fix: add last_challenged_at field to mfa factors #1705

J0 · 2024-08-02T20:10:54Z

What kind of change does this PR introduce?

Deprecates sent_at on Challenge in favour of the last_challenged_at field on factors. We use this to calculate whether it's appropriate to allow for more SMS-es to be sent.

Base is pointed to #1693 as it depends on the PR and diffs are smaller when pointed against #1693

coveralls · 2024-08-04T23:57:43Z

Pull Request Test Coverage Report for Build 10247167420

Details

15 of 24 (62.5%) changed or added relevant lines in 2 files are covered.
14 unchanged lines in 2 files lost coverage.
Overall coverage decreased (-0.08%) to 58.284%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/mfa.go	7	10	70.0%
internal/models/factor.go	8	14	57.14%

Files with Coverage Reduction	New Missed Lines	%
internal/models/errors.go	2	45.59%
internal/models/factor.go	12	72.0%

Totals
Change from base Build 10247113177:	-0.08%
Covered Lines:	9192
Relevant Lines:	15771

💛 - Coveralls

internal/api/mfa.go

internal/models/factor.go

internal/api/mfa.go

🤖 I have created a release *beep* *boop* --- ## [2.158.1](v2.158.0...v2.158.1) (2024-08-05) ### Bug Fixes * add last_challenged_at field to mfa factors ([#1705](#1705)) ([29cbeb7](29cbeb7)) * allow enabling sms hook without setting up sms provider ([#1704](#1704)) ([575e88a](575e88a)) * drop the MFA_ENABLED config ([#1701](#1701)) ([078c3a8](078c3a8)) * enforce uniqueness on verified phone numbers ([#1693](#1693)) ([70446cc](70446cc)) * expose `X-Supabase-Api-Version` header in CORS ([#1612](#1612)) ([6ccd814](6ccd814)) * include factor_id in query ([#1702](#1702)) ([ac14e82](ac14e82)) * move is owned by check to load factor ([#1703](#1703)) ([701a779](701a779)) * refactor TOTP MFA into separate methods ([#1698](#1698)) ([250d92f](250d92f)) * remove check for content-length ([#1700](#1700)) ([81b332d](81b332d)) * remove FindFactorsByUser ([#1707](#1707)) ([af8e2dd](af8e2dd)) * update openapi spec for MFA (Phone) ([#1689](#1689)) ([a3da4b8](a3da4b8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Deprecates `sent_at` on Challenge in favour of the `last_challenged_at` field on factors. We use this to calculate whether it's appropriate to allow for more SMS-es to be sent. Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller when pointed against supabase#1693

🤖 I have created a release *beep* *boop* --- ## [2.158.1](supabase/auth@v2.158.0...v2.158.1) (2024-08-05) ### Bug Fixes * add last_challenged_at field to mfa factors ([supabase#1705](supabase#1705)) ([29cbeb7](supabase@29cbeb7)) * allow enabling sms hook without setting up sms provider ([supabase#1704](supabase#1704)) ([575e88a](supabase@575e88a)) * drop the MFA_ENABLED config ([supabase#1701](supabase#1701)) ([078c3a8](supabase@078c3a8)) * enforce uniqueness on verified phone numbers ([supabase#1693](supabase#1693)) ([70446cc](supabase@70446cc)) * expose `X-Supabase-Api-Version` header in CORS ([supabase#1612](supabase#1612)) ([6ccd814](supabase@6ccd814)) * include factor_id in query ([supabase#1702](supabase#1702)) ([ac14e82](supabase@ac14e82)) * move is owned by check to load factor ([supabase#1703](supabase#1703)) ([701a779](supabase@701a779)) * refactor TOTP MFA into separate methods ([supabase#1698](supabase#1698)) ([250d92f](supabase@250d92f)) * remove check for content-length ([supabase#1700](supabase#1700)) ([81b332d](supabase@81b332d)) * remove FindFactorsByUser ([supabase#1707](supabase#1707)) ([af8e2dd](supabase@af8e2dd)) * update openapi spec for MFA (Phone) ([supabase#1689](supabase#1689)) ([a3da4b8](supabase@a3da4b8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Deprecates `sent_at` on Challenge in favour of the `last_challenged_at` field on factors. We use this to calculate whether it's appropriate to allow for more SMS-es to be sent. Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller when pointed against supabase#1693

🤖 I have created a release *beep* *boop* --- ## [2.158.1](supabase/auth@v2.158.0...v2.158.1) (2024-08-05) ### Bug Fixes * add last_challenged_at field to mfa factors ([supabase#1705](supabase#1705)) ([29cbeb7](supabase@29cbeb7)) * allow enabling sms hook without setting up sms provider ([supabase#1704](supabase#1704)) ([575e88a](supabase@575e88a)) * drop the MFA_ENABLED config ([supabase#1701](supabase#1701)) ([078c3a8](supabase@078c3a8)) * enforce uniqueness on verified phone numbers ([supabase#1693](supabase#1693)) ([70446cc](supabase@70446cc)) * expose `X-Supabase-Api-Version` header in CORS ([supabase#1612](supabase#1612)) ([6ccd814](supabase@6ccd814)) * include factor_id in query ([supabase#1702](supabase#1702)) ([ac14e82](supabase@ac14e82)) * move is owned by check to load factor ([supabase#1703](supabase#1703)) ([701a779](supabase@701a779)) * refactor TOTP MFA into separate methods ([supabase#1698](supabase#1698)) ([250d92f](supabase@250d92f)) * remove check for content-length ([supabase#1700](supabase#1700)) ([81b332d](supabase@81b332d)) * remove FindFactorsByUser ([supabase#1707](supabase#1707)) ([af8e2dd](supabase@af8e2dd)) * update openapi spec for MFA (Phone) ([supabase#1689](supabase#1689)) ([a3da4b8](supabase@a3da4b8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Deprecates `sent_at` on Challenge in favour of the `last_challenged_at` field on factors. We use this to calculate whether it's appropriate to allow for more SMS-es to be sent. Base is pointed to supabase#1693 as it depends on the PR and diffs are smaller when pointed against supabase#1693

