snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/platform/shared/mfa/mfa.go

@@ -0,0 +1,166 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package mfa
+
+import (
+	"crypto/rand"
+	"encoding/base32"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/dgryski/dgoogauth"
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/rsc/qr"
+	"github.com/pkg/errors"
+)
+
+// InvalidToken indicates the case where the token validation has failed.
+var InvalidToken = errors.New("invalid mfa token")
+
+const (
+	// This will result in 160 bits of entropy (base32 encoded), as recommended by rfc4226.
+	mfaSecretSize = 20
+)
+
+type Store interface {
+	UpdateMfaActive(userId string, active bool) error
+	UpdateMfaSecret(userId, secret string) error
+	StoreMfaUsedTimestamps(userId string, ts []int) error
+	GetMfaUsedTimestamps(userId string) ([]int, error)
+}
+
+type MFA struct {
+	store Store
+}
+
+func New(store Store) *MFA {
+	return &MFA{store}
+}
+
+// newRandomBase32String returns a base32 encoded string of a random slice
+// of bytes of the given size. The resulting entropy will be (8 * size) bits.
+func newRandomBase32String(size int) string {
+	data := make([]byte, size)
+	rand.Read(data)
+	return base32.StdEncoding.EncodeToString(data)
+}
+
+func getIssuerFromURL(uri string) string {
+	issuer := "Mattermost"
+	siteURL := strings.TrimSpace(uri)
+
+	if siteURL != "" {
+		siteURL = strings.TrimPrefix(siteURL, "https://")
+		siteURL = strings.TrimPrefix(siteURL, "http://")
+		issuer = strings.TrimPrefix(siteURL, "www.")
+	}
+
+	return url.QueryEscape(issuer)
+}
+
+// GenerateSecret generates a new user mfa secret and store it with the StoreSecret function provided
+func (m *MFA) GenerateSecret(siteURL, userEmail, userID string) (string, []byte, error) {
+	issuer := getIssuerFromURL(siteURL)
+
+	secret := newRandomBase32String(mfaSecretSize)
+
+	authLink := fmt.Sprintf("otpauth://totp/%s:%s?secret=%s&issuer=%s", issuer, userEmail, secret, issuer)
+
+	code, err := qr.Encode(authLink, qr.H)
+
+	if err != nil {
+		return "", nil, errors.Wrap(err, "unable to generate qr code")
+	}
+
+	img := code.PNG()
+
+	if err := m.store.UpdateMfaSecret(userID, secret); err != nil {
+		return "", nil, errors.Wrap(err, "unable to store mfa secret")
+	}
+
+	return secret, img, nil
+}
+
+// Activate set the mfa as active and store it with the StoreActive function provided
+func (m *MFA) Activate(userMfaSecret, userID string, token string) error {
+	usedTs, err := m.store.GetMfaUsedTimestamps(userID)
+	if err != nil {
+		return errors.Wrap(err, "unable to retrieve the DisallowReuse slice")
+	}
+
+	otpConfig, err := m.authenticate(userMfaSecret, usedTs, token)
+	if err != nil {
+		return errors.Wrap(err, "unable to authenticate the token")
+	}
+
+	if err = m.store.UpdateMfaActive(userID, true); err != nil {
+		return errors.Wrap(err, "unable to store mfa active")
+	}
+
+	err = m.store.StoreMfaUsedTimestamps(userID, otpConfig.DisallowReuse)
+	if err != nil {
+		return errors.Wrap(err, "unable to store the DisallowReuse slice")
+	}
+
+	return nil
+}
+
+// Deactivate set the mfa as deactivated, remove the mfa secret, store it with the StoreActive and StoreSecret functions provided
+func (m *MFA) Deactivate(userId string) error {
+	if err := m.store.UpdateMfaActive(userId, false); err != nil {
+		return errors.Wrap(err, "unable to store mfa active")
+	}
+
+	if err := m.store.UpdateMfaSecret(userId, ""); err != nil {
+		return errors.Wrap(err, "unable to store mfa secret")
+	}
+
+	return nil
+}
+
+// Validate the provide token using the secret provided
+func (m *MFA) ValidateToken(user *model.User, token string) (bool, error) {
+	usedTs, err := m.store.GetMfaUsedTimestamps(user.Id)
+	if err != nil {
+		return false, errors.Wrap(err, "unable to retrieve the DisallowReuse slice")
+	}
+
+	otpConfig, err := m.authenticate(user.MfaSecret, usedTs, token)
+	if err != nil {
+		if err == InvalidToken {
+			return false, nil
+		}
+
+		return false, errors.Wrap(err, "unable to parse the token")
+	}
+
