Merge 2d37d57e4f into 146561bacb

server/graph/generated/generated.go

@@ -2596,15 +2596,16 @@ input UpdateUserInput {
 }
 
 input ForgotPasswordInput {
-  email: String!
+  email_or_phone: String!
   state: String
   redirect_uri: String
 }
 
 input ResetPasswordInput {
-  token: String!
+  token_or_code: String!
   password: String!
   confirm_password: String!
+  phone_number: String
 }
 
 input DeleteUserInput {
@@ -15840,18 +15841,18 @@ func (ec *executionContext) unmarshalInputForgotPasswordInput(ctx context.Contex
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"email", "state", "redirect_uri"}
+	fieldsInOrder := [...]string{"email_or_phone", "state", "redirect_uri"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
-		case "email":
+		case "email_or_phone":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email_or_phone"))
-			it.Email, err = ec.unmarshalNString2string(ctx, v)
+			it.EmailOrPhone, err = ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -16528,18 +16529,18 @@ func (ec *executionContext) unmarshalInputResetPasswordInput(ctx context.Context
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"token", "password", "confirm_password"}
+	fieldsInOrder := [...]string{"token_or_code", "password", "confirm_password", "phone_number"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
-		case "token":
+		case "token_or_code":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("token"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("token_or_code"))
-			it.Token, err = ec.unmarshalNString2string(ctx, v)
+			it.TokenOrCode, err = ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -16559,6 +16560,14 @@ func (ec *executionContext) unmarshalInputResetPasswordInput(ctx context.Context
 			if err != nil {
 				return it, err
 			}
+		case "phone_number":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("phone_number"))
+			it.PhoneNumber, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
 		}
 	}
 

server/graph/model/models_gen.go

@@ -129,7 +129,7 @@ type Error struct {
 }
 
 type ForgotPasswordInput struct {
-	Email       string  `json:"email"`
+	EmailOrPhone string  `json:"email_or_phone"`
 	State        *string `json:"state"`
 	RedirectURI  *string `json:"redirect_uri"`
 }
@@ -258,9 +258,10 @@ type ResendVerifyEmailInput struct {
 }
 
 type ResetPasswordInput struct {
-	Token           string `json:"token"`
+	TokenOrCode     string  `json:"token_or_code"`
 	Password        string  `json:"password"`
 	ConfirmPassword string  `json:"confirm_password"`
+	PhoneNumber     *string `json:"phone_number"`
 }
 
 type Response struct {

server/graph/schema.graphqls

@@ -418,15 +418,16 @@ input UpdateUserInput {
 }
 
 input ForgotPasswordInput {
-  email: String!
+  email_or_phone: String!
   state: String
   redirect_uri: String
 }
 
 input ResetPasswordInput {
-  token: String!
+  token_or_code: String!
   password: String!
   confirm_password: String!
+  phone_number: String
 }
 
 input DeleteUserInput {

server/resolvers/forgot_password.go

@@ -19,6 +19,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
+	"github.com/authorizerdev/authorizer/server/smsproviders"
 )
 
 // ForgotPasswordResolver is a resolver for forgot password mutation
@@ -31,26 +32,34 @@ func ForgotPasswordResolver(ctx context.Context, params model.ForgotPasswordInpu
 		return res, err
 	}
 
+	disablePhoneVerification, _ := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisablePhoneVerification)
 	isBasicAuthDisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableBasicAuthentication)
+
 	if err != nil {
 		log.Debug("Error getting basic auth disabled: ", err)
 		isBasicAuthDisabled = true
 	}
+
 	if isBasicAuthDisabled {
 		log.Debug("Basic authentication is disabled")
 		return res, fmt.Errorf(`basic authentication is disabled for this instance`)
 	}
-	params.Email = strings.ToLower(params.Email)
 
-	if !validators.IsValidEmail(params.Email) {
+	mobile := strings.TrimSpace(params.EmailOrPhone)
-		log.Debug("Invalid email address: ", params.Email)
+
-		return res, fmt.Errorf("invalid email")
+	if !validators.IsValidEmail(params.EmailOrPhone) && len(mobile) < 10 {
+		log.Debug("Invalid email or phone: ", params.EmailOrPhone)
+		return res, fmt.Errorf("invalid email or phone")
 	}
 
