implemented disable totp for a user - #1237
Conversation
|
Did this because I thought it was a easy implementation :D |
GitLab Pipeline ActionGeneral informationLink to pipeline: https://gitlab.com/code0-tech/development/sagittarius/-/pipelines/2779892081 Status: Passed Job summariesrspec: [cloud]Coverage report available at https://code0-tech.gitlab.io/-/development/sagittarius/-/jobs/16033885625/artifacts/tmp/coverage/index.html rspec: [ee]Coverage report available at https://code0-tech.gitlab.io/-/development/sagittarius/-/jobs/16033885624/artifacts/tmp/coverage/index.html rspec: [ce]Coverage report available at https://code0-tech.gitlab.io/-/development/sagittarius/-/jobs/16033885623/artifacts/tmp/coverage/index.html docs:previewDocumentation preview available at https://code0-tech.gitlab.io/-/development/telescopium/-/jobs/16034004148/artifacts/out/index.html rubocop1006 files inspected, no offenses detected |
| argument :current_totp, String, | ||
| required: true, | ||
| description: 'The current totp at the time to verify the mfa authentication device' |
There was a problem hiding this comment.
We should use Types::Input::MfaInput here. You should be able to deactivate TOTP by verifying any configured MFA method (for example using a backup code in case you don't have access to your TOTP code generator)
You can look in the Users::Update mutation and service for that
| totp = ROTP::TOTP.new(current_user.totp_secret) | ||
|
|
||
| return ServiceResponse.error(error_code: :wrong_totp) unless totp.verify(current_totp) |
There was a problem hiding this comment.
There is current_user.validate_mfa!(mfa)
2 participants
Resolves: #649