Skip to content

feat (2fa): Add IStatelessProvider interface #57216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Roszakos wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat (2fa): Add IStatelessProvider interface #57216

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79013e0
feat (2fa): Add IStatelessProvider interface
Roszakos Dec 19, 2025
739bd3d
refactor (2fa): Change IStatelessProvider definition
Roszakos Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions AUTHORS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -629,6 +629,7 @@
- zorn-v <[email protected]>
- zulan <[email protected]>
- Łukasz Buśko <[email protected]>
- Michał Roszak <[email protected]>
- Nextcloud GmbH
- ownCloud GmbH
- ownCloud, Inc.
Expand Down
9 changes: 7 additions & 2 deletions lib/private/Authentication/TwoFactorAuth/ProviderManager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
use OCP\Authentication\TwoFactorAuth\IDeactivatableByAdmin;
use OCP\Authentication\TwoFactorAuth\IProvider;
use OCP\Authentication\TwoFactorAuth\IRegistry;
use OCP\Authentication\TwoFactorAuth\IStatelessProvider;
use OCP\IUser;

class ProviderManager {
Expand Down Expand Up @@ -47,7 +48,9 @@ private function getProvider(string $providerId, IUser $user): IProvider {
public function tryEnableProviderFor(string $providerId, IUser $user): bool {
$provider = $this->getProvider($providerId, $user);

if ($provider instanceof IActivatableByAdmin) {
if ($provider instanceof IActivatableByAdmin
&& !($provider instanceof IStatelessProvider)
) {
$provider->enableFor($user);
$this->providerRegistry->enableProviderFor($provider, $user);
return true;
Expand All @@ -66,7 +69,9 @@ public function tryEnableProviderFor(string $providerId, IUser $user): bool {
public function tryDisableProviderFor(string $providerId, IUser $user): bool {
$provider = $this->getProvider($providerId, $user);

if ($provider instanceof IDeactivatableByAdmin) {
if ($provider instanceof IDeactivatableByAdmin
&& !($provider instanceof IStatelessProvider)
) {
$provider->disableFor($user);
$this->providerRegistry->disableProviderFor($provider, $user);
return true;
Expand Down
9 changes: 9 additions & 0 deletions lib/private/Authentication/TwoFactorAuth/Registry.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
use OC\Authentication\TwoFactorAuth\Db\ProviderUserAssignmentDao;
use OCP\Authentication\TwoFactorAuth\IProvider;
use OCP\Authentication\TwoFactorAuth\IRegistry;
use OCP\Authentication\TwoFactorAuth\IStatelessProvider;
use OCP\Authentication\TwoFactorAuth\RegistryEvent;
use OCP\Authentication\TwoFactorAuth\TwoFactorProviderDisabled;
use OCP\Authentication\TwoFactorAuth\TwoFactorProviderForUserRegistered;
Expand All @@ -37,6 +38,10 @@ public function getProviderStates(IUser $user): array {
}

public function enableProviderFor(IProvider $provider, IUser $user) {
if ($provider instanceof IStatelessProvider) {
return;
}

$this->assignmentDao->persist($provider->getId(), $user->getUID(), 1);

$event = new RegistryEvent($provider, $user);
Expand All @@ -45,6 +50,10 @@ public function enableProviderFor(IProvider $provider, IUser $user) {
}

public function disableProviderFor(IProvider $provider, IUser $user) {
if ($provider instanceof IStatelessProvider) {
return;
}

$this->assignmentDao->persist($provider->getId(), $user->getUID(), 0);

$event = new RegistryEvent($provider, $user);
Expand Down
21 changes: 21 additions & 0 deletions lib/public/Authentication/TwoFactorAuth/IStatelessProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
<?php

declare(strict_types=1);

/**
* SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-only
*/

namespace OCP\Authentication\TwoFactorAuth;

use OCP\IUser;

/**
* Marks the 2FA provider stateless. That means the state of 2FA activation
* for user will be checked dynamically and not stored in the database.
*/
Comment on lines 16 to 19
Copy link
Member

@CarlSchwan CarlSchwan Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* for user will be checked dynamically and not stored in the database.
*/
* for user will be checked dynamically and not stored in the database.
* @since 33.0.0
*/
#[Implementable(since: '33.0.0')]

interface IStatelessProvider extends IProvider {

Check failure on line 18 in lib/public/Authentication/TwoFactorAuth/IStatelessProvider.php

View workflow job for this annotation

GitHub Actions / static-code-analysis-ocp

InvalidDocblock 

lib/public/Authentication/TwoFactorAuth/IStatelessProvider.php:18:1: InvalidDocblock: @SInCE is required for classes/interfaces in OCP. (see https://psalm.dev/008)

public function isTwoFactorAuthEnabledForUser(IUser $user): bool;
Copy link
Member

@CarlSchwan CarlSchwan Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
public function isTwoFactorAuthEnabledForUser(IUser $user): bool;

Doesn't add anything sine this method is from the parent interface

Copy link
Author

@Roszakos Roszakos Dec 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True. I added it, because i was concerned it may get removed from the IProvider interface in the future, since the DocBlock of the OC\Authentication\TwoFactorAuth\Manager::fixMissingProviderStates method says "todo: remove in Nextcloud 17 as by then all providers should have been updated" and it is the only usage of isTwoFactorAuthEnabledForUser method.

Anyway, i'm going to remove it from my interface, since there is no need for that at the moment.

}
25 changes: 25 additions & 0 deletions tests/lib/Authentication/TwoFactorAuth/RegistryTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
use OC\Authentication\TwoFactorAuth\Registry;
use OCP\Authentication\TwoFactorAuth\IProvider;
use OCP\Authentication\TwoFactorAuth\IRegistry;
use OCP\Authentication\TwoFactorAuth\IStatelessProvider;
use OCP\Authentication\TwoFactorAuth\RegistryEvent;
use OCP\Authentication\TwoFactorAuth\TwoFactorProviderDisabled;
use OCP\Authentication\TwoFactorAuth\TwoFactorProviderForUserRegistered;
Expand Down Expand Up @@ -81,6 +82,18 @@ public function testEnableProvider(): void {
$this->registry->enableProviderFor($provider, $user);
}

public function testEnableStatelessProvider(): void {
$user = $this->createMock(IUser::class);
$provider = $this->createMock(IStatelessProvider::class);

$this->dao->expects($this->never())->method('persist');

$this->dispatcher->expects($this->never())->method('dispatch');
$this->dispatcher->expects($this->never())->method('dispatchTyped');

$this->registry->enableProviderFor($provider, $user);
}

public function testDisableProvider(): void {
$user = $this->createMock(IUser::class);
$provider = $this->createMock(IProvider::class);
Expand Down Expand Up @@ -108,6 +121,18 @@ public function testDisableProvider(): void {
$this->registry->disableProviderFor($provider, $user);
}

public function testDisableStatelessProvider(): void {
$user = $this->createMock(IUser::class);
$provider = $this->createMock(IStatelessProvider::class);

$this->dao->expects($this->never())->method('persist');

$this->dispatcher->expects($this->never())->method('dispatch');
$this->dispatcher->expects($this->never())->method('dispatchTyped');

$this->registry->disableProviderFor($provider, $user);
}

public function testDeleteUserData(): void {
$user = $this->createMock(IUser::class);
$user->expects($this->once())->method('getUID')->willReturn('user123');
Expand Down
Loading