+	if validators.IsValidEmail(params.EmailOrPhone) {
+		
+		params.EmailOrPhone = strings.ToLower(params.EmailOrPhone)
+
 		log := log.WithFields(log.Fields{
-		"email": params.Email,
+			"email": params.EmailOrPhone,
 		})
-	user, err := db.Provider.GetUserByEmail(ctx, params.Email)
+		user, err := db.Provider.GetUserByEmail(ctx, params.EmailOrPhone)
 		if err != nil {
 			log.Debug("User not found: ", err)
 			return res, fmt.Errorf(`user with this email not found`)
@@ -76,7 +85,7 @@ func ForgotPasswordResolver(ctx context.Context, params model.ForgotPasswordInpu
 			}
 		}
 
-	verificationToken, err := token.CreateVerificationToken(params.Email, constants.VerificationTypeForgotPassword, hostname, nonceHash, redirectURI)
+		verificationToken, err := token.CreateVerificationToken(params.EmailOrPhone, constants.VerificationTypeForgotPassword, hostname, nonceHash, redirectURI)
 		if err != nil {
 			log.Debug("Failed to create verification token", err)
 			return res, err
@@ -85,7 +94,7 @@ func ForgotPasswordResolver(ctx context.Context, params model.ForgotPasswordInpu
 			Token:       verificationToken,
 			Identifier:  constants.VerificationTypeForgotPassword,
 			ExpiresAt:   time.Now().Add(time.Minute * 30).Unix(),
-		Email:       params.Email,
+			Email:       params.EmailOrPhone,
 			Nonce:       nonceHash,
 			RedirectURI: redirectURI,
 		})
@@ -95,7 +104,7 @@ func ForgotPasswordResolver(ctx context.Context, params model.ForgotPasswordInpu
 		}
 
 		// execute it as go routine so that we can reduce the api latency
-	go email.SendEmail([]string{params.Email}, constants.VerificationTypeForgotPassword, map[string]interface{}{
+		go email.SendEmail([]string{params.EmailOrPhone}, constants.VerificationTypeForgotPassword, map[string]interface{}{
 			"user":             user.ToMap(),
 			"organization":     utils.GetOrganization(),
 			"verification_url": utils.GetForgotPasswordURL(verificationToken, redirectURI),
@@ -106,4 +115,47 @@ func ForgotPasswordResolver(ctx context.Context, params model.ForgotPasswordInpu
 		}
 
     	return res, nil
+	}
+
+    if !disablePhoneVerification && len(mobile) > 9 {
+	
+		if _, err := db.Provider.GetUserByPhoneNumber(ctx, refs.StringValue(&params.EmailOrPhone)); err != nil {
+			return res, fmt.Errorf("user with given phone number does not exist")
+		}
+		
+		duration, _ := time.ParseDuration("10m")
+		smsCode := utils.GenerateOTP()
+	
+		smsBody := strings.Builder{}
+		smsBody.WriteString("Your verification code is: ")
+		smsBody.WriteString(smsCode)
+
+		go func() {
+			_, err = db.Provider.UpsertSMSRequest(ctx, &models.SMSVerificationRequest{
+				PhoneNumber:     params.EmailOrPhone,
+				Code:   	     smsCode,
+				CodeExpiresAt:   time.Now().Add(duration).Unix(),
+			})
+
+			if err != nil {
+				log.Debug("Failed to upsert sms otp: ", err)
+				return
+			}
+			
+			err = smsproviders.SendSMS(params.EmailOrPhone, smsBody.String())
+			if err != nil {
+				log.Debug("Failed to send sms: ", err)
+				return
+			}
+		}()
+
+		res = &model.Response{
+			Message: `verification code has been sent to your phone`,
+		}
+	
+		return res, nil
+	}
+
+	return res, nil
+
 }

server/resolvers/reset_password.go

@@ -40,7 +40,62 @@ func ResetPasswordResolver(ctx context.Context, params model.ResetPasswordInput)
 		return res, fmt.Errorf(`basic authentication is disabled for this instance`)
 	}
 	
