Twofactor authentication and strong password

2025-10-17 14:52:45 +02:00
parent 71a688f97f
commit dbd8c8aed2
17 changed files with 3055 additions and 14 deletions
@@ -0,0 +1,195 @@
+<?php
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/**
+ * Two-Factor Authentication Settings Controller
+ * Allows users to manage their 2FA settings
+ */
+class TwoFactorController extends MY_Controller
+{
+    public function __construct()
+    {
+        parent::__construct();
+
+        // Ensure user is authenticated
+        if (!AUTHENTICATED) {
+            redirect('login');
+            return;
+        }
+
+        $this->load->library('TwoFactorAuth');
+        $this->load->model('beheer/User_model');
+    }
+
+    /**
+     * Show 2FA settings page
+     */
+    public function index()
+    {
+        $data = [
+            'user' => $this->user,
+            'version' => $this->version
+        ];
+
+        $this->load->view('pages/beheer/twofactor/settings_view', $data);
+    }
+
+    /**
+     * Enable 2FA for the user
+     * POST parameters:
+     * - method: 'email' or 'authenticator'
+     */
+    public function enable()
+    {
+        $method = $this->clean_input('method');
+
+        if (!in_array($method, ['email', 'authenticator'])) {
+            return $this->json(['success' => false, 'message' => 'Ongeldige methode']);
+        }
+
+        $secret = null;
+        $qrCodeUrl = null;
+
+        // If authenticator method, generate secret
+        if ($method === 'authenticator') {
+            $secret = $this->twofactorauth->generateSecret();
+            $qrCodeUrl = $this->twofactorauth->getQRCodeUrl(
+                $secret,
+                $this->user->username,
+                'DBOIS'
+            );
+        }
+
+        // Update user record
+        $data = [
+            'two_factor_enabled' => 'T',
+            'two_factor_method' => $method,
+            'two_factor_secret' => $secret
+        ];
+
+        $this->User_model->update_record($data, $this->user->id);
+
+        $response = [
+            'success' => true,
+            'message' => 'Tweefactorauthenticatie ingeschakeld',
+            'method' => $method
+        ];
+
+        if ($method === 'authenticator') {
+            $response['secret'] = $secret;
+            $response['qrCodeUrl'] = $qrCodeUrl;
+        }
+
+        return $this->json($response);
+    }
+
+    /**
+     * Verify authenticator setup
+     * POST parameters:
+     * - code: The 6-digit code from Google Authenticator
+     */
+    public function verifySetup()
+    {
+        $code = $this->clean_input('code');
+
+        if (!$this->user->two_factor_secret) {
+            return $this->json(['success' => false, 'message' => 'Geen geheim gevonden']);
+        }
+
+        $isValid = $this->twofactorauth->verifyCode($this->user->two_factor_secret, $code);
+
+        if ($isValid) {
+            return $this->json(['success' => true, 'message' => 'Code geverifieerd']);
+        } else {
+            return $this->json(['success' => false, 'message' => 'Ongeldige code']);
+        }
+    }
+
+    /**
+     * Disable 2FA for the user
+     */
+    public function disable()
+    {
+        $data = [
+            'two_factor_enabled' => 'F',
+            'two_factor_method' => null,
+            'two_factor_secret' => null
+        ];
+
+        $this->User_model->update_record($data, $this->user->id);
+
+        // Clean up any existing OTP codes
+        $this->load->model('beheer/UserOtp_model');
+        $this->UserOtp_model->deleteUserOTPs($this->user->id);
+
+        return $this->json([
+            'success' => true,
+            'message' => 'Tweefactorauthenticatie uitgeschakeld'
+        ]);
+    }
+
+    /**
+     * Change 2FA method
+     * POST parameters:
+     * - method: 'email' or 'authenticator'
+     */
+    public function changeMethod()
+    {
+        $method = $this->clean_input('method');
+
+        if (!in_array($method, ['email', 'authenticator'])) {
+            return $this->json(['success' => false, 'message' => 'Ongeldige methode']);
+        }
+
+        // If user is not enabled for 2FA, they should use enable endpoint
+        if ($this->user->two_factor_enabled !== 'T') {
+            return $this->json(['success' => false, 'message' => '2FA is niet ingeschakeld']);
+        }
+
+        $secret = null;
+        $qrCodeUrl = null;
+
+        // If switching to authenticator, generate new secret
+        if ($method === 'authenticator') {
+            $secret = $this->twofactorauth->generateSecret();
+            $qrCodeUrl = $this->twofactorauth->getQRCodeUrl(
+                $secret,
+                $this->user->username,
+                'DBOIS'
+            );
+        }
+
+        $data = [
+            'two_factor_method' => $method,
+            'two_factor_secret' => $secret
+        ];
+
+        $this->User_model->update_record($data, $this->user->id);
+
+        $response = [
+            'success' => true,
+            'message' => '2FA methode gewijzigd',
+            'method' => $method
+        ];
+
+        if ($method === 'authenticator') {
+            $response['secret'] = $secret;
+            $response['qrCodeUrl'] = $qrCodeUrl;
+        }
+
+        return $this->json($response);
+    }
+
+    /**
+     * Get current 2FA status
+     */
+    public function status()
+    {
+        $response = [
+            'enabled' => $this->user->two_factor_enabled === 'T',
+            'method' => $this->user->two_factor_method
+        ];
+
+        return $this->json($response);
+    }
+}