[rokwire#674] Refactor account auth types (#18)

* add app-env.json and update port * Update app-env.json * Update app-env.json * update detect-secrets, update secrets baseline * update secrets baseline * update makefile versioning * Update Makefile Fix typo * print version * upgrade go to v1.20 * fix secrets * initial webauthn implementation (in progress) * refactor webauthn to handle credentials, update docs * avoid creating inaccessible accounts * fix webauthn registration issues, add webauthn test page * fix webauthn login flow * update changelog * [rokwire#659] WebAuthn authentication (#7) * initial webauthn implementation (in progress) * refactor webauthn to handle credentials, update docs * avoid creating inaccessible accounts * fix webauthn registration issues, add webauthn test page * fix webauthn login flow * update changelog * fix error handling * fix login issues for mobile * upgrade dependencies * [rokwire#659] webauthn authentication (#8) * initial webauthn implementation (in progress) * refactor webauthn to handle credentials, update docs * avoid creating inaccessible accounts * fix webauthn registration issues, add webauthn test page * fix webauthn login flow * update changelog * fix error handling * fix login issues for mobile * upgrade dependencies * add webauthn to account check types * add configs for authenticator selection to supported auth type params * add configs for authenticator selection to supported auth type params (#10) * start adding verification types (contains errors) [rokwire#665] * continue splitting auth and verification types [rokwire#665] * finish implementing password auth type, start code verification type, add phone verifier interface [rokwire#665] * finish refactoring identifier, auth types, start updating apis [rokwire#665] * upgrade dependencies * finish fixing errors [rokwire#665] * fix passkey errors [rokwire#665] * bug fixes, email with passkey not working because no params in email auth type * update identifier impl and auth impl getters to better handle backwards compatibility (has errors) * bug fixes, email and passkey not completing registration * add json omitempty tags to credential structs * better identifier type parsing * passkeys using email and username identifiers working * start fixing phone, passkey auth * bug fixes for phone and passkey, better error messages * simplify phone verifier interface * phone auth type link working, add authCommunicationChannel interface to handle verification functions * add ability to link webauthn credentials to accounts * only set username if empty * Change messages handling for verification * remove commented blocks * cleanup * return verified auth types when cannot find account with username but not identifier * bug fixes * fix phone auth type docs * make sure usernames are lowercase, do not fail if phone verifier fails to init * start refactoring account auth types into account auth types and account identifiers, do not store identifiers in credentials (contains errors) * more progress, identifier type and auth type simplifications * read email verification settings from config, refactor verify credential APIs to verify identifier * build error fixes, add account identifier storage operations * start preparing for multiple credentials of same type (e.g., passkeys) * some progress implementing passkey with identifier flow * rewrite passkey flows * build error cleanup, start moving account external IDs into identifiers, refactor shared profile stuff * start fixing shared profiles * comment shared profile functionality * update API docs for linking auth types and identifiers, more error fixes * more API doc tweaks, more error fixes, remove all uses of claims.UID * more link and unlink request body tweaks * do not store account auth type ID in login session, instead use identifier to get account * start working on link account auth type implementation updates * more link auth type updates * finish implementing link identifier, some code auth type bug fixes * match LinkAccountIdentifier interface definition * fix remaining build errors, begin implementing DB migration * add support for login using external identifiers, update more request body definitions * identifiers bug fixes, fix build errors * update db indexes * start implementing db migration * do not allow generic oidc auth type code - no specified identity provider * implement app org and auth type migrations * credentials migration working, use json convert utils func * login session migration done * accounts migration done, a few bug fixes related to external IDs * move migration functions into separate file * more bug fixes, accountAuthTypesToDef not working * email and phone login fixes, finish implementing identifier-less login * bug fixes * linking, unlinking bug fixes * more linking, unlinking bug fixes and identifier verification email bug fixes * username login, webauthn backwards compatible login bug fixes * fix identifier-less webauthn login, update canLink * fix passkey sign up * return account on webauthn signup * make OIDC ID tokens optional * add sign-in-options API, update login API to accept account identifier ID * finish implementing sign in options and login with identifier ID * mask email and phone identifiers for sign in options, add regexp to validate emails * clean up linking, unlinking * fix unlink examples, sign in options fix, handle nil identifier when linking * upgrade dependencies, set username in token claims * use error statuses for auth type and identifier linking * allow webauthn credentials to be created after account already exists * update changelog * updates and fixes for conde_oidc, started refactoring email and phone from profile, username from account into identifiers * fix build errors * start handling external email identifiers * implement profile email and phone and account username migrations * set sensitive flags for email and phone migrations * finish implementing identifier sensitive field, return profile email, phone and username for BC * disallow updating account username to empty string * add sensitive field to account identifier api model * bug fixes * mark email as external if it matches external email field * usernames verified by default, identifiers used to sign up with webauthn unverified by default * auth type unlink bug fixes * simplify link auth type transaction, add app type identifier to webauthn aat params * fix link docs example * return identifiers on auth type link and unlink * improve external identifier migration, add IsEmailVerified flag * do not change email sensitivity on update external identifiers * remove API docs comment * fix go mod --------- Co-authored-by: Stephen Hurwit <[email protected]> Co-authored-by: Stephen Hurwit <[email protected]> Co-authored-by: akshadpai <[email protected]>
rokmetro · Oct 6, 2023 · 10b1b4e · 10b1b4e
1 parent 4eb98cc
commit 10b1b4e
Show file tree

Hide file tree

Showing 113 changed files with 7,979 additions and 3,550 deletions.
