Merge branch 'feat/2fa' of https://github.com/authorizerdev/authorizer into feat/2fa

update: verify otp resolver and test added

.github/CONTRIBUTING.md

@@ -49,7 +49,7 @@ Please ask as many questions as you need, either directly in the issue or on [Di
 6. Build Dashboard `make build-dashboard`
 7. Build App `make build-app`
 8. Build Server `make clean && make`
-   > Note: if you don't have [`make`](https://www.ibm.com/docs/en/aix/7.2?topic=concepts-make-command), you can `cd` into `server` dir and build using the `go build` command
+   > Note: if you don't have [`make`](https://www.ibm.com/docs/en/aix/7.2?topic=concepts-make-command), you can `cd` into `server` dir and build using the `go build` command. In that case you will have to build `dashboard` & `app` manually using `npm run build` on both dirs.
 9. Run binary `./build/server`
 
 ### Testing

Makefile

@@ -10,7 +10,28 @@ build-dashboard:
 clean:
 	rm -rf build
 test:
-	rm -rf server/test/test.db && rm -rf test.db && cd server && go clean --testcache && go test -p 1 -v ./test
+	rm -rf server/test/test.db && rm -rf test.db && cd server && go clean --testcache && TEST_DBS="sqlite" go test -p 1 -v ./test
+test-mongodb:
+	docker run -d --name authorizer_mongodb_db -p 27017:27017 mongo:4.4.15
+	cd server && go clean --testcache && TEST_DBS="mongodb" go test -p 1 -v ./test
+	docker rm -vf authorizer_mongodb_db
+test-scylladb:
+	docker run -d --name authorizer_scylla_db -p 9042:9042 scylladb/scylla
+	cd server && go clean --testcache && TEST_DBS="scylladb" go test -p 1 -v ./test
+	docker rm -vf authorizer_scylla_db
+test-arangodb:
+	docker run -d --name authorizer_arangodb -p 8529:8529 -e ARANGO_NO_AUTH=1 arangodb/arangodb:3.8.4
+	cd server && go clean --testcache && TEST_DBS="arangodb" go test -p 1 -v ./test
+	docker rm -vf authorizer_arangodb
+test-all-db:
+	rm -rf server/test/test.db && rm -rf test.db
+	docker run -d --name authorizer_scylla_db -p 9042:9042 scylladb/scylla
+	docker run -d --name authorizer_mongodb_db -p 27017:27017 mongo:4.4.15
+	docker run -d --name authorizer_arangodb -p 8529:8529 -e ARANGO_NO_AUTH=1 arangodb/arangodb:3.8.4
+	cd server && go clean --testcache && TEST_DBS="sqlite,mongodb,arangodb,scylladb" go test -p 1 -v ./test
+	docker rm -vf authorizer_scylla_db
+	docker rm -vf authorizer_mongodb_db
+	docker rm -vf authorizer_arangodb
 generate:
 	cd server && go get github.com/99designs/gqlgen/cmd@v0.14.0 && go run github.com/99designs/gqlgen generate
 	

README.md

@@ -89,7 +89,7 @@ This guide helps you practice using Authorizer to evaluate it before you use it
 5. Build Dashboard `make build-dashboard`
 6. Build App `make build-app`
 7. Build Server `make clean && make`
-   > Note: if you don't have [`make`](https://www.ibm.com/docs/en/aix/7.2?topic=concepts-make-command), you can `cd` into `server` dir and build using the `go build` command
+   > Note: if you don't have [`make`](https://www.ibm.com/docs/en/aix/7.2?topic=concepts-make-command), you can `cd` into `server` dir and build using the `go build` command. In that case you will have to build `dashboard` & `app` manually using `npm run build` on both dirs.
 8. Run binary `./build/server`
 
