Merge feature/ENG-1111/mfa-lambda

src/main/api/checkChangePasswordUsingIdAndIPAddress.json

@@ -0,0 +1,34 @@
+{
+  "uri": "/api/user/change-password",
+  "comments": [
+    "Check to see if the user must obtain a Trust Token Id in order to complete a change password request.",
+    "When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change",
+    "your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.",
+    "",
+    "An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API."
+  ],
+  "method": "get",
+  "methodName": "checkChangePasswordUsingIdAndIPAddress",
+  "successResponse": "Void",
+  "errorResponse": "Errors",
+  "anonymous": true,
+  "params": [
+    {
+      "name": "changePasswordId",
+      "comments": [
+        "The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated."
+      ],
+      "type": "urlSegment",
+      "javaType": "String"
+    },
+    {
+      "name": "ipAddress",
+      "comments": [
+        "(Optional) IP address of the user changing their password. This is used for MFA risk assessment."
+      ],
+      "type": "urlParameter",
+      "parameterName": "ipAddress",
+      "javaType": "String"
+    }
+  ]
+}

src/main/api/checkChangePasswordUsingJWTAndIPAddress.json

@@ -0,0 +1,35 @@
+{
+  "uri": "/api/user/change-password",
+  "comments": [
+    "Check to see if the user must obtain a Trust Token Id in order to complete a change password request.",
+    "When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change",
+    "your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.",
+    "",
+    "An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API."
+  ],
+  "method": "get",
+  "methodName": "checkChangePasswordUsingJWTAndIPAddress",
+  "successResponse": "Void",
+  "errorResponse": "Errors",
+  "anonymous": true,
+  "authorization": "\"Bearer \" + encodedJWT",
+  "params": [
+    {
+      "name": "encodedJWT",
+      "comments": [
+        "The encoded JWT (access token)."
+      ],
+      "type": "notUsed",
+      "javaType": "String"
+    },
+    {
+      "name": "ipAddress",
+      "comments": [
+        "(Optional) IP address of the user changing their password. This is used for MFA risk assessment."
+      ],
+      "type": "urlParameter",
+      "parameterName": "ipAddress",
+      "javaType": "String"
+    }
+  ]
+}

src/main/api/checkChangePasswordUsingLoginIdAndIPAddress.json

@@ -0,0 +1,34 @@
+{
+  "uri": "/api/user/change-password",
+  "comments": [
+    "Check to see if the user must obtain a Trust Request Id in order to complete a change password request.",
+    "When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change",
+    "your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.",
+    "",
+    "An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API."
+  ],
+  "method": "get",
+  "methodName": "checkChangePasswordUsingLoginIdAndIPAddress",
+  "successResponse": "Void",
+  "errorResponse": "Errors",
+  "params": [
+    {
+      "name": "loginId",
+      "comments": [
+        "The loginId (email or username) of the User that you intend to change the password for."
+      ],
+      "type": "urlParameter",
+      "parameterName": "loginId",
+      "javaType": "String"
+    },
+    {
+      "name": "ipAddress",
+      "comments": [
+        "(Optional) IP address of the user changing their password. This is used for MFA risk assessment."
+      ],
+      "type": "urlParameter",
+      "parameterName": "ipAddress",
+      "javaType": "String"
+    }
+  ]
+}

src/main/api/checkChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddress.json

@@ -0,0 +1,43 @@
+{
+  "uri": "/api/user/change-password",
+  "comments": [
+    "Check to see if the user must obtain a Trust Request Id in order to complete a change password request.",
+    "When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change",
+    "your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.",
+    "",
+    "An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API."
+  ],
+  "method": "get",
+  "methodName": "checkChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddress",
+  "successResponse": "Void",
+  "errorResponse": "Errors",
+  "params": [
+    {
+      "name": "loginId",
+      "comments": [
+        "The loginId of the User that you intend to change the password for."
+      ],
+      "type": "urlParameter",
+      "parameterName": "loginId",
+      "javaType": "String"
+    },
+    {
+      "name": "loginIdTypes",
+      "comments": [
+        "The identity types that FusionAuth will compare the loginId to."
+      ],
+      "type": "urlParameter",
+      "parameterName": "loginIdTypes",
+      "javaType": "List<String>"
+    },
+    {
+      "name": "ipAddress",
+      "comments": [
+        "(Optional) IP address of the user changing their password. This is used for MFA risk assessment."
+      ],
+      "type": "urlParameter",
+      "parameterName": "ipAddress",
+      "javaType": "String"
+    }
+  ]
+}

