2fa login

composer.json

@@ -67,7 +67,12 @@
         "scienta/doctrine-json-functions": "^5.0",
         "twig/intl-extra": "^3.3",
         "symfony/expression-language": "6.*",
-        "symfony/lock": "6.*"
+        "symfony/lock": "6.*",
+        "scheb/2fa-google-authenticator": "^6.9",
+        "endroid/qr-code": "^4.8",
+        "scheb/2fa-bundle": "^6.9",
+        "scheb/2fa-trusted-device": "^6.9",
+        "scheb/2fa-backup-code": "^6.9"
     },
     "require-dev": {
         "squizlabs/php_codesniffer": "dev-master as 3.6.0",

config/bundles.php

@@ -18,4 +18,5 @@
     Pageon\DoctrineDataGridBundle\PageonDoctrineDataGridBundle::class => ['all' => true],
     Stof\DoctrineExtensionsBundle\StofDoctrineExtensionsBundle::class => ['all' => true],
     DAMA\DoctrineTestBundle\DAMADoctrineTestBundle::class => ['test' => true, 'test_install' => true],
+    Scheb\TwoFactorBundle\SchebTwoFactorBundle::class => ['all' => true],
 ];

config/packages/scheb_2fa.yaml

@@ -0,0 +1,19 @@
+# See the configuration reference at https://symfony.com/bundles/SchebTwoFactorBundle/6.x/configuration.html
+scheb_two_factor:
+    security_tokens:
+        - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
+        - Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken
+    google:
+        enabled: '@=service("ForkCMS\\Modules\\Backend\\Domain\\Authentication\\TwoFactorAuthenticationFactory").enabled()'
+        template: '@Backend\Backend\2fa.html.twig'
+        server_name: '%env(SITE_DOMAIN)%'
+        issuer: '%env(SITE_DEFAULT_TITLE)%'
+
+    trusted_device:
+        enabled: '@=service("ForkCMS\\Modules\\Backend\\Domain\\Authentication\\TwoFactorAuthenticationFactory").trustedDevices()'
+        extend_lifetime: true
+        lifetime: 2592000 # 30 days in seconds
+        key: '@=service("ForkCMS\\Modules\\Backend\\Domain\\Authentication\\TwoFactorAuthenticationFactory").secret()'
+
+    backup_codes:
+        enabled: true

config/packages/security.yaml

@@ -14,6 +14,10 @@ security:
       pattern: ^/private
       lazy: true
       provider: backend_user_provider
+      two_factor:
+        auth_form_path: backend_2fa_login
+        check_path: backend_2fa_login_check
+        multi_factor: true
       remember_me:
         secret: '%kernel.secret%'
         path: /private
@@ -34,6 +38,7 @@ security:
   # Easy way to control access for large sections of your site
   # Note: Only the *first* access control that matches will be used
   access_control:
+    - { path: ^/private/2fa, role: IS_AUTHENTICATED_2FA_IN_PROGRESS }
     - { path: ^/private/\w\w/backend/authentication-login, roles: PUBLIC_ACCESS }
     - { path: ^/private/\w\w/backend/authentication-logout, roles: PUBLIC_ACCESS }
     - { path: ^/private, roles: ROLE_USER }

config/routes/scheb_2fa.yaml

@@ -0,0 +1,8 @@
+backend_2fa_login:
+    path: /private/2fa
+    defaults:
+        _controller: ForkCMS\Modules\Backend\Controller\TwoFactorAuthenticationController::form
+        _method: "form"
+
+backend_2fa_login_check:
+    path: /private/2fa/check

src/Core/assets/js/Components/Ajax.js

@@ -2,49 +2,59 @@ import { Data } from './Data'
 import { Messages } from './Messages'
 
 export class Ajax {
+  _ajaxSpinner
+  _baseUrl
+  _locale
+
   constructor (locale, baseUrl) {
     // variables
-    const $ajaxSpinner = $('[data-role="fork-ajax-spinner"]')
+    this._ajaxSpinner = $('[data-role="fork-ajax-spinner"]')
+    this._baseUrl = baseUrl
+    this._locale = locale
+  }
+
+  makeRequest (data, successCallback, errorCallback) {
+    console.log(data, successCallback, errorCallback)
+
+    this._ajaxSpinner.show()
 