 ### Deploy Authorizer using binaries

app/package-lock.json

@@ -9,7 +9,7 @@
 			"version": "1.0.0",
 			"license": "ISC",
 			"dependencies": {
-				"@authorizerdev/authorizer-react": "^0.25.0",
+				"@authorizerdev/authorizer-react": "^0.26.0-beta.0",
 				"@types/react": "^17.0.15",
 				"@types/react-dom": "^17.0.9",
 				"esbuild": "^0.12.17",
@@ -26,9 +26,9 @@
 			}
 		},
 		"node_modules/@authorizerdev/authorizer-js": {
-			"version": "0.14.0",
+			"version": "0.17.0-beta.1",
-			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-js/-/authorizer-js-0.14.0.tgz",
+			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-js/-/authorizer-js-0.17.0-beta.1.tgz",
-			"integrity": "sha512-cpeeFrmG623QPLn+nf+ACHayZYqW8xokIidGikeboBDJtuAAQB50a54/7HwLHriG2FB7WvPuHQ/9LFFX//N1lg==",
+			"integrity": "sha512-jUlFUrs4Ys6LZ5hclPeRt84teygi+bA57d/IpV9GAqOrfifv70jkFeDln4+Bs0mZk74el23Xn+DR9380mqE4Cg==",
 			"dependencies": {
 				"node-fetch": "^2.6.1"
 			},
@@ -37,11 +37,11 @@
 			}
 		},
 		"node_modules/@authorizerdev/authorizer-react": {
-			"version": "0.25.0",
+			"version": "0.26.0-beta.0",
-			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-react/-/authorizer-react-0.25.0.tgz",
+			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-react/-/authorizer-react-0.26.0-beta.0.tgz",
-			"integrity": "sha512-Dt2rZf+cGCVb8dqcJ/9l8Trx+QeXnTdfhER6r/cq0iOnFC9MqWzQPB3RgrlUoMLHtZvKNDXIk1HvfD5hSX9lhw==",
+			"integrity": "sha512-YfyiGYBmbsp3tLWIxOrOZ/hUTCmdMXVE9SLE8m1xsFsxzJJlUhepp0AMahSbH5EyLj5bchOhOw/rzgpnDZDvMw==",
 			"dependencies": {
-				"@authorizerdev/authorizer-js": "^0.14.0",
+				"@authorizerdev/authorizer-js": "^0.17.0-beta.1",
 				"final-form": "^4.20.2",
 				"react-final-form": "^6.5.3",
 				"styled-components": "^5.3.0"
@@ -852,19 +852,19 @@
 	},
 	"dependencies": {
 		"@authorizerdev/authorizer-js": {
-			"version": "0.14.0",
+			"version": "0.17.0-beta.1",
-			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-js/-/authorizer-js-0.14.0.tgz",
+			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-js/-/authorizer-js-0.17.0-beta.1.tgz",
-			"integrity": "sha512-cpeeFrmG623QPLn+nf+ACHayZYqW8xokIidGikeboBDJtuAAQB50a54/7HwLHriG2FB7WvPuHQ/9LFFX//N1lg==",
+			"integrity": "sha512-jUlFUrs4Ys6LZ5hclPeRt84teygi+bA57d/IpV9GAqOrfifv70jkFeDln4+Bs0mZk74el23Xn+DR9380mqE4Cg==",
 			"requires": {
 				"node-fetch": "^2.6.1"
 			}
 		},
 		"@authorizerdev/authorizer-react": {
-			"version": "0.25.0",
+			"version": "0.26.0-beta.0",
-			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-react/-/authorizer-react-0.25.0.tgz",
+			"resolved": "https://registry.npmjs.org/@authorizerdev/authorizer-react/-/authorizer-react-0.26.0-beta.0.tgz",
-			"integrity": "sha512-Dt2rZf+cGCVb8dqcJ/9l8Trx+QeXnTdfhER6r/cq0iOnFC9MqWzQPB3RgrlUoMLHtZvKNDXIk1HvfD5hSX9lhw==",
+			"integrity": "sha512-YfyiGYBmbsp3tLWIxOrOZ/hUTCmdMXVE9SLE8m1xsFsxzJJlUhepp0AMahSbH5EyLj5bchOhOw/rzgpnDZDvMw==",
 			"requires": {
-				"@authorizerdev/authorizer-js": "^0.14.0",
+				"@authorizerdev/authorizer-js": "^0.17.0-beta.1",
 				"final-form": "^4.20.2",
 				"react-final-form": "^6.5.3",
 				"styled-components": "^5.3.0"