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -75,6 +75,10 @@
     {
       "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
     },
+    {
+      "path": "detect_secrets.filters.common.is_baseline_file",
+      "filename": ".secrets.baseline"
+    },
     {
       "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
       "min_level": 2
@@ -117,103 +121,68 @@
         "line_number": 37
       }
     ],
+    "core/apis.go": [
+      {
+        "type": "Secret Keyword",
+        "filename": "core/apis.go",
+        "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
+        "is_verified": false,
+        "line_number": 95
+      }
+    ],
     "core/app_shared.go": [
       {
         "type": "Secret Keyword",
         "filename": "core/app_shared.go",
         "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
         "is_verified": false,
-        "line_number": 41
+        "line_number": 42
       }
     ],
     "core/auth/apis.go": [
+      {
+        "type": "Secret Keyword",
+        "filename": "core/auth/apis.go",
+        "hashed_secret": "04e110541a2e8b44bc10939bfaf5d82adfe45158",
+        "is_verified": false,
+        "line_number": 1944
+      },
       {
         "type": "Secret Keyword",
         "filename": "core/auth/apis.go",
         "hashed_secret": "394e3412459f79523e12e1fa95a4cf141ccff122",
         "is_verified": false,
-        "line_number": 2100
+        "line_number": 2277
       }
     ],
     "core/auth/auth.go": [
       {
         "type": "Secret Keyword",
         "filename": "core/auth/auth.go",
-        "hashed_secret": "417355fe2b66baa6826739a6d8006ab2ddcf5186",
+        "hashed_secret": "3fea7ef2cdd6ecf5280c66dbd062272664559d83",
         "is_verified": false,
-        "line_number": 151
+        "line_number": 160
       },
       {
         "type": "Secret Keyword",
         "filename": "core/auth/auth.go",
-        "hashed_secret": "a358987289cd70bbf50fb10acbcb9bff73c66df6",
+        "hashed_secret": "4a0043e461375664a5656fbdda0d3c39a42a1af4",
         "is_verified": false,
-        "line_number": 153
+        "line_number": 162
       },
       {
         "type": "Secret Keyword",
         "filename": "core/auth/auth.go",
         "hashed_secret": "58f3388441fbce0e48aef2bf74413a6f43f6dc70",
         "is_verified": false,
-        "line_number": 937
+        "line_number": 982
       },
       {
         "type": "Secret Keyword",
         "filename": "core/auth/auth.go",
         "hashed_secret": "94a7f0195bbbd2260c4e4d02b6348fbcd90b2b30",
         "is_verified": false,
-        "line_number": 2441
-      }
-    ],
-    "core/auth/auth_type_email.go": [
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "f3f2fb17a3bf9f307cb6e79b61b9d4baf07dd681",
-        "is_verified": false,
-        "line_number": 75
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "fe70d8c51780596c0b3399573122bba943a461da",
-        "is_verified": false,
-        "line_number": 76
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "06354d205ab5a3b6c7ad2333c58f1ddc810c97ba",
-        "is_verified": false,
-        "line_number": 87
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "7cbe6dcf7274355d223e3174e4d8a7ffb55a9227",
-        "is_verified": false,
-        "line_number": 156
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "69411040443be576ce64fc793269d7c26dd0866a",
-        "is_verified": false,
-        "line_number": 253
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "cba104f0870345d3ec99d55c06441bdce9fcf584",
-        "is_verified": false,
-        "line_number": 390
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_email.go",
-        "hashed_secret": "c74f3640d83fd19d941a4f44b28fbd9e57f59eef",
-        "is_verified": false,
-        "line_number": 391
+        "line_number": 2730
       }
     ],
     "core/auth/auth_type_oidc.go": [
@@ -222,51 +191,32 @@
         "filename": "core/auth/auth_type_oidc.go",
         "hashed_secret": "0ade4f3edccc8888bef404fe6b3c92c13cdfad6b",
         "is_verified": false,
-        "line_number": 376
+        "line_number": 400
       }
     ],
-    "core/auth/auth_type_username.go": [
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "86f4f81d8dcd41f5f695464a3bba658467957bb3",
-        "is_verified": false,
-        "line_number": 64
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "d6f3638bf6ffed24773951f1a48460efa6766362",