-	verificationRequest, err := db.Provider.GetVerificationRequestByToken(ctx, params.Token)
+	if params.PhoneNumber != nil {
+		smsVerificationRequest, err := db.Provider.GetCodeByPhone(ctx, *params.PhoneNumber)
+
+		if err != nil {
+			log.Debug("Failed to get verification request: ", err)
+			return res, err
+		}
+
+		if smsVerificationRequest == nil {
+			return res, fmt.Errorf(`phone number not found`)
+		}
+	
+		if smsVerificationRequest.Code != params.TokenOrCode {
+			log.Debug("Failed to verify request: bad credentials")
+			return res, fmt.Errorf(`bad credentials`)
+		}
+	
+		expiresIn := smsVerificationRequest.CodeExpiresAt - time.Now().Unix()
+		if expiresIn < 0 {
+			log.Debug("Failed to verify sms request: Timeout")
+			return res, fmt.Errorf("time expired")
+		}
+
+		err = db.Provider.DeleteSMSRequest(ctx, smsVerificationRequest)
+		if err != nil {
+			log.Debug("Failed to delete sms request: ", err.Error())
+		}
+
+		user, err := db.Provider.GetUserByPhoneNumber(ctx, *params.PhoneNumber)
+		if err != nil {
+			log.Debug("Failed to get user: ", err)
+			return res, err
+		}
+
+		password, _ := crypto.EncryptPassword(params.Password)
+		user.Password = &password
+
+		if user.PhoneNumberVerifiedAt == nil {
+			now := time.Now().Unix()
+			user.PhoneNumberVerifiedAt = &now
+		}
+
+		_, err = db.Provider.UpdateUser(ctx, *user)
+		if err != nil {
+			log.Debug("Failed to update user: ", err)
+			return res, err
+		}
+
+		res = &model.Response{
+			Message: `Password updated successfully.`,
+		}
+
+		return res, nil
+	}
+
+	verificationRequest, err := db.Provider.GetVerificationRequestByToken(ctx, params.TokenOrCode)
 	if err != nil {
 		log.Debug("Failed to get verification request: ", err)
 		return res, fmt.Errorf(`invalid token`)
@@ -58,7 +113,7 @@ func ResetPasswordResolver(ctx context.Context, params model.ResetPasswordInput)
 
 	// verify if token exists in db
 	hostname := parsers.GetHost(gc)
-	claim, err := token.ParseJWTToken(params.Token)
+	claim, err := token.ParseJWTToken(params.TokenOrCode)
 	if err != nil {
 		log.Debug("Failed to parse token: ", err)
 		return res, fmt.Errorf(`invalid token`)

server/test/forgot_password_test.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/resolvers"
@@ -14,6 +15,7 @@ func forgotPasswordTest(t *testing.T, s TestSetup) {
 	t.Helper()
 	t.Run(`should run forgot password`, func(t *testing.T) {
 		_, ctx := createContext(s)
+		phoneNumber := "2234567890"
 		email := "forgot_password." + s.TestInfo.Email
 		res, err := resolvers.SignupResolver(ctx, model.SignUpInput{
 			Email:           email,
@@ -23,7 +25,7 @@ func forgotPasswordTest(t *testing.T, s TestSetup) {
 		assert.NoError(t, err)
 		assert.NotNil(t, res)
 		forgotPasswordRes, err := resolvers.ForgotPasswordResolver(ctx, model.ForgotPasswordInput{
-			Email: email,
+			EmailOrPhone: email,
 		})
 		assert.Nil(t, err, "no errors for forgot password")
 		assert.NotNil(t, forgotPasswordRes)
@@ -32,6 +34,33 @@ func forgotPasswordTest(t *testing.T, s TestSetup) {
 
 		assert.Equal(t, verificationRequest.Identifier, constants.VerificationTypeForgotPassword)
 
+		// Signup using phone and forget password
+		signUpRes, err := resolvers.MobileSignupResolver(ctx, &model.MobileSignUpInput{
+			Email:           refs.NewStringRef(email),
+			PhoneNumber:     phoneNumber,
+			Password:        s.TestInfo.Password,
+			ConfirmPassword: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, signUpRes)
+
+		smsRequest, err := db.Provider.GetCodeByPhone(ctx, phoneNumber)
+		assert.NoError(t, err)
+		assert.NotEmpty(t, smsRequest.Code)
+
+		verifySMSRequest, err := resolvers.VerifyMobileResolver(ctx, model.VerifyMobileRequest{
+			PhoneNumber: phoneNumber,
+			Code:   smsRequest.Code,
+		})
+		assert.Nil(t, err)
+		assert.NotEqual(t, verifySMSRequest.Message, "", "message should not be empty")
+	
+		forgotPasswordWithPhone, err := resolvers.ForgotPasswordResolver(ctx, model.ForgotPasswordInput{
+			EmailOrPhone: phoneNumber,
+		})
+		assert.Nil(t, err)
+		assert.NotNil(t, forgotPasswordWithPhone, "verification code has been sent to your phone")
+
 		cleanData(email)
 	})
 }

server/test/reset_password_test.go

@@ -3,6 +3,7 @@ package test
 import (
 	"testing"
 