app/package.json

@@ -11,7 +11,7 @@
 	"author": "Lakhan Samani",
 	"license": "ISC",
 	"dependencies": {
-		"@authorizerdev/authorizer-react": "^0.25.0",
+		"@authorizerdev/authorizer-react": "^0.26.0-beta.0",
 		"@types/react": "^17.0.15",
 		"@types/react-dom": "^17.0.9",
 		"esbuild": "^0.12.17",

dashboard/src/components/DeleteWebhookModal.tsx

@@ -0,0 +1,106 @@
+import React from 'react';
+import {
+	Button,
+	Center,
+	Flex,
+	MenuItem,
+	Modal,
+	ModalBody,
+	ModalCloseButton,
+	ModalContent,
+	ModalFooter,
+	ModalHeader,
+	ModalOverlay,
+	useDisclosure,
+	Text,
+	useToast,
+} from '@chakra-ui/react';
+import { useClient } from 'urql';
+import { FaRegTrashAlt } from 'react-icons/fa';
+import { DeleteWebhook } from '../graphql/mutation';
+import { capitalizeFirstLetter } from '../utils';
+
+interface deleteWebhookModalInputPropTypes {
+	webhookId: string;
+	eventName: string;
+	fetchWebookData: Function;
+}
+
+const DeleteWebhookModal = ({
+	webhookId,
+	eventName,
+	fetchWebookData,
+}: deleteWebhookModalInputPropTypes) => {
+	const client = useClient();
+	const toast = useToast();
+	const { isOpen, onOpen, onClose } = useDisclosure();
+
+	const deleteHandler = async () => {
+		const res = await client
+			.mutation(DeleteWebhook, { params: { id: webhookId } })
+			.toPromise();
+		if (res.error) {
+			toast({
+				title: capitalizeFirstLetter(res.error.message),
+				isClosable: true,
+				status: 'error',
+				position: 'bottom-right',
+			});
+
+			return;
+		} else if (res.data?._delete_webhook) {
+			toast({
+				title: capitalizeFirstLetter(res.data?._delete_webhook.message),
+				isClosable: true,
+				status: 'success',
+				position: 'bottom-right',
+			});
+		}
+		onClose();
+		fetchWebookData();
+	};
+	return (
+		<>
+			<MenuItem onClick={onOpen}>Delete</MenuItem>
+			<Modal isOpen={isOpen} onClose={onClose}>
+				<ModalOverlay />
+				<ModalContent>
+					<ModalHeader>Delete Webhook</ModalHeader>
+					<ModalCloseButton />
+					<ModalBody>
+						<Text fontSize="md">Are you sure?</Text>
+						<Flex
+							padding="5%"
+							marginTop="5%"
+							marginBottom="2%"
+							border="1px solid #ff7875"
+							borderRadius="5px"
+							flexDirection="column"
+						>
+							<Text fontSize="sm">
+								Webhook for event <b>{eventName}</b> will be deleted
+								permanently!
+							</Text>
+						</Flex>
+					</ModalBody>
+
+					<ModalFooter>
+						<Button
+							leftIcon={<FaRegTrashAlt />}
+							colorScheme="red"
+							variant="solid"
+							onClick={deleteHandler}
+							isDisabled={false}
+						>
+							<Center h="100%" pt="5%">
+								Delete
+							</Center>
+						</Button>
+					</ModalFooter>
+				</ModalContent>
+			</Modal>
+		</>
+	);
+};
+
+export default DeleteWebhookModal;

