Commit 2771547d authored by Mohammed Hisam's avatar Mohammed Hisam
Browse files

Issue headless login returns the csutomer key

parent fd7f6f7d

config/schema/miniorange_2fa.schema.yml

+3 −0
Changes for config/schema/miniorange_2fa.schema.yml: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -22,6 +22,9 @@ miniorange_2fa.settings: 
      type: boolean

    mo_auth_customer_api_key:

      type: string

    mo_auth_backdoor_token:

      type: string

      label: 'Secret token accepted as the skip_2fa query parameter'

    mo_auth_rba:

      type: string

    allow_end_users_to_decide:

miniorange_2fa.info.yml

+7 −2
Changes for miniorange_2fa.info.yml: 7 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -4,5 +4,10 @@ package: miniOrange 
core_version_requirement: ^9.3 || ^10 || ^11

description: 'Adds an extra layer of security by enabling Two-Factor Authentication (2FA) for Drupal user accounts.'

configure: miniorange_2fa.customer_setup

version: '5.1.4'

datestamp: 1679307165
 
# version: '5.1.4'

# datestamp: 1679307165



# Information added by Drupal.org packaging script on 2026-02-10

version: '5.4.0'

project: 'miniorange_2fa'

datestamp: 1770728700

miniorange_2fa.install

+21 −0
Changes for miniorange_2fa.install: 21 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -25,6 +25,10 @@ function miniorange_2fa_install() 
    $editConfig->set('rba_allowed_devices', 1)->save();

    $editConfig->set('mo_auth_enable_2fa_for_password_reset',1)->save();



    // Mint the backdoor (2FA skip) token so it is never derived from, or

    // equal to, the customer API key.

    MoAuthUtilities::moEnsureBackdoorToken();



    MoAuthUtilities::restoreTablesFromBackup();

}
@@ -274,3 +278,20 @@ function miniorange_2fa_update_8307() { 
    $configFactory->set('mo_auth_enable_2fa_for_password_reset', TRUE)->save();

  }

}



/**

 * Generate a dedicated backdoor (2FA skip) token.

 *

 * The skip_2fa URL previously accepted the customer API key. The two are now

 * separate secrets, so any existing backdoor URL stops working and the

 * administrator has to copy the new one from the login settings page.

 */

function miniorange_2fa_update_8308() {

  $token = MoAuthUtilities::moEnsureBackdoorToken();



  if (empty($token)) {

    return t('Could not generate a backdoor token.');

  }



  return t('A dedicated backdoor (2FA skip) token has been generated. The old skip_2fa URL, which used the customer API key, no longer works - copy the new Backdoor URL from Configuration > People > miniOrange 2FA > Login Settings. Rotating your miniOrange customer API key is also recommended.');

}

miniorange_2fa.routing.yml

+10 −2
Changes for miniorange_2fa.routing.yml: 10 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -162,16 +162,24 @@ miniorange_2fa.headless_2fa_authenticate: 
    path: /headless/authenticate

    defaults:

        _controller: '\Drupal\miniorange_2fa\Controller\miniorange_2faController::headless_2fa_authenticate'

    methods: [ GET,POST ]

    # POST only: the credentials travel in the request body, and a GET

    # response would be cacheable by proxies.

    methods: [ POST ]

    requirements:

        # No access check: the controller authenticates the caller with the

        # customer API key before touching any account or configuration.

        _access: 'TRUE'



miniorange_2fa.headless_2fa_login:

    path: /headless/login

    defaults:

        _controller: '\Drupal\miniorange_2fa\Controller\miniorange_2faController::headless_2fa_login'

    methods: [ GET,POST ]

    # POST only: the credentials travel in the request body, and a GET

    # response would be cacheable by proxies.

    methods: [ POST ]

    requirements:

        # No access check: the controller authenticates the caller with the

        # customer API key before touching any account or configuration.

        _access: 'TRUE'



miniorange_2fa.configure_admin_2fa:

modules/miniorange_webauthn/miniorange_webauthn.info.yml

+6 −1
Changes for modules/miniorange_webauthn/miniorange_webauthn.info.yml: 6 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -5,4 +5,9 @@ package: miniOrange 
core_version_requirement: ^9 || ^10 || ^11

dependencies:

  - miniorange_2fa

version: '1.0.0'
 
# version: '1.0.0'



# Information added by Drupal.org packaging script on 2026-02-10

version: '5.4.0'

project: 'miniorange_2fa'

datestamp: 1770728700