Packages
ash_authentication
5.0.0-rc.6
5.0.0-rc.12
5.0.0-rc.11
5.0.0-rc.10
5.0.0-rc.9
5.0.0-rc.8
5.0.0-rc.7
5.0.0-rc.6
5.0.0-rc.5
5.0.0-rc.4
5.0.0-rc.3
5.0.0-rc.2
5.0.0-rc.1
5.0.0-rc.0
4.14.1
4.14.0
4.13.7
4.13.6
4.13.5
4.13.4
4.13.3
4.13.2
retired
4.13.1
retired
4.13.0
4.12.0
4.11.0
4.10.0
4.9.9
4.9.8
4.9.7
4.9.6
4.9.5
4.9.4
4.9.3
4.9.2
4.9.1
4.9.0
4.8.7
4.8.6
4.8.5
4.8.3
4.8.2
4.8.1
4.8.0
4.7.6
4.7.5
4.7.4
4.7.3
4.7.2
4.7.1
4.7.0
4.6.4
4.6.3
4.6.2
4.6.1
4.6.0
4.5.6
4.5.5
4.5.4
4.5.3
4.5.2
4.5.1
4.5.0
4.4.9
4.4.8
4.4.7
4.4.6
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.12
4.3.11
4.3.10
4.3.9
4.3.8
4.3.7
4.3.6
4.3.5
4.3.4
4.3.3
4.3.2
4.3.1
4.3.0
4.2.7
4.2.6
4.2.5
4.2.4
4.2.3
4.2.2
4.2.1
4.2.0
4.1.0
4.0.4
4.0.3
4.0.2
4.0.1
4.0.0
4.0.0-rc.6
4.0.0-rc.5
4.0.0-rc.3
4.0.0-rc.2
4.0.0-rc.1
4.0.0-rc.0
3.12.4
3.12.3
3.12.2
3.12.1
3.12.0
3.11.16
3.11.15
3.11.14
3.11.13
3.11.12
3.11.11
3.11.10
3.11.9
3.11.8
3.11.7
3.11.6
3.11.5
3.11.4
3.11.3
3.11.2
3.11.1
3.11.0
3.10.8
3.10.7
3.10.6
3.10.5
3.10.4
3.10.3
3.10.2
3.10.1
3.10.0
3.9.6
3.9.5
3.9.4
3.9.3
3.9.2
3.9.1
3.9.0
3.8.0
3.7.9
3.7.8
3.7.6
3.7.5
3.7.4
3.7.3
3.7.2
3.7.1
3.7.0
3.6.1
3.6.0
3.5.3
3.5.2
3.5.1
3.5.0
3.3.1
3.3.0
3.2.2
3.2.1
3.2.0
3.1.0
3.0.3
Authentication extension for the Ash Framework.
Security advisory:
This version has known vulnerabilities.
View advisories
Current section
Files
Jump to
Current section
Files
lib/ash_authentication/strategies/otp/sign_in_change.ex
# SPDX-FileCopyrightText: 2022 Alembic Pty Ltd
#
# SPDX-License-Identifier: MIT
defmodule AshAuthentication.Strategy.Otp.SignInChange do
@moduledoc """
Change for OTP sign-in when registration is enabled.
Used on a create action with upsert to allow new users to register
via OTP. Validates the OTP code, sets the identity attribute, and
generates an auth JWT on success.
"""
use Ash.Resource.Change
alias Ash.{Changeset, Resource, Resource.Change}
alias AshAuthentication.{Errors.InvalidToken, Info, Jwt, Strategy.Otp}
alias AshAuthentication.Strategy.Otp.SignInHelpers
@doc false
@impl true
@spec change(Changeset.t(), keyword, Change.Context.t()) :: Changeset.t()
def change(changeset, opts, context) do
case Info.find_strategy(changeset, context, opts) do
{:ok, strategy} ->
apply_otp_change(changeset, strategy, context)
_ ->
Changeset.add_error(
changeset,
"No strategy found for action #{inspect(changeset.resource)}.#{changeset.action.name}"
)
end
end
defp apply_otp_change(changeset, strategy, context) do
identity = Changeset.get_argument(changeset, strategy.identity_field)
otp_code = Changeset.get_argument(changeset, strategy.otp_param_name)
if is_nil(identity) || is_nil(otp_code) do
add_otp_error(changeset, strategy, "Identity and OTP code are required")
else
normalized_otp = Otp.normalize_otp(strategy, otp_code)
jti =
Otp.compute_deterministic_jti_for_identity(strategy, to_string(identity), normalized_otp)
token_resource = Info.authentication_tokens_token_resource!(strategy.resource)
context_opts = Ash.Context.to_opts(context)
changeset
|> Changeset.force_change_attribute(strategy.identity_field, identity)
|> Changeset.after_action(
&verify_token_and_finalize(&1, &2, strategy, token_resource, jti, context_opts)
)
end
end
# Runs inside the create/upsert transaction. `SignInHelpers.get_otp_token_locked/3`
# takes a SELECT FOR UPDATE lock so concurrent sign-in attempts for the same OTP
# code serialize here rather than both succeeding.
defp verify_token_and_finalize(_changeset, record, strategy, token_resource, jti, context_opts) do
subject = AshAuthentication.user_to_subject(record)
with {:ok, [_ | _]} <- SignInHelpers.get_otp_token_locked(token_resource, jti, context_opts),
:ok <- SignInHelpers.consume_token(strategy, token_resource, jti, subject, context_opts) do
{:ok, auth_token, _claims} = Jwt.token_for_user(record, %{}, context_opts)
{:ok, Resource.put_metadata(record, :token, auth_token)}
else
_ -> {:error, otp_error(strategy)}
end
end
defp otp_error(strategy) do
InvalidToken.exception(
field: strategy.otp_param_name,
reason: "Invalid or expired OTP code",
type: :otp
)
end
defp add_otp_error(changeset, strategy, reason) do
Changeset.add_error(
changeset,
InvalidToken.exception(
field: strategy.otp_param_name,
reason: reason,
type: :otp
)
)
end
end