dashboard/src/components/EnvComponents/OAuthConfig.tsx

@@ -108,7 +108,7 @@ const OAuthConfig = ({
 								fieldVisibility={fieldVisibility}
 								setFieldVisibility={setFieldVisibility}
 								inputType={HiddenInputType.GOOGLE_CLIENT_SECRET}
-								placeholder="Google Secret"
+								placeholder="Google Client Secret"
 							/>
 						</Center>
 					</Flex>
@@ -146,7 +146,7 @@ const OAuthConfig = ({
 								fieldVisibility={fieldVisibility}
 								setFieldVisibility={setFieldVisibility}
 								inputType={HiddenInputType.GITHUB_CLIENT_SECRET}
-								placeholder="Github Secret"
+								placeholder="Github Client Secret"
 							/>
 						</Center>
 					</Flex>
@@ -184,7 +184,7 @@ const OAuthConfig = ({
 								fieldVisibility={fieldVisibility}
 								setFieldVisibility={setFieldVisibility}
 								inputType={HiddenInputType.FACEBOOK_CLIENT_SECRET}
-								placeholder="Facebook Secret"
+								placeholder="Facebook Client Secret"
 							/>
 						</Center>
 					</Flex>
@@ -260,7 +260,7 @@ const OAuthConfig = ({
 								fieldVisibility={fieldVisibility}
 								setFieldVisibility={setFieldVisibility}
 								inputType={HiddenInputType.APPLE_CLIENT_SECRET}
-								placeholder="Apple CLient Secret"
+								placeholder="Apple Client Secret"
 							/>
 						</Center>
 					</Flex>

dashboard/src/components/Menu.tsx

@@ -30,6 +30,7 @@ import {
 	FiMenu,
 	FiUsers,
 	FiChevronDown,
+	FiLink,
 } from 'react-icons/fi';
 import { BiCustomize } from 'react-icons/bi';
 import { AiOutlineKey } from 'react-icons/ai';
@@ -111,6 +112,7 @@ const LinkItems: Array<LinkItemProps> = [
 		],
 	},
 	{ name: 'Users', icon: FiUsers, route: '/users' },
+	{ name: 'Webhooks', icon: FiLink, route: '/webhooks' },
 ];
 
