factors (supabase#1705)
c4120f4 
## What kind of change does this PR introduce?

Deprecates `sent_at` on Challenge in favour of the `last_challenged_at`
field on factors. We use this to calculate whether it's appropriate to
allow for more SMS-es to be sent.

Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller
when pointed against supabase#1693
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@github-actions
chore(master): release 2.158.1 (supabase#1699)
a3655af 
🤖 I have created a release *beep* *boop*
---


##
[2.158.1](supabase/auth@v2.158.0...v2.158.1)
(2024-08-05)


### Bug Fixes

* add last_challenged_at field to mfa factors
([supabase#1705](supabase#1705))
([29cbeb7](supabase@29cbeb7))
* allow enabling sms hook without setting up sms provider
([supabase#1704](supabase#1704))
([575e88a](supabase@575e88a))
* drop the MFA_ENABLED config
([supabase#1701](supabase#1701))
([078c3a8](supabase@078c3a8))
* enforce uniqueness on verified phone numbers
([supabase#1693](supabase#1693))
([70446cc](supabase@70446cc))
* expose `X-Supabase-Api-Version` header in CORS
([supabase#1612](supabase#1612))
([6ccd814](supabase@6ccd814))
* include factor_id in query
([supabase#1702](supabase#1702))
([ac14e82](supabase@ac14e82))
* move is owned by check to load factor
([supabase#1703](supabase#1703))
([701a779](supabase@701a779))
* refactor TOTP MFA into separate methods
([supabase#1698](supabase#1698))
([250d92f](supabase@250d92f))
* remove check for content-length
([supabase#1700](supabase#1700))
([81b332d](supabase@81b332d))
* remove FindFactorsByUser
([supabase#1707](supabase#1707))
([af8e2dd](supabase@af8e2dd))
* update openapi spec for MFA (Phone)
([supabase#1689](supabase#1689))
([a3da4b8](supabase@a3da4b8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@J0 @LashaJini
fix: enforce uniqueness on verified phone numbers (supabase#1693)
1d7bbe9 
## What kind of change does this PR introduce?

With this change:
- Multiple verified phone mfa factors can exist so long as they have
distinct phone numbers (see discussion below)
- Enrolling a factor with a number that is the same as the existing
verified factor will result in a 422 status code
- Enrolling a factor with a number that is the same as another existing
unverified factor will result in the deletion of the older factor.

Also includes:
- A refactor to check for duplicate constraints at application level
then at the Postgres layer.
- A narrowing of deletion so that only unverified factors of the same
type are deleted upon first successful verification

Follow up to supabase#1687 to support the unique constraint on phone factors.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@J0 @LashaJini
fix: add last_challenged_at field to mfa factors (supabase#1705)
3fe7b66 
## What kind of change does this PR introduce?

Deprecates `sent_at` on Challenge in favour of the `last_challenged_at`
field on factors. We use this to calculate whether it's appropriate to
allow for more SMS-es to be sent.

Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller
when pointed against supabase#1693
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@github-actions @LashaJini
chore(master): release 2.158.1 (supabase#1699)
8583c12 
🤖 I have created a release *beep* *boop*
---


##
[2.158.1](supabase/auth@v2.158.0...v2.158.1)
(2024-08-05)


### Bug Fixes

* add last_challenged_at field to mfa factors
([supabase#1705](supabase#1705))
([29cbeb7](supabase@29cbeb7))
* allow enabling sms hook without setting up sms provider
([supabase#1704](supabase#1704))
([575e88a](supabase@575e88a))
* drop the MFA_ENABLED config
([supabase#1701](supabase#1701))
([078c3a8](supabase@078c3a8))
* enforce uniqueness on verified phone numbers
([supabase#1693](supabase#1693))
([70446cc](supabase@70446cc))
* expose `X-Supabase-Api-Version` header in CORS
([supabase#1612](supabase#1612))
([6ccd814](supabase@6ccd814))
* include factor_id in query
([supabase#1702](supabase#1702))
([ac14e82](supabase@ac14e82))
* move is owned by check to load factor
([supabase#1703](supabase#1703))
([701a779](supabase@701a779))
* refactor TOTP MFA into separate methods
([supabase#1698](supabase#1698))
([250d92f](supabase@250d92f))
* remove check for content-length
([supabase#1700](supabase#1700))
([81b332d](supabase@81b332d))
* remove FindFactorsByUser
([supabase#1707](supabase#1707))
([af8e2dd](supabase@af8e2dd))
* update openapi spec for MFA (Phone)
([supabase#1689](supabase#1689))
([a3da4b8](supabase@a3da4b8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@J0 @LashaJini
fix: enforce uniqueness on verified phone numbers (supabase#1693)
25acc32 
## What kind of change does this PR introduce?

With this change:
- Multiple verified phone mfa factors can exist so long as they have
distinct phone numbers (see discussion below)
- Enrolling a factor with a number that is the same as the existing
verified factor will result in a 422 status code
- Enrolling a factor with a number that is the same as another existing
unverified factor will result in the deletion of the older factor.

Also includes:
- A refactor to check for duplicate constraints at application level
then at the Postgres layer.
- A narrowing of deletion so that only unverified factors of the same
type are deleted upon first successful verification

Follow up to supabase#1687 to support the unique constraint on phone factors.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@J0 @LashaJini
fix: add last_challenged_at field to mfa factors (supabase#1705)
06abe0d 
## What kind of change does this PR introduce?

Deprecates `sent_at` on Challenge in favour of the `last_challenged_at`
field on factors. We use this to calculate whether it's appropriate to
allow for more SMS-es to be sent.

Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller
when pointed against supabase#1693
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@github-actions @LashaJini
chore(master): release 2.158.1 (supabase#1699)
dad9be7 
🤖 I have created a release *beep* *boop*
---


##
[2.158.1](supabase/auth@v2.158.0...v2.158.1)
(2024-08-05)


### Bug Fixes

* add last_challenged_at field to mfa factors
([supabase#1705](supabase#1705))
([29cbeb7](supabase@29cbeb7))
* allow enabling sms hook without setting up sms provider
([supabase#1704](supabase#1704))
([575e88a](supabase@575e88a))
* drop the MFA_ENABLED config
([supabase#1701](supabase#1701))
([078c3a8](supabase@078c3a8))
* enforce uniqueness on verified phone numbers
([supabase#1693](supabase#1693))
([70446cc](supabase@70446cc))
* expose `X-Supabase-Api-Version` header in CORS
([supabase#1612](supabase#1612))
([6ccd814](supabase@6ccd814))
* include factor_id in query
([supabase#1702](supabase#1702))
([ac14e82](supabase@ac14e82))
* move is owned by check to load factor
([supabase#1703](supabase#1703))
([701a779](supabase@701a779))
* refactor TOTP MFA into separate methods
([supabase#1698](supabase#1698))
([250d92f](supabase@250d92f))
* remove check for content-length
([supabase#1700](supabase#1700))
([81b332d](supabase@81b332d))
* remove FindFactorsByUser
([supabase#1707](supabase#1707))
([af8e2dd](supabase@af8e2dd))
* update openapi spec for MFA (Phone)
([supabase#1689](supabase#1689))
([a3da4b8](supabase@a3da4b8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kangmingtay kangmingtay kangmingtay left review comments

@hf hf hf approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@J0 @coveralls @hf @kangmingtay