|
{{ $resetPasswordEmailToken->created_at }}
+ offed())class="crossed"@endif>
+ {{ $resetPasswordEmailToken->token }}
+
|
{{ $resetPasswordEmailToken->email }}
-
- {{ $resetPasswordEmailToken->token }}
-
|
{{ $resetPasswordEmailToken->consumed() ? $resetPasswordEmailToken->updated_at : '-' }}
diff --git a/flexiapi/resources/views/api/documentation_markdown.blade.php b/flexiapi/resources/views/api/documentation_markdown.blade.php
index 2189105..1e01cfb 100644
--- a/flexiapi/resources/views/api/documentation_markdown.blade.php
+++ b/flexiapi/resources/views/api/documentation_markdown.blade.php
@@ -121,15 +121,6 @@ You can find more documentation on the related [IETF RFC-7616](https://tools.iet
Returns `pong`
-## Account Creation Request Tokens
-
-An `account_creation_request_token` is a unique token that can be validated and then used to generate a valid `account_creation_token`.
-
-### `POST /account_creation_request_tokens`
-Public
-
-Create and return an `account_creation_request_token` that should then be validated to be used.
-
## Spaces
Manage the list of allowed `spaces`. The admin accounts declared with a `domain` that is a `super` `sip_domain` will become Super Admin.
@@ -249,6 +240,15 @@ JSON parameters:
Delete the a space email server configuration.
+## Account Creation Request Tokens
+
+An `account_creation_request_token` is a unique token that can be validated and then used to generate a valid `account_creation_token`.
+
+### `POST /account_creation_request_tokens`
+Public
+
+Create and return an `account_creation_request_token` that should then be validated to be used.
+
## Account Creation Tokens
An `account_creation_token` is a unique token that allow the creation or the validation of a unique account.
@@ -294,6 +294,28 @@ JSON parameters:
Create and return an `account_creation_token`.
+## Account Recovery Tokens
+
+An `account_recovery_token` is a unique token that allow the recovery of an account.
+
+It can be used on the following page that also accepts a `phone` optional parameter to prefil the recovery form:
+
+ {{ route('account.recovery.show.phone', ['account_recovery_token' => '_the_token_']) }}
+ {{ route('account.recovery.show.phone', ['account_recovery_token' => '_the_token_', 'phone' => '+3312341234']) }}
+
+### `POST /account_recovery_tokens/send-by-push`
+Public
+
+Create and send an `account_recovery_token` using a push notification to the device.
+Return `403` if a token was already sent, or if the tokens limit is reached for this device.
+Return `503` if the token was not successfully sent.
+
+JSON parameters:
+
+* `pn_provider` **required**, the push notification provider, must be in apns.dev, apns or fcm
+* `pn_param` the push notification parameter, can be null or contain only alphanumeric and underscore characters
+* `pn_prid` the push notification unique id, can be null or contain only alphanumeric, dashes and colon characters
+
## Auth Tokens
### `POST /accounts/auth_token`
diff --git a/flexiapi/resources/views/mails/recover_by_code.blade.php b/flexiapi/resources/views/mails/recover_by_code.blade.php
index eedd5f7..0384d49 100644
--- a/flexiapi/resources/views/mails/recover_by_code.blade.php
+++ b/flexiapi/resources/views/mails/recover_by_code.blade.php
@@ -9,7 +9,7 @@ You are trying to authenticate to {{ $account->space->name }} using your email a
Please enter the code bellow to finish the authentication process.
-## {{ $account->recovery_code }
+## {{ $account->recovery_code }}
@if (config('app.recovery_code_expiration_minutes') > 0)
The code is only available {{ config('app.recovery_code_expiration_minutes') }} minutes.
diff --git a/flexiapi/resources/views/mails/recover_by_code_custom.blade.php.example b/flexiapi/resources/views/mails/recover_by_code_custom.blade.php.example
index eedd5f7..0384d49 100644
--- a/flexiapi/resources/views/mails/recover_by_code_custom.blade.php.example
+++ b/flexiapi/resources/views/mails/recover_by_code_custom.blade.php.example
@@ -9,7 +9,7 @@ You are trying to authenticate to {{ $account->space->name }} using your email a
Please enter the code bellow to finish the authentication process.
-## {{ $account->recovery_code }
+## {{ $account->recovery_code }}
@if (config('app.recovery_code_expiration_minutes') > 0)
The code is only available {{ config('app.recovery_code_expiration_minutes') }} minutes.