 interface SidebarProps extends BoxProps {

dashboard/src/components/UpdateWebhookModal.tsx

@@ -0,0 +1,599 @@
+import React, { useEffect, useState } from 'react';
+import {
+	Button,
+	Center,
+	Flex,
+	Input,
+	InputGroup,
+	InputRightElement,
+	MenuItem,
+	Modal,
+	ModalBody,
+	ModalCloseButton,
+	ModalContent,
+	ModalFooter,
+	ModalHeader,
+	ModalOverlay,
+	Select,
+	Switch,
+	Text,
+	useDisclosure,
+	useToast,
+} from '@chakra-ui/react';
+import { FaMinusCircle, FaPlus } from 'react-icons/fa';
+import { useClient } from 'urql';
+import {
+	webhookEventNames,
+	ArrayInputOperations,
+	WebhookInputDataFields,
+	WebhookInputHeaderFields,
+	UpdateWebhookModalViews,
+	webhookVerifiedStatus,
+} from '../constants';
+import { capitalizeFirstLetter, validateURI } from '../utils';
+import { AddWebhook, EditWebhook, TestEndpoint } from '../graphql/mutation';
+import { rest } from 'lodash';
+import { BiCheckCircle, BiError, BiErrorCircle } from 'react-icons/bi';
+
+interface headersDataType {
+	[WebhookInputHeaderFields.KEY]: string;
+	[WebhookInputHeaderFields.VALUE]: string;
+}
+
+interface headersValidatorDataType {
+	[WebhookInputHeaderFields.KEY]: boolean;
+	[WebhookInputHeaderFields.VALUE]: boolean;
+}
+
+interface selecetdWebhookDataTypes {
+	[WebhookInputDataFields.ID]: string;
+	[WebhookInputDataFields.EVENT_NAME]: string;
+	[WebhookInputDataFields.ENDPOINT]: string;
+	[WebhookInputDataFields.ENABLED]: boolean;
+	[WebhookInputDataFields.HEADERS]?: Record<string, string>;
+}
+
+interface UpdateWebhookModalInputPropTypes {
+	view: UpdateWebhookModalViews;
+	selectedWebhook?: selecetdWebhookDataTypes;
+	fetchWebookData: Function;
+}
+
+const initHeadersData: headersDataType = {
+	[WebhookInputHeaderFields.KEY]: '',
+	[WebhookInputHeaderFields.VALUE]: '',
+};
+
+const initHeadersValidatorData: headersValidatorDataType = {
+	[WebhookInputHeaderFields.KEY]: true,
+	[WebhookInputHeaderFields.VALUE]: true,
+};
+
+interface webhookDataType {
+	[WebhookInputDataFields.EVENT_NAME]: string;
+	[WebhookInputDataFields.ENDPOINT]: string;
+	[WebhookInputDataFields.ENABLED]: boolean;
+	[WebhookInputDataFields.HEADERS]: headersDataType[];
+}
+
+interface validatorDataType {
+	[WebhookInputDataFields.ENDPOINT]: boolean;
+	[WebhookInputDataFields.HEADERS]: headersValidatorDataType[];
+}
+
+const initWebhookData: webhookDataType = {
+	[WebhookInputDataFields.EVENT_NAME]: webhookEventNames.USER_LOGIN,
+	[WebhookInputDataFields.ENDPOINT]: '',
+	[WebhookInputDataFields.ENABLED]: true,
+	[WebhookInputDataFields.HEADERS]: [{ ...initHeadersData }],
+};
+
+const initWebhookValidatorData: validatorDataType = {
+	[WebhookInputDataFields.ENDPOINT]: true,
+	[WebhookInputDataFields.HEADERS]: [{ ...initHeadersValidatorData }],
+};
+
+const UpdateWebhookModal = ({
+	view,
+	selectedWebhook,
+	fetchWebookData,
+}: UpdateWebhookModalInputPropTypes) => {
+	const client = useClient();
+	const toast = useToast();
+	const { isOpen, onOpen, onClose } = useDisclosure();
+	const [loading, setLoading] = useState<boolean>(false);
+	const [verifyingEndpoint, setVerifyingEndpoint] = useState<boolean>(false);
+	const [webhook, setWebhook] = useState<webhookDataType>({
+		...initWebhookData,
+	});
+	const [validator, setValidator] = useState<validatorDataType>({
+		...initWebhookValidatorData,
+	});
+	const [verifiedStatus, setVerifiedStatus] = useState<webhookVerifiedStatus>(
+		webhookVerifiedStatus.PENDING
+	);
+	const inputChangehandler = (
+		inputType: string,
+		value: any,
+		headerInputType: string = WebhookInputHeaderFields.KEY,
+		headerIndex: number = 0
+	) => {
+		if (
+			verifiedStatus !== webhookVerifiedStatus.PENDING &&
+			inputType !== WebhookInputDataFields.ENABLED
+		) {
+			setVerifiedStatus(webhookVerifiedStatus.PENDING);
+		}
+		switch (inputType) {