src/main/api/retrieveTwoFactorStatusWithRequest.json

@@ -0,0 +1,24 @@
+{
+  "uri": "/api/two-factor/status",
+  "comments": [
+    "Retrieve a user's two-factor status.",
+    "",
+    "This can be used to see if a user will need to complete a two-factor challenge to complete a login,",
+    "and optionally identify the state of the two-factor trust across various applications. This operation",
+    "provides more payload options than retrieveTwoFactorStatus."
+  ],
+  "method": "post",
+  "methodName": "retrieveTwoFactorStatusWithRequest",
+  "successResponse": "TwoFactorStatusResponse",
+  "errorResponse": "Errors",
+  "params": [
+    {
+      "name": "request",
+      "comments": [
+        "The request object that contains all the information used to check the status."
+      ],
+      "type": "body",
+      "javaType": "TwoFactorStatusRequest"
+    }
+  ]
+}

src/main/client/java.client.ftl

@@ -219,6 +219,7 @@ import io.fusionauth.domain.api.twoFactor.TwoFactorSendRequest;
 import io.fusionauth.domain.api.twoFactor.TwoFactorStartRequest;
 import io.fusionauth.domain.api.twoFactor.TwoFactorStartResponse;
 import io.fusionauth.domain.api.twoFactor.TwoFactorStatusResponse;
+import io.fusionauth.domain.api.twoFactor.TwoFactorStatusRequest;
 import io.fusionauth.domain.api.user.ActionRequest;
 import io.fusionauth.domain.api.user.ActionResponse;
 import io.fusionauth.domain.api.user.ChangePasswordRequest;

src/main/domain/io.fusionauth.domain.Application$LambdaConfiguration.json

@@ -8,6 +8,9 @@
     "idTokenPopulateId" : {
       "type" : "UUID"
     },
+    "multiFactorRequirementId" : {
+      "type" : "UUID"
+    },
     "samlv2PopulateId" : {
       "type" : "UUID"
     },

src/main/domain/io.fusionauth.domain.LambdaType.json

@@ -80,5 +80,8 @@
   }, {
     "name" : "LoginValidation",
     "args" : [ "validate" ]
+  }, {
+    "name" : "MFARequirement",
+    "args" : [ "checkRequired" ]
   } ]
 }

src/main/domain/io.fusionauth.domain.MultiFactorAction.json

@@ -0,0 +1,6 @@
+{
+  "packageName" : "io.fusionauth.domain",
+  "type" : "MultiFactorAction",
+  "description" : "/**\n * Communicate various actions/contexts in which multi-factor authentication can be used.\n */\n",
+  "enum" : [ "changePassword", "login", "stepUp" ]
+}

src/main/domain/io.fusionauth.domain.TenantLambdaConfiguration.json

@@ -12,6 +12,9 @@
     "loginValidationId" : {
       "type" : "UUID"
     },
+    "multiFactorRequirementId" : {
+      "type" : "UUID"
+    },
     "scimEnterpriseUserRequestConverterId" : {
       "type" : "UUID"
     },

src/main/domain/io.fusionauth.domain.api.twoFactor.TwoFactorStatusRequest.json

@@ -0,0 +1,25 @@
+{
+  "packageName" : "io.fusionauth.domain.api.twoFactor",
+  "type" : "TwoFactorStatusRequest",
+  "description" : "/**\n * Check the status of two-factor authentication for a user, with more options than on a GET request.\n */\n",
+  "extends" : [ {
+    "type" : "BaseEventRequest"
+  } ],
+  "fields" : {
+    "userId" : {
+      "type" : "UUID"
+    },
+    "accessToken" : {
+      "type" : "String"
+    },
+    "action" : {
+      "type" : "MultiFactorAction"
+    },
+    "applicationId" : {
+      "type" : "UUID"
+    },
+    "twoFactorTrustId" : {
+      "type" : "String"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.lambda.parameters.mfa.Context.json

