(w http.ResponseWriter, r *http.Request)
| 340 | } |
| 341 | |
| 342 | func (a *API) challengePhoneFactor(w http.ResponseWriter, r *http.Request) error { |
| 343 | ctx := r.Context() |
| 344 | config := a.config |
| 345 | db := a.db.WithContext(ctx) |
| 346 | user := getUser(ctx) |
| 347 | factor := getFactor(ctx) |
| 348 | ipAddress := utilities.GetIPAddress(r) |
| 349 | params := &ChallengeFactorParams{} |
| 350 | if err := retrieveRequestParams(r, params); err != nil { |
| 351 | return err |
| 352 | } |
| 353 | channel := params.Channel |
| 354 | if channel == "" { |
| 355 | channel = sms_provider.SMSProvider |
| 356 | } |
| 357 | if !sms_provider.IsValidMessageChannel(channel, config) { |
| 358 | return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, InvalidChannelError) |
| 359 | } |
| 360 | |
| 361 | if factor.IsPhoneFactor() && factor.LastChallengedAt != nil { |
| 362 | if !factor.LastChallengedAt.Add(config.MFA.Phone.MaxFrequency).Before(time.Now()) { |
| 363 | return apierrors.NewTooManyRequestsError(apierrors.ErrorCodeOverSMSSendRateLimit, "%s", generateFrequencyLimitErrorMessage(factor.LastChallengedAt, config.MFA.Phone.MaxFrequency)) |
| 364 | } |
| 365 | } |
| 366 | |
| 367 | otp := crypto.GenerateOtp(config.MFA.Phone.OtpLength) |
| 368 | |
| 369 | challenge, err := factor.CreatePhoneChallenge(ipAddress, otp, config.Security.DBEncryption.Encrypt, config.Security.DBEncryption.EncryptionKeyID, config.Security.DBEncryption.EncryptionKey) |
| 370 | if err != nil { |
| 371 | return apierrors.NewInternalServerError("error creating SMS Challenge") |
| 372 | } |
| 373 | |
| 374 | message, err := generateSMSFromTemplate(config.MFA.Phone.SMSTemplate, otp) |
| 375 | if err != nil { |
| 376 | return apierrors.NewInternalServerError("error generating sms template").WithInternalError(err) |
| 377 | } |
| 378 | |
| 379 | phone := factor.Phone.String() |
| 380 | |
| 381 | if config.Hook.SendSMS.Enabled { |
| 382 | input := v0hooks.NewSendSMSInput( |
| 383 | r, |
| 384 | user, |
| 385 | v0hooks.SMS{ |
| 386 | OTP: otp, |
| 387 | SMSType: "mfa", |
| 388 | Phone: phone, |
| 389 | }, |
| 390 | ) |
| 391 | output := v0hooks.SendSMSOutput{} |
| 392 | err := a.hooksMgr.InvokeHook(db, r, input, &output) |
| 393 | if err != nil { |
| 394 | return apierrors.NewInternalServerError("error invoking hook") |
| 395 | } |
| 396 | } else { |
| 397 | smsProvider, err := sms_provider.GetSmsProvider(*config) |
| 398 | if err != nil { |
| 399 | return apierrors.NewInternalServerError("Failed to get SMS provider").WithInternalError(err) |
no test coverage detected