🤖 I have created a release *beep* *boop* --- ## [2.158.1](supabase/auth@v2.158.0...v2.158.1) (2024-08-05) ### Bug Fixes * add last_challenged_at field to mfa factors ([supabase#1705](supabase#1705)) ([29cbeb7](supabase@29cbeb7)) * allow enabling sms hook without setting up sms provider ([supabase#1704](supabase#1704)) ([575e88a](supabase@575e88a)) * drop the MFA_ENABLED config ([supabase#1701](supabase#1701)) ([078c3a8](supabase@078c3a8)) * enforce uniqueness on verified phone numbers ([supabase#1693](supabase#1693)) ([70446cc](supabase@70446cc)) * expose `X-Supabase-Api-Version` header in CORS ([supabase#1612](supabase#1612)) ([6ccd814](supabase@6ccd814)) * include factor_id in query ([supabase#1702](supabase#1702)) ([ac14e82](supabase@ac14e82)) * move is owned by check to load factor ([supabase#1703](supabase#1703)) ([701a779](supabase@701a779)) * refactor TOTP MFA into separate methods ([supabase#1698](supabase#1698)) ([250d92f](supabase@250d92f)) * remove check for content-length ([supabase#1700](supabase#1700)) ([81b332d](supabase@81b332d)) * remove FindFactorsByUser ([supabase#1707](supabase#1707)) ([af8e2dd](supabase@af8e2dd)) * update openapi spec for MFA (Phone) ([supabase#1689](supabase#1689)) ([a3da4b8](supabase@a3da4b8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

J0 added 10 commits August 4, 2024 21:53

fix: update checks on challenge to allow for only one phone factor

7f32a81

fix: change error code name and make factor deletion more specific

022c965

fix: adjust for type

0cba22b

fix: initial tests

7fa5566

fix: destroy all at once

58bf5bb

fix: update tests

f4af3a8

fix: refactor tests

8a6a489

fix: add last_challenged_at

edea4fb

fix: clean up migration

27d97fa

fix: update migration

2627ed2

J0 force-pushed the j0/add_last_challenged_at branch from a405e3e to 2627ed2 Compare August 4, 2024 20:42

J0 added 4 commits August 5, 2024 00:22

fix: clean up switch statements

4c612d2

fix: update minor naming

2a2cbec

fix: commit merge

2e2c2d5

fix: add last challenged_at

ef4c5ed

J0 marked this pull request as ready for review August 5, 2024 06:57

J0 requested a review from a team as a code owner August 5, 2024 06:57

J0 changed the base branch from master to j0/allow_only_one_phone_factor August 5, 2024 06:57

J0 commented Aug 5, 2024

View reviewed changes

internal/api/mfa.go Show resolved Hide resolved

J0 commented Aug 5, 2024

View reviewed changes

internal/models/factor.go Show resolved Hide resolved

J0 commented Aug 5, 2024

View reviewed changes

internal/models/factor.go Outdated Show resolved Hide resolved

fix: remove unused tx param

1d202fd

J0 commented Aug 5, 2024

View reviewed changes

internal/api/mfa.go Show resolved Hide resolved

hf approved these changes Aug 5, 2024

View reviewed changes

Base automatically changed from j0/allow_only_one_phone_factor to master August 5, 2024 10:27

Merge branch 'master' into j0/add_last_challenged_at

8329d2e

J0 merged commit 29cbeb7 into master Aug 5, 2024
2 checks passed

J0 deleted the j0/add_last_challenged_at branch August 5, 2024 10:51

github-actions bot mentioned this pull request Aug 5, 2024

chore(master): release 2.158.1 #1699

Merged

THPubs mentioned this pull request Sep 7, 2024

When I do a db pull it drops mfa_factors_last_challenged_at_key and this cause the application to break supabase/supabase#29151

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: add last_challenged_at field to mfa factors #1705

fix: add last_challenged_at field to mfa factors #1705

J0 commented Aug 2, 2024 •

edited

Loading

coveralls commented Aug 4, 2024 •

edited

Loading

fix: add last_challenged_at field to mfa factors #1705

fix: add last_challenged_at field to mfa factors #1705

Conversation

J0 commented Aug 2, 2024 • edited Loading

What kind of change does this PR introduce?

coveralls commented Aug 4, 2024 • edited Loading

Pull Request Test Coverage Report for Build 10247167420

Details

💛 - Coveralls

J0 commented Aug 2, 2024 •

edited

Loading

coveralls commented Aug 4, 2024 •

edited

Loading