@@ -0,0 +1,31 @@
+{
+  "packageName" : "io.fusionauth.domain.lambda.parameters.mfa",
+  "type" : "Context",
+  "description" : "/**\n * Represents the inbound lambda parameter 'context' for MFA Required lambdas.\n */\n",
+  "fields" : {
+    "accessToken" : {
+      "type" : "String"
+    },
+    "action" : {
+      "type" : "MultiFactorAction"
+    },
+    "application" : {
+      "type" : "Application"
+    },
+    "authenticationThreats" : {
+      "type" : "Set",
+      "typeArguments" : [ {
+        "type" : "AuthenticationThreats"
+      } ]
+    },
+    "eventInfo" : {
+      "type" : "EventInfo"
+    },
+    "mfaTrust" : {
+      "type" : "Trust"
+    },
+    "policies" : {
+      "type" : "Policies"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.lambda.parameters.mfa.Policies.json

@@ -0,0 +1,16 @@
+{
+  "packageName" : "io.fusionauth.domain.lambda.parameters.mfa",
+  "type" : "Policies",
+  "description" : "/**\n * Represents the inbound lambda parameter 'policies' for MFA Required lambdas.\n */\n",
+  "fields" : {
+    "applicationLoginPolicy" : {
+      "type" : "MultiFactorLoginPolicy"
+    },
+    "applicationMultiFactorTrustPolicy" : {
+      "type" : "ApplicationMultiFactorTrustPolicy"
+    },
+    "tenantLoginPolicy" : {
+      "type" : "MultiFactorLoginPolicy"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.lambda.parameters.mfa.RequiredLambdaResult.json

@@ -0,0 +1,13 @@
+{
+  "packageName" : "io.fusionauth.domain.lambda.parameters.mfa",
+  "type" : "RequiredLambdaResult",
+  "description" : "/**\n * Represents the inbound lambda parameter 'result' for MFA Required lambdas.\n */\n",
+  "fields" : {
+    "required" : {
+      "type" : "boolean"
+    },
+    "sendSuspiciousLoginEvent" : {
+      "type" : "boolean"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.lambda.parameters.mfa.Trust$StartInstant.json

@@ -0,0 +1,17 @@
+{
+  "packageName" : "io.fusionauth.domain.lambda.parameters.mfa",
+  "type" : "StartInstant",
+  "fields" : {
+    "applications" : {
+      "type" : "Map",
+      "typeArguments" : [ {
+        "type" : "UUID"
+      }, {
+        "type" : "ZonedDateTime"
+      } ]
+    },
+    "tenant" : {
+      "type" : "ZonedDateTime"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.lambda.parameters.mfa.Trust.json

@@ -0,0 +1,44 @@
+{
+  "packageName" : "io.fusionauth.domain.lambda.parameters.mfa",
+  "type" : "Trust",
+  "description" : "/**\n * Represents the inbound lambda parameter 'mfaTrust' inside the 'context' parameter for MFA Required lambdas.\n */\n",
+  "fields" : {
+    "applicationId" : {
+      "type" : "UUID"
+    },
+    "attributes" : {
+      "type" : "Map",
+      "typeArguments" : [ {
+        "type" : "String"
+      }, {
+        "type" : "String"
+      } ]
+    },
+    "expirationInstant" : {
+      "type" : "ZonedDateTime"
+    },
+    "id" : {
+      "type" : "String"
+    },
+    "insertInstant" : {
+      "type" : "ZonedDateTime"
+    },
+    "startInstants" : {
+      "type" : "StartInstant"
+    },
+    "state" : {
+      "type" : "Map",
+      "typeArguments" : [ {
+        "type" : "String"
+      }, {
+        "type" : "Object"
+      } ]
+    },
+    "tenantId" : {
+      "type" : "UUID"
+    },
+    "userId" : {
+      "type" : "UUID"
+    }
+  }
+}

src/main/domain/io.fusionauth.domain.reactor.ReactorStatus.json

@@ -53,6 +53,9 @@
     "licensed" : {
       "type" : "boolean"
     },
+    "multiFactorLambdas" : {
+      "type" : "ReactorFeatureStatus"
+    },
     "scimServer" : {
       "type" : "ReactorFeatureStatus"
     },

src/main/domainNG/io.fusionauth.domain.Application$LambdaConfiguration.json

@@ -10,6 +10,10 @@
       "className" : "java.util.UUID",
       "type" : "UUID"
     },
+    "multiFactorRequirementId" : {
+      "className" : "java.util.UUID",
+      "type" : "UUID"
+    },
     "samlv2PopulateId" : {
       "className" : "java.util.UUID",
       "type" : "UUID"