+			case WebhookInputDataFields.EVENT_NAME:
+				setWebhook({ ...webhook, [inputType]: value });
+				break;
+			case WebhookInputDataFields.ENDPOINT:
+				setWebhook({ ...webhook, [inputType]: value });
+				setValidator({
+					...validator,
+					[WebhookInputDataFields.ENDPOINT]: validateURI(value),
+				});
+				break;
+			case WebhookInputDataFields.ENABLED:
+				setWebhook({ ...webhook, [inputType]: value });
+				break;
+			case WebhookInputDataFields.HEADERS:
+				const updatedHeaders: any = [
+					...webhook[WebhookInputDataFields.HEADERS],
+				];
+				const updatedHeadersValidatorData: any = [
+					...validator[WebhookInputDataFields.HEADERS],
+				];
+				const otherHeaderInputType =
+					headerInputType === WebhookInputHeaderFields.KEY
+						? WebhookInputHeaderFields.VALUE
+						: WebhookInputHeaderFields.KEY;
+				updatedHeaders[headerIndex][headerInputType] = value;
+				updatedHeadersValidatorData[headerIndex][headerInputType] =
+					value.length > 0
+						? updatedHeaders[headerIndex][otherHeaderInputType].length > 0
+						: updatedHeaders[headerIndex][otherHeaderInputType].length === 0;
+				updatedHeadersValidatorData[headerIndex][otherHeaderInputType] =
+					value.length > 0
+						? updatedHeaders[headerIndex][otherHeaderInputType].length > 0
+						: updatedHeaders[headerIndex][otherHeaderInputType].length === 0;
+				setWebhook({ ...webhook, [inputType]: updatedHeaders });
+				setValidator({
+					...validator,
+					[inputType]: updatedHeadersValidatorData,
+				});
+				break;
+			default:
+				break;
+		}
+	};
+	const updateHeaders = (operation: string, index: number = 0) => {
+		if (verifiedStatus !== webhookVerifiedStatus.PENDING) {
+			setVerifiedStatus(webhookVerifiedStatus.PENDING);
+		}
+		switch (operation) {
+			case ArrayInputOperations.APPEND:
+				setWebhook({
+					...webhook,
+					[WebhookInputDataFields.HEADERS]: [
+						...(webhook?.[WebhookInputDataFields.HEADERS] || []),
+						{ ...initHeadersData },
+					],
+				});
+				setValidator({
+					...validator,
+					[WebhookInputDataFields.HEADERS]: [
+						...(validator?.[WebhookInputDataFields.HEADERS] || []),
+						{ ...initHeadersValidatorData },
+					],
+				});
+				break;
+			case ArrayInputOperations.REMOVE:
+				if (webhook?.[WebhookInputDataFields.HEADERS]?.length) {
+					const updatedHeaders = [...webhook[WebhookInputDataFields.HEADERS]];
+					updatedHeaders.splice(index, 1);
+					setWebhook({
+						...webhook,
+						[WebhookInputDataFields.HEADERS]: updatedHeaders,
+					});
+				}
+				if (validator?.[WebhookInputDataFields.HEADERS]?.length) {
+					const updatedHeadersData = [
+						...validator[WebhookInputDataFields.HEADERS],
+					];
+					updatedHeadersData.splice(index, 1);
+					setValidator({
+						...validator,
+						[WebhookInputDataFields.HEADERS]: updatedHeadersData,
+					});
+				}
+				break;
+			default:
+				break;
+		}
+	};
+	const validateData = () => {
+		return (
+			!loading &&
+			!verifyingEndpoint &&
+			webhook[WebhookInputDataFields.EVENT_NAME].length > 0 &&
+			webhook[WebhookInputDataFields.ENDPOINT].length > 0 &&
+			validator[WebhookInputDataFields.ENDPOINT] &&
+			!validator[WebhookInputDataFields.HEADERS].some(
+				(headerData: headersValidatorDataType) =>
+					!headerData.key || !headerData.value
+			)
+		);
+	};
+	const getParams = () => {
+		let params: any = {
+			[WebhookInputDataFields.EVENT_NAME]:
+				webhook[WebhookInputDataFields.EVENT_NAME],
+			[WebhookInputDataFields.ENDPOINT]:
+				webhook[WebhookInputDataFields.ENDPOINT],
+			[WebhookInputDataFields.ENABLED]: webhook[WebhookInputDataFields.ENABLED],
+			[WebhookInputDataFields.HEADERS]: {},
+		};
+		if (webhook[WebhookInputDataFields.HEADERS].length) {
+			const headers = webhook[WebhookInputDataFields.HEADERS].reduce(