-    // set defaults for AJAX
-    $.ajaxSetup(
+    // eslint-disable-next-line no-undef
+    const formData = new URLSearchParams()
+    for (const key in data) {
+      formData.append(key, data[key])
+    }
+
+    return fetch(
+      this._baseUrl,
       {
-        url: baseUrl,
-        cache: false,
-        type: 'POST',
-        dataType: 'json',
-        timeout: 10000,
-        beforeSend: (jqXHR) => {
-          jqXHR.setRequestHeader('X-CSRF-Token', Data.get('csrf-token'))
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+          'X-CSRF-Token': Data.get('csrf-token'),
+          'X-Requested-With': 'XMLHttpRequest'
         },
-        data: {}
+        body: formData
       }
     )
+      .then(response => {
+        if (!response.ok) {
+          throw new Error(response.statusText)
+        }
 
-    // global error handler
-    $(document).ajaxError((e, XMLHttpRequest, ajaxOptions) => {
-      // 401 means we aren't authenticated anymore, so reload the page
-      if (XMLHttpRequest.status === 401) window.location.reload()
-
-      // check if a custom errorhandler is used
-      if (typeof ajaxOptions.error === 'undefined') {
-        // init var
-        let textStatus = locale.err('SomethingWentWrong')
+        return response.json()
+      })
+      .then(successCallback)
+      .catch(error => {
+        if (errorCallback) {
+          errorCallback(error)
 
-        // get real message
-        if (typeof XMLHttpRequest.responseText !== 'undefined') textStatus = $.parseJSON(XMLHttpRequest.responseText).message
+          return
+        }
 
-        // show message
-        Messages.add('danger', textStatus, '', true)
-      }
-    })
-
-    // spinner stuff
-    $(document).ajaxStart(() => {
-      $ajaxSpinner.show()
-    })
-    $(document).ajaxStop(() => {
-      $ajaxSpinner.hide()
-    })
+        Messages.add('danger', error.message, '', true)
+      })
+      .finally(() => {
+        this._ajaxSpinner.hide()
+      })
   }
 }

src/Core/assets/js/Components/AjaxContentEditable.js

@@ -1,4 +1,5 @@
 import { Messages } from './Messages'
+import { Data } from './Data'
 
 class EditableContend {
   constructor ($editable, locale) {
@@ -21,20 +22,34 @@ class EditableContend {
       this.tooltip.addClass('invisible')
       this.content.attr('contenteditable', false)
       if (originalContent !== this.content.text()) {
-        $.ajax(
+        const formData = new URLSearchParams()
+        formData.append('content', this.content.text())
+
+        fetch(
+          url,
           {
-            url,
-            data: {
-              content: this.content.text()
-            },
-            success: function (XMLHttpRequest) {
-              Messages.add('success', XMLHttpRequest.message || locale.msg('Edited'))
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+              'X-CSRF-Token': Data.get('csrf-token'),
+              'X-Requested-With': 'XMLHttpRequest'
             },
-            error: function (XMLHttpRequest) {
-              Messages.add('danger', $.parseJSON(XMLHttpRequest.responseText).message)
-            }
+            body: formData
           }
         )
+          .then(response => {
+            if (!response.ok) {
+              throw new Error(response.message)
+            }
+
+            return response.json()
+          })
+          .then(json => {
+            Messages.add('success', json.message || locale.msg('Edited'))
+          })
+          .catch(error => {
+            Messages.add('danger', error.message)
+          })
       }
     })
   }

src/Core/assets/js/Components/ClipBoard.js

@@ -0,0 +1,41 @@
+import { Messages } from './Messages'
+
+export class ClipBoard {
+  constructor (element, successMessage = null) {
+    this.element = element
+    this.successMessage = successMessage
+
+    this.element.on('click', this.copy.bind(this))
+  }
+
+  copy (event) {
+    event.preventDefault()
+
+    const target = $(event.currentTarget)
+    let contentToCopy
+
+    if (target.attr('data-clipboard-text')) {
+      contentToCopy = target.attr('data-clipboard-text')
+    }
+
+    if (target.attr('data-clipboard-target')) {
+      contentToCopy = $(target.attr('data-clipboard-target')).text()
+
+      const lines = contentToCopy.split('\n')
+      // Remove leading and trailing spaces on each line
+      contentToCopy = lines.map(line => line.trim()).join('\n')
+    }
+
+    if (contentToCopy === undefined || contentToCopy === '') {
+      return
+    }
+
+    navigator.clipboard.writeText(contentToCopy)
+
+    if (this.successMessage === null) {
+      return
+    }
+
+    Messages.add('success', this.successMessage)
+  }
+}