+	err = m.store.StoreMfaUsedTimestamps(user.Id, otpConfig.DisallowReuse)
+	if err != nil {
+		return true, errors.Wrap(err, "unable to store the DisallowReuse slice")
+	}
+
+	return true, nil
+}
+
+func (*MFA) authenticate(userMfaSecret string, usedTs []int, token string) (*dgoogauth.OTPConfig, error) {
+	trimmedToken := strings.TrimSpace(token)
+
+	otpConfig := &dgoogauth.OTPConfig{
+		Secret:        userMfaSecret,
+		WindowSize:    3,
+		HotpCounter:   0,
+		DisallowReuse: usedTs,
+	}
+
+	ok, err := otpConfig.Authenticate(trimmedToken)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to parse the token")
+	}
+	if !ok {
+		return nil, InvalidToken
+	}
+
+	return otpConfig, nil
+}

server/platform/shared/mfa/mfa_test.go

@@ -0,0 +1,237 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package mfa
+
+import (
+	"encoding/base32"
+	"errors"
+	"fmt"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/dgryski/dgoogauth"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/plugin/plugintest/mock"
+	"github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
+)
+
+func TestGenerateSecret(t *testing.T) {
+	userID := "user-id"
+	userEmail := "sample@sample.com"
+	siteURL := "http://localhost:8065"
+
+	t.Run("fail on store action fail", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("UpdateMfaSecret", userID, mock.AnythingOfType("string")).Return(func(userId string, secret string) error {
+			return errors.New("failed to update mfa secret")
+		})
+
+		_, _, err := New(&storeMock).GenerateSecret(siteURL, userEmail, userID)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unable to store mfa secret")
+	})
+
+	t.Run("Successful generate secret", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("UpdateMfaSecret", userID, mock.AnythingOfType("string")).Return(func(userId string, secret string) error {
+			return nil
+		})
+
+		secret, img, err := New(&storeMock).GenerateSecret(siteURL, userEmail, userID)
+		require.NoError(t, err)
+		assert.Len(t, secret, 32)
+		require.NotEmpty(t, img, "no image set")
+	})
+}
+
+func TestGetIssuerFromURL(t *testing.T) {
+	cases := []struct {
+		Input    string
+		Expected string
+	}{
+		{"http://somewebsite.com", url.QueryEscape("somewebsite.com")},
+		{"https://somewebsite.com", url.QueryEscape("somewebsite.com")},
+		{"https://some.website.com", url.QueryEscape("some.website.com")},
+		{" https://www.somewebsite.com", url.QueryEscape("somewebsite.com")},
+		{"http://somewebsite.com/chat", url.QueryEscape("somewebsite.com/chat")},
+		{"somewebsite.com ", url.QueryEscape("somewebsite.com")},
+		{"http://localhost:8065", url.QueryEscape("localhost:8065")},
+		{"", "Mattermost"},
+		{"  ", "Mattermost"},
+	}
+
+	for _, c := range cases {
+		assert.Equal(t, c.Expected, getIssuerFromURL(c.Input))
+	}
+}
+
+func TestActivate(t *testing.T) {
+	userID := "user-id"
+	userMfaSecret := newRandomBase32String(mfaSecretSize)
+
+	token := dgoogauth.ComputeCode(userMfaSecret, time.Now().UTC().Unix()/30)
+
+	t.Run("fail on wrongly formatted token", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("GetMfaUsedTimestamps", userID).Return([]int{}, nil).Once()
+
+		err := New(&storeMock).Activate(userMfaSecret, userID, "invalid-token")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unable to parse the token")
+	})
+
+	t.Run("fail on invalid token", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("GetMfaUsedTimestamps", userID).Return([]int{}, nil).Once()
+
+		err := New(&storeMock).Activate(userMfaSecret, userID, "000000")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid mfa token")
+	})
+
+	t.Run("fail on store action fail", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("GetMfaUsedTimestamps", userID).Return([]int{}, nil).Once()
+		storeMock.On("UpdateMfaActive", userID, true).Return(func(userId string, active bool) error {
+			return errors.New("failed to update mfa active")
+		})
+
+		err := New(&storeMock).Activate(userMfaSecret, userID, fmt.Sprintf("%06d", token))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unable to store mfa active")
+	})
+
