admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

OTP : Improve : tighten the security + cosmetic

Browse source 
set double authentication : create, send link, usable with
FreeOTP (opensource) AEgis (opensource) and Google Authenticator

1. OTP : prevent direct access without going throught the 2FA mechanism
2. Go back to the url where you were disconnected
3. Cosmetic
This commit is contained in:
sparkyx 2025-08-03 20:21:39 +02:00
parent bf503299c3
commit 0aa9c4ed28
32 changed files with 1904 additions and 276 deletions
Download patch file Download diff file Expand all files Collapse all files

38
sql/ac_upgrade.sql
View file

@ -1,12 +1,30 @@
ALTER TABLE public.ac_users ADD use_auth_method int2 DEFAULT 0 NULL;
COMMENT ON COLUMN public.ac_users.use_auth_method IS '0 = plain text, 1 = OTP , digit sent by email, 2=freeOTP';
ALTER TABLE public.ac_users ADD use_otp_secret text NULL;
COMMENT ON COLUMN public.ac_users.use_otp_secret IS 'string base32 generated for OTP';
ALTER TABLE public.ac_users ADD CONSTRAINT ac_users_unique UNIQUE (use_otp_secret);
update public.ac_users set use_auth_method=0;
ALTER TABLE public.ac_users ALTER COLUMN use_auth_method SET NOT NULL;
begin;
ALTER TABLE ac_dossier drop COLUMN dos_jnt_user ;
delete from jnt_use_dos where jnt_id in (select priv_jnt from priv_user where priv_priv='X');
delete from jnt_use_dos where use_id in (select use_id from ac_users where use_admin=1 or use_active=0);
ALTER TABLE ac_users ADD COLUMN use_email text;
COMMENT ON COLUMN ac_users.use_email IS 'Email of the user';
drop table priv_user;
select upgrade_repo(16);
alter table
rollback;
CREATE TABLE public.otp_send_secret (
os_id int8 GENERATED ALWAYS AS IDENTITY( INCREMENT BY 1 MINVALUE 1 MAXVALUE 9223372036854775807 START 1 CACHE 1 NO CYCLE) NOT NULL, -- PK
os_timestamp timestamptz DEFAULT now() NOT NULL, -- Timestamp of the email sent
os_request text NULL, -- Unique identifier when request to scan qrcode
use_id int4 NOT NULL, -- FK to ac_users
os_code varchar(8) NULL,
os_valid_time timestamp NOT NULL,
CONSTRAINT otp_send_secret_pk PRIMARY KEY (os_id),
CONSTRAINT otp_send_secret_unique UNIQUE (use_id)
);
COMMENT ON TABLE public.otp_send_secret IS 'sent to user for scanning a QRCODE for FreeOTP
or digit to connect, depends of ac_users use_auth_method.';
-- Column comments
COMMENT ON COLUMN public.otp_send_secret.os_id IS 'PK';
COMMENT ON COLUMN public.otp_send_secret.os_timestamp IS 'Timestamp of the email sent';
COMMENT ON COLUMN public.otp_send_secret.os_request IS 'Unique identifier when request to scan qrcode';
COMMENT ON COLUMN public.otp_send_secret.os_code IS 'contains code sent by email';
COMMENT ON COLUMN public.otp_send_secret.use_id IS 'FK to ac_users';