+				(acc, data) => {
+					return data.key ? { ...acc, [data.key]: data.value } : acc;
+				},
+				{}
+			);
+			if (Object.keys(headers).length) {
+				params[WebhookInputDataFields.HEADERS] = headers;
+			}
+		}
+		return params;
+	};
+	const saveData = async () => {
+		if (!validateData()) return;
+		setLoading(true);
+		const params = getParams();
+		let res: any = {};
+		if (
+			view === UpdateWebhookModalViews.Edit &&
+			selectedWebhook?.[WebhookInputDataFields.ID]
+		) {
+			res = await client
+				.mutation(EditWebhook, {
+					params: {
+						...params,
+						id: selectedWebhook[WebhookInputDataFields.ID],
+					},
+				})
+				.toPromise();
+		} else {
+			res = await client.mutation(AddWebhook, { params }).toPromise();
+		}
+		setLoading(false);
+		if (res.error) {
+			toast({
+				title: capitalizeFirstLetter(res.error.message),
+				isClosable: true,
+				status: 'error',
+				position: 'bottom-right',
+			});
+		} else if (res.data?._add_webhook || res.data?._update_webhook) {
+			toast({
+				title: capitalizeFirstLetter(
+					res.data?._add_webhook?.message || res.data?._update_webhook?.message
+				),
+				isClosable: true,
+				status: 'success',
+				position: 'bottom-right',
+			});
+			setWebhook({
+				...initWebhookData,
+				[WebhookInputDataFields.HEADERS]: [{ ...initHeadersData }],
+			});
+			setValidator({ ...initWebhookValidatorData });
+			fetchWebookData();
+		}
+		view === UpdateWebhookModalViews.ADD && onClose();
+	};
+	useEffect(() => {
+		if (
+			isOpen &&
+			view === UpdateWebhookModalViews.Edit &&
+			selectedWebhook &&
+			Object.keys(selectedWebhook || {}).length
+		) {
+			const { headers, ...rest } = selectedWebhook;
+			const headerItems = Object.entries(headers || {});
+			if (headerItems.length) {
+				let formattedHeadersData = headerItems.map((headerData) => {
+					return {
+						[WebhookInputHeaderFields.KEY]: headerData[0],
+						[WebhookInputHeaderFields.VALUE]: headerData[1],
+					};
+				});
+				setWebhook({
+					...rest,
+					[WebhookInputDataFields.HEADERS]: formattedHeadersData,
+				});
+				setValidator({
+					...validator,
+					[WebhookInputDataFields.HEADERS]: new Array(
+						formattedHeadersData.length
+					)
+						.fill({})
+						.map(() => ({ ...initHeadersValidatorData })),
+				});
+			} else {
+				setWebhook({
+					...rest,
+					[WebhookInputDataFields.HEADERS]: [{ ...initHeadersData }],
+				});
+			}
+		}
+	}, [isOpen]);
+	const verifyEndpoint = async () => {
+		if (!validateData()) return;
+		setVerifyingEndpoint(true);
+		const { [WebhookInputDataFields.ENABLED]: _, ...params } = getParams();
+		const res = await client.mutation(TestEndpoint, { params }).toPromise();
+		if (
+			res.data?._test_endpoint?.http_status >= 200 &&
+			res.data?._test_endpoint?.http_status < 400
+		) {
+			setVerifiedStatus(webhookVerifiedStatus.VERIFIED);
+		} else {
+			setVerifiedStatus(webhookVerifiedStatus.NOT_VERIFIED);
+		}
+		setVerifyingEndpoint(false);
+	};
+	return (
+		<>
+			{view === UpdateWebhookModalViews.ADD ? (
+				<Button
+					leftIcon={<FaPlus />}
+					colorScheme="blue"
+					variant="solid"
+					onClick={onOpen}
+					isDisabled={false}
+					size="sm"
+				>
+					<Center h="100%">Add Webhook</Center>{' '}
+				</Button>
+			) : (
+				<MenuItem onClick={onOpen}>Edit</MenuItem>
+			)}
+			<Modal isOpen={isOpen} onClose={onClose} size="3xl">
+				<ModalOverlay />
+				<ModalContent>
+					<ModalHeader>
+						{view === UpdateWebhookModalViews.ADD
+							? 'Add New Webhook'
+							: 'Edit Webhook'}
+					</ModalHeader>
+					<ModalCloseButton />
+					<ModalBody>
+						<Flex
+							flexDirection="column"
+							border="1px"
+							borderRadius="md"
+							borderColor="gray.200"
+							p="5"