+	t.Run("Successful activate", func(t *testing.T) {
+		userID := model.NewId()
+		secret := newRandomBase32String(mfaSecretSize)
+
+		t0 := time.Now().UTC().Unix() / 30
+		code := fmt.Sprintf("%06d", dgoogauth.ComputeCode(secret, t0))
+
+		usMock := mocks.UserStore{}
+		usMock.On("GetMfaUsedTimestamps", userID).Return([]int{}, nil).Once()
+		usMock.On("UpdateMfaActive", userID, true).Return(nil).Once()
+		usMock.On("StoreMfaUsedTimestamps", userID, mock.AnythingOfType("[]int")).Return(nil).Once()
+
+		err := New(&usMock).Activate(secret, userID, code)
+		require.NoError(t, err)
+	})
+
+	t.Run("disallow reuse of totp", func(t *testing.T) {
+		userID := model.NewId()
+		secret := newRandomBase32String(mfaSecretSize)
+
+		t0 := time.Now().UTC().Unix() / 30
+		code := fmt.Sprintf("%06d", dgoogauth.ComputeCode(secret, t0))
+
+		usMock := mocks.UserStore{}
+		usMock.On("GetMfaUsedTimestamps", userID).Return([]int{int(t0)}, nil).Once()
+
+		err := New(&usMock).Activate(secret, userID, code)
+		require.Error(t, err)
+	})
+}
+
+func TestDeactivate(t *testing.T) {
+	userID := "user-id"
+
+	t.Run("fail on store UpdateMfaActive action fail", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
+			return errors.New("failed to update mfa active")
+		})
+		storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
+			return errors.New("failed to update mfa secret")
+		})
+
+		err := New(&storeMock).Deactivate(userID)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unable to store mfa active")
+	})
+
+	t.Run("fail on store UpdateMfaSecret action fail", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
+			return nil
+		})
+		storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
+			return errors.New("failed to update mfa secret")
+		})
+
+		err := New(&storeMock).Deactivate(userID)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unable to store mfa secret")
+	})
+
+	t.Run("Successful deactivate", func(t *testing.T) {
+		storeMock := mocks.UserStore{}
+		storeMock.On("UpdateMfaActive", userID, false).Return(func(userId string, active bool) error {
+			return nil
+		})
+		storeMock.On("UpdateMfaSecret", userID, "").Return(func(userId string, secret string) error {
+			return nil
+		})
+
+		err := New(&storeMock).Deactivate(userID)
+		require.NoError(t, err)
+	})
+}
+
+func TestValidateToken(t *testing.T) {
+	t.Run("fail on wrongly formatted token", func(t *testing.T) {
+		id := model.NewId()
+		secret := newRandomBase32String(mfaSecretSize)
+		u := &model.User{Id: id, MfaSecret: secret}
+
+		usMock := mocks.UserStore{}
+		usMock.On("GetMfaUsedTimestamps", u.Id).Return([]int{}, nil).Once()
+		ok, err := New(&usMock).ValidateToken(u, "invalid-token")
+		require.Error(t, err)
+		require.False(t, ok)
+		require.Contains(t, err.Error(), "unable to parse the token")
+	})
+
+	t.Run("successful validation", func(t *testing.T) {
+		id := model.NewId()
+		secret := newRandomBase32String(mfaSecretSize)
+		u := &model.User{Id: id, MfaSecret: secret}
+
+		code := fmt.Sprintf("%06d", dgoogauth.ComputeCode(secret, time.Now().UTC().Unix()/30))
+
+		usMock := mocks.UserStore{}
+		usMock.On("GetMfaUsedTimestamps", u.Id).Return([]int{}, nil).Once()
+		usMock.On("StoreMfaUsedTimestamps", u.Id, mock.AnythingOfType("[]int")).Return(nil).Once()
+
+		ok, err := New(&usMock).ValidateToken(u, code)
+		require.NoError(t, err)
+		require.True(t, ok)
+	})
+
+	t.Run("disallow reuse of totp", func(t *testing.T) {
+		id := model.NewId()
+		secret := newRandomBase32String(mfaSecretSize)
+		u := &model.User{Id: id, MfaSecret: secret}
+
+		t0 := time.Now().UTC().Unix() / 30
+		code := fmt.Sprintf("%06d", dgoogauth.ComputeCode(secret, t0))
+
+		usMock := mocks.UserStore{}
+		usMock.On("GetMfaUsedTimestamps", u.Id).Return([]int{int(t0)}, nil).Once()
+
+		ok, err := New(&usMock).ValidateToken(u, code)
+		require.False(t, ok)
+		require.NoError(t, err)
+	})
+}
+
+func TestRandomBase32String(t *testing.T) {
+	for i := range 1000 {
+		str := newRandomBase32String(i)
+		require.Len(t, str, base32.StdEncoding.EncodedLen(i))
+	}
+}