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/graph/model"
@@ -13,6 +14,8 @@ import (
 func resetPasswordTest(t *testing.T, s TestSetup) {
 	t.Helper()
 	t.Run(`should reset password`, func(t *testing.T) {
+		phoneNumber := "2234567890"
+		phonePointer := &phoneNumber
 		email := "reset_password." + s.TestInfo.Email
 		_, ctx := createContext(s)
 		_, err := resolvers.SignupResolver(ctx, model.SignUpInput{
@@ -22,7 +25,7 @@ func resetPasswordTest(t *testing.T, s TestSetup) {
 		})
 		assert.NoError(t, err)
 		_, err = resolvers.ForgotPasswordResolver(ctx, model.ForgotPasswordInput{
-			Email: email,
+			EmailOrPhone: email,
 		})
 		assert.Nil(t, err, "no errors for forgot password")
 
@@ -30,7 +33,7 @@ func resetPasswordTest(t *testing.T, s TestSetup) {
 		assert.Nil(t, err, "should get forgot password request")
 		assert.NotNil(t, verificationRequest)
 		_, err = resolvers.ResetPasswordResolver(ctx, model.ResetPasswordInput{
-			Token:           verificationRequest.Token,
+			TokenOrCode:           verificationRequest.Token,
 			Password:        "test1",
 			ConfirmPassword: "test",
 		})
@@ -38,7 +41,7 @@ func resetPasswordTest(t *testing.T, s TestSetup) {
 		assert.NotNil(t, err, "passowrds don't match")
 
 		_, err = resolvers.ResetPasswordResolver(ctx, model.ResetPasswordInput{
-			Token:           verificationRequest.Token,
+			TokenOrCode:           verificationRequest.Token,
 			Password:        "test1",
 			ConfirmPassword: "test1",
 		})
@@ -46,13 +49,49 @@ func resetPasswordTest(t *testing.T, s TestSetup) {
 		assert.NotNil(t, err, "invalid password")
 
 		_, err = resolvers.ResetPasswordResolver(ctx, model.ResetPasswordInput{
-			Token:           verificationRequest.Token,
+			TokenOrCode:           verificationRequest.Token,
 			Password:              "Test@1234",
 			ConfirmPassword:       "Test@1234",
 		})
 
 		assert.Nil(t, err, "password changed successfully")
 
+		// Signup with phone, forget password and then - reset it.
+		signUpRes, err := resolvers.MobileSignupResolver(ctx, &model.MobileSignUpInput{
+			Email:           refs.NewStringRef(email),
+			PhoneNumber:     phoneNumber,
+			Password:        s.TestInfo.Password,
+			ConfirmPassword: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, signUpRes)
+
+		forgotPasswordWithPhone, err := resolvers.ForgotPasswordResolver(ctx, model.ForgotPasswordInput{
+			EmailOrPhone: phoneNumber,
+		})
+		assert.Nil(t, err)
+		assert.NotNil(t, forgotPasswordWithPhone)
+
+		// get code from db
+		smsRequestForReset, err := db.Provider.GetCodeByPhone(ctx, phoneNumber)
+		assert.Nil(t, err)
+		assert.NotNil(t, smsRequestForReset)
+
+		// throw an error if the code is not correct
+		resetPasswordResponse, err := resolvers.ResetPasswordResolver(ctx, model.ResetPasswordInput{
+			PhoneNumber: phonePointer,
+			TokenOrCode:  "abcd@EFG",
+		})
+		assert.NotNil(t, err, "should fail because of bad credentials")
+		assert.Nil(t, resetPasswordResponse)
+	
+		resetPasswordResponse, err = resolvers.ResetPasswordResolver(ctx, model.ResetPasswordInput{
+			PhoneNumber: phonePointer,
+			TokenOrCode:   smsRequestForReset.Code,
+		})
+		assert.Nil(t, err)
+		assert.NotNil(t, resetPasswordResponse)
+
 		cleanData(email)
 	})
 }