diff --git a/flexiapi/resources/views/parts/recovery.blade.php b/flexiapi/resources/views/parts/recovery.blade.php
index 5d1c283..311bb87 100644
--- a/flexiapi/resources/views/parts/recovery.blade.php
+++ b/flexiapi/resources/views/parts/recovery.blade.php
@@ -1,7 +1,7 @@
envelope{{ __('Recover your account using your email') }}
@if (space()->phone_registration)
- phone{{ __('Recover your account using your phone number') }}
+ phone{{ __('Use the mobile app to recover your account using your phone number') }}
@endif
qr-code{{ __('Login using a QRCode') }}
\ No newline at end of file
diff --git a/flexiapi/routes/api.php b/flexiapi/routes/api.php
index 3677aba..3981c4f 100644
--- a/flexiapi/routes/api.php
+++ b/flexiapi/routes/api.php
@@ -44,6 +44,7 @@ Route::post('account_creation_request_tokens', 'Api\Account\CreationRequestToken
Route::post('account_creation_tokens/send-by-push', 'Api\Account\CreationTokenController@sendByPush');
Route::post('account_creation_tokens/using-account-creation-request-token', 'Api\Account\CreationTokenController@usingAccountRequestToken');
Route::post('accounts/with-account-creation-token', 'Api\Account\AccountController@store');
+Route::post('account_recovery_tokens/send-by-push', 'Api\Account\RecoveryTokenController@sendByPush');
Route::get('accounts/{sip}/info', 'Api\Account\AccountController@info');
diff --git a/flexiapi/routes/web.php b/flexiapi/routes/web.php
index 2d9c18b..c990d5d 100644
--- a/flexiapi/routes/web.php
+++ b/flexiapi/routes/web.php
@@ -100,7 +100,7 @@ Route::middleware(['web_panel_enabled', 'space.check'])->group(function () {
});
Route::prefix('recovery')->controller(RecoveryController::class)->group(function () {
- Route::get('phone', 'showPhone')->name('account.recovery.show.phone');
+ Route::get('phone/{account_recovery_token}', 'showPhone')->name('account.recovery.show.phone');
Route::get('email', 'showEmail')->name('account.recovery.show.email');
Route::post('/', 'send')->name('account.recovery.send');
Route::post('confirm', 'confirm')->name('account.recovery.confirm');
diff --git a/flexiapi/tests/Feature/ApiAccountRecoveryTokenTest.php b/flexiapi/tests/Feature/ApiAccountRecoveryTokenTest.php
new file mode 100644
index 0000000..48473ca
--- /dev/null
+++ b/flexiapi/tests/Feature/ApiAccountRecoveryTokenTest.php
@@ -0,0 +1,95 @@
+.
+*/
+
+namespace Tests\Feature;
+
+use App\Account;
+use App\Space;
+use App\AccountRecoveryToken;
+use Tests\TestCase;
+use Carbon\Carbon;
+use App\Http\Middleware\IsWebPanelEnabled;
+
+class ApiAccountRecoveryTokenTest extends TestCase
+{
+ protected $tokenRoute = '/api/account_recovery_tokens/send-by-push';
+ protected $tokenRequestRoute = '/api/account_recovery_request_tokens';
+ protected $method = 'POST';
+
+ protected $pnProvider = 'fcm';
+ protected $pnParam = 'param';
+ protected $pnPrid = 'id';
+
+ public function testMandatoryParameters()
+ {
+ $this->json($this->method, $this->tokenRoute)->assertStatus(422);
+ $this->json($this->method, $this->tokenRoute, [
+ 'pn_provider' => null,
+ 'pn_param' => null,
+ 'pn_prid' => null,
+ ])->assertStatus(422);
+ }
+
+ public function testThrottling()
+ {
+ AccountRecoveryToken::factory()->create([
+ 'pn_provider' => $this->pnProvider,
+ 'pn_param' => $this->pnParam,
+ 'pn_prid' => $this->pnPrid,
+ ]);
+
+ $this->json($this->method, $this->tokenRoute, [
+ 'pn_provider' => $this->pnProvider,
+ 'pn_param' => $this->pnParam,
+ 'pn_prid' => $this->pnPrid,
+ ])->assertStatus(503);
+
+ // Redeem all the tokens
+ AccountRecoveryToken::where('used', false)->update(['used' => true]);
+
+ $this->json($this->method, $this->tokenRoute, [
+ 'pn_provider' => $this->pnProvider,
+ 'pn_param' => $this->pnParam,
+ 'pn_prid' => $this->pnPrid,
+ ])->assertStatus(429);
+ }
+
+ public function testTokenRecoveryPage()
+ {
+ $token = AccountRecoveryToken::factory()->create();
+ $space = Space::factory()->create();
+ $phone = '+3312345';
+
+ $this->get($this->setSpaceOnRoute($space, route('account.recovery.show.phone', ['account_recovery_token' => 'bad_token'])))
+ ->assertStatus(404);
+
+ $this->get($this->setSpaceOnRoute($space, route('account.recovery.show.phone', ['account_recovery_token' => $token->token])))
+ ->assertDontSee($phone)
+ ->assertStatus(200);
+
+ $this->get($this->setSpaceOnRoute($space, route('account.recovery.show.phone', ['account_recovery_token' => $token->token, 'phone' => $phone])))
+ ->assertSee($phone)
+ ->assertStatus(200);
+
+ $token->consume();
+
+ $this->get($this->setSpaceOnRoute($space, route('account.recovery.show.phone', ['account_recovery_token' => $token->token])))
+ ->assertStatus(404);
+ }
+}
diff --git a/flexiapi/tests/TestCase.php b/flexiapi/tests/TestCase.php
index 91223ae..bb1d122 100644
--- a/flexiapi/tests/TestCase.php
+++ b/flexiapi/tests/TestCase.php
@@ -20,6 +20,7 @@
namespace Tests;
use App\PhoneCountry;
+use App\Space;
use App\Http\Middleware\SpaceCheck;
use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -45,4 +46,9 @@ abstract class TestCase extends BaseTestCase
PhoneCountry::factory()->france()->activated()->create();
PhoneCountry::factory()->netherlands()->create();
}
+
+ protected function setSpaceOnRoute(Space $space, string $route)
+ {
+ return str_replace('localhost', $space->domain, $route);
+ }
}
|