-        "is_verified": false,
-        "line_number": 65
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "06354d205ab5a3b6c7ad2333c58f1ddc810c97ba",
-        "is_verified": false,
-        "line_number": 77
-      },
+    "core/auth/auth_type_password.go": [
       {
         "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "7cbe6dcf7274355d223e3174e4d8a7ffb55a9227",
+        "filename": "core/auth/auth_type_password.go",
+        "hashed_secret": "ed4434126edb03dc832260a730ccf3bb61af1396",
         "is_verified": false,
-        "line_number": 179
+        "line_number": 91
       },
       {
         "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "cba104f0870345d3ec99d55c06441bdce9fcf584",
+        "filename": "core/auth/auth_type_password.go",
+        "hashed_secret": "8a1618d670f9d2d7d0b26c1d80227ead407f66dd",
         "is_verified": false,
-        "line_number": 215
-      },
+        "line_number": 197
+      }
+    ],
+    "core/auth/identifier_type_email.go": [
       {
         "type": "Secret Keyword",
-        "filename": "core/auth/auth_type_username.go",
-        "hashed_secret": "c74f3640d83fd19d941a4f44b28fbd9e57f59eef",
+        "filename": "core/auth/identifier_type_email.go",
+        "hashed_secret": "69411040443be576ce64fc793269d7c26dd0866a",
         "is_verified": false,
-        "line_number": 216
+        "line_number": 251
       }
     ],
     "core/auth/service_static_token.go": [
@@ -275,7 +225,7 @@
         "filename": "core/auth/service_static_token.go",
         "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
         "is_verified": false,
-        "line_number": 78
+        "line_number": 71
       }
     ],
     "driven/emailer/adapter.go": [
@@ -293,7 +243,7 @@
         "filename": "driven/profilebb/adapter.go",
         "hashed_secret": "36c48d6ac9d10902792fa78b9c2d7d535971c2cc",
         "is_verified": false,
-        "line_number": 224
+        "line_number": 223
       }
     ],
     "driven/storage/database.go": [
@@ -302,7 +252,23 @@
         "filename": "driven/storage/database.go",
         "hashed_secret": "6547f385c6d867e20f8217018a4d468a7d67d638",
         "is_verified": false,
-        "line_number": 216
+        "line_number": 224
+      }
+    ],
+    "driven/storage/migrations.go": [
+      {
+        "type": "Secret Keyword",
+        "filename": "driven/storage/migrations.go",
+        "hashed_secret": "fd9a601da67dbaa273e7fb64877518ee9e408057",
+        "is_verified": false,
+        "line_number": 141
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "driven/storage/migrations.go",
+        "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
+        "is_verified": false,
+        "line_number": 156
       }
     ],
     "driver/web/apis_system.go": [
@@ -329,7 +295,7 @@
         "filename": "driver/web/docs/gen/gen_types.go",
         "hashed_secret": "c9739eab2dfa093cc0e450bf0ea81a43ae67b581",
         "is_verified": false,
-        "line_number": 1797
+        "line_number": 1920
       }
     ],
     "driver/web/docs/resources/admin/auth/login.yaml": [
@@ -347,7 +313,7 @@
         "filename": "driver/web/docs/resources/services/auth/account/auth-type/link.yaml",
         "hashed_secret": "448ed7416fce2cb66c285d182b1ba3df1e90016d",
         "is_verified": false,
-        "line_number": 26
+        "line_number": 23
       }
     ],
     "driver/web/docs/resources/services/auth/login.yaml": [
@@ -360,5 +326,5 @@
       }
     ]
   },
-  "generated_at": "2023-10-06T19:34:36Z"
+  "generated_at": "2023-10-03T21:38:39Z"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,13 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
-
 ### Added
+- WebAuthn authentication [#659](https://github.com/rokwire/core-building-block/issues/659)
 - Searching follows looks for substring matches [#670](https://github.com/rokwire/core-building-block/issues/670)
-
-### Added
 - Support following accounts [#667](https://github.com/rokwire/core-building-block/issues/667)
 - Device ID not nullable [#672](https://github.com/rokwire/core-building-block/issues/672)
+### Changed
+- Decouple authentication and verification mechanisms [#665](https://github.com/rokwire/core-building-block/issues/665)
+- Refactor account auth types [#674](https://github.com/rokwire/core-building-block/issues/674)
 
 ## [1.34.0] - 2023-07-06
 ### Added