src/Modules/Backend/Backend/Actions/DisableTwoFactorAuthentication.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace ForkCMS\Modules\Backend\Backend\Actions;
+
+use ForkCMS\Core\Domain\Header\FlashMessage\FlashMessage;
+use ForkCMS\Core\Domain\Header\FlashMessage\FlashMessageType;
+use ForkCMS\Modules\Backend\Domain\Action\AbstractActionController;
+use ForkCMS\Modules\Backend\Domain\Action\ActionServices;
+use ForkCMS\Modules\Backend\Domain\User\User;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use ForkCMS\Modules\Backend\Domain\User\Command\DisableTwoFactorAuthentication as DisableTwoFactorAuthenticationCommand;
+use Symfony\Component\HttpFoundation\Response;
+
+class DisableTwoFactorAuthentication extends AbstractActionController
+{
+    private User $user;
+
+    public function __construct(ActionServices $actionServices)
+    {
+        parent::__construct($actionServices);
+    }
+
+    protected function execute(Request $request): void
+    {
+        $this->user = $this->getEntityFromRequest($request, User::class);
+        $this->commandBus->dispatch(
+            new DisableTwoFactorAuthenticationCommand($this->user)
+        );
+
+        $this->header->addFlashMessage(
+            new FlashMessage(
+                'msg.2FAIsDisabled',
+                FlashMessageType::SUCCESS
+            )
+        );
+    }
+
+    public function getResponse(Request $request): Response
+    {
+        return new RedirectResponse(
+            UserEdit::getActionSlug()->generateRoute($this->router, ['slug' => $this->user->getId()])
+        );
+    }
+}

src/Modules/Backend/Backend/Actions/ModuleSettings.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace ForkCMS\Modules\Backend\Backend\Actions;
+
+use ForkCMS\Core\Domain\Header\FlashMessage\FlashMessage;
+use ForkCMS\Core\Domain\Kernel\Command\ClearContainerCache;
+use ForkCMS\Modules\Backend\Domain\Action\AbstractFormActionController;
+use ForkCMS\Modules\Backend\Domain\ModuleSettings\ModuleSettingsType;
+use ForkCMS\Modules\Backend\Domain\User\User;
+use ForkCMS\Modules\Backend\Domain\User\UserRepository;
+use ForkCMS\Modules\Extensions\Domain\Module\Command\ChangeModuleSettings;
+use ForkCMS\Modules\Extensions\Domain\Module\Module;
+use ForkCMS\Modules\Extensions\Domain\Module\ModuleName;
+use RuntimeException;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+final class ModuleSettings extends AbstractFormActionController
+{
+    protected function getFormResponse(Request $request): ?Response
+    {
+        $moduleRepository = $this->getRepository(Module::class);
+        $moduleName = $this->getModuleName();
+
+        return $this->handleSettingsForm(
+            request: $request,
+            formType: ModuleSettingsType::class,
+            formData: new ChangeModuleSettings(
+                $moduleRepository->find(ModuleName::core()) ?? throw new RuntimeException('Core module not found'),
+                $moduleRepository->find($moduleName) ?? throw new RuntimeException($moduleName . ' module not found'),
+                []
+            ),
+            validCallback: function (FormInterface $form): Response {
+                $this->commandBus->dispatch($form->getData());
+
+                if (!$this->moduleSettings->get(ModuleName::fromString('Backend'), '2fa_enabled', false)) {
+                    /** @var UserRepository $userRepository */
+                    $userRepository = $this->getRepository(User::class);
+                    $users = $userRepository->findAll();
+
+                    foreach ($users as $user) {
+                        $user->disableTwoFactorAuthentication();
+                        $userRepository->save($user);
+                    }
+                }
+
+                return new RedirectResponse(self::getActionSlug()->generateRoute($this->router));
+            }
+        );
+    }
+}

src/Modules/Backend/Backend/Actions/UserAdd.php

@@ -22,10 +22,25 @@ protected function getFormResponse(Request $request): ?Response
             request: $request,
             formType: UserType::class,
             formData: new CreateUser(),
-            redirectResponse: new RedirectResponse(UserIndex::getActionSlug()->generateRoute($this->router)),
             formOptions: [
                 'validation_groups' => ['Default', 'create'],
             ],
+            validCallback: function (FormInterface $form) use ($request): Response {
+                $this->commandBus->dispatch($form->getData());
+
+                if ($form->getData()->enableTwoFactorAuthentication) {
+                    $request->getSession()->set('showBackupCodes', true);
+
+                    return new RedirectResponse(
+                        UserEdit::getActionSlug()->generateRoute(
+                            $this->router,
+                            ['slug' => $form->getData()->getEntity()->getId()]
+                        )
+                    );
+                }
+
+                return new RedirectResponse(UserIndex::getActionSlug()->generateRoute($this->router));
+            },
             flashMessageCallback: static function (FormInterface $form): FlashMessage {
                 return FlashMessage::success('UserAdded', ['%user%' => $form->getData()->displayName]);
             }