+						>
+							<Flex
+								width="100%"
+								justifyContent="space-between"
+								alignItems="center"
+								marginBottom="2%"
+							>
+								<Flex flex="1">Event Name</Flex>
+								<Flex flex="3">
+									<Select
+										size="md"
+										value={webhook[WebhookInputDataFields.EVENT_NAME]}
+										onChange={(e) =>
+											inputChangehandler(
+												WebhookInputDataFields.EVENT_NAME,
+												e.currentTarget.value
+											)
+										}
+									>
+										{Object.entries(webhookEventNames).map(
+											([key, value]: any) => (
+												<option value={value} key={key}>
+													{key}
+												</option>
+											)
+										)}
+									</Select>
+								</Flex>
+							</Flex>
+							<Flex
+								width="100%"
+								justifyContent="start"
+								alignItems="center"
+								marginBottom="5%"
+							>
+								<Flex flex="1">Endpoint</Flex>
+								<Flex flex="3">
+									<InputGroup size="md">
+										<Input
+											pr="4.5rem"
+											type="text"
+											placeholder="https://domain.com/webhook"
+											value={webhook[WebhookInputDataFields.ENDPOINT]}
+											isInvalid={!validator[WebhookInputDataFields.ENDPOINT]}
+											onChange={(e) =>
+												inputChangehandler(
+													WebhookInputDataFields.ENDPOINT,
+													e.currentTarget.value
+												)
+											}
+										/>
+									</InputGroup>
+								</Flex>
+							</Flex>
+							<Flex
+								width="100%"
+								justifyContent="space-between"
+								alignItems="center"
+								marginBottom="5%"
+							>
+								<Flex flex="1">Enabled</Flex>
+								<Flex w="25%" justifyContent="space-between">
+									<Text h="75%" fontWeight="bold" marginRight="2">
+										Off
+									</Text>
+									<Switch
+										size="md"
+										isChecked={webhook[WebhookInputDataFields.ENABLED]}
+										onChange={() =>
+											inputChangehandler(
+												WebhookInputDataFields.ENABLED,
+												!webhook[WebhookInputDataFields.ENABLED]
+											)
+										}
+									/>
+									<Text h="75%" fontWeight="bold" marginLeft="2">
+										On
+									</Text>
+								</Flex>
+							</Flex>
+							<Flex
+								width="100%"
+								justifyContent="space-between"
+								alignItems="center"
+								marginBottom="2%"
+							>
+								<Flex>Headers</Flex>
+								<Flex>
+									<Button
+										leftIcon={<FaPlus />}
+										colorScheme="blue"
+										h="1.75rem"
+										size="sm"
+										variant="ghost"
+										paddingRight="0"
+										onClick={() => updateHeaders(ArrayInputOperations.APPEND)}
+									>
+										Add more Headers
+									</Button>
+								</Flex>
+							</Flex>
+							<Flex flexDirection="column" maxH={220} overflowY="scroll">
+								{webhook[WebhookInputDataFields.HEADERS]?.map(
+									(headerData, index) => (
+										<Flex
+											key={`header-data-${index}`}
+											justifyContent="center"
+											alignItems="center"
+										>
+											<InputGroup size="md" marginBottom="2.5%">
+												<Input
+													type="text"
+													placeholder="key"
+													value={headerData[WebhookInputHeaderFields.KEY]}
+													isInvalid={
+														!validator[WebhookInputDataFields.HEADERS][index]?.[
+															WebhookInputHeaderFields.KEY
+														]
+													}
+													onChange={(e) =>
+														inputChangehandler(
+															WebhookInputDataFields.HEADERS,
+															e.target.value,
+															WebhookInputHeaderFields.KEY,
+															index
+														)
+													}
+													width="30%"
+													marginRight="2%"
+												/>
+												<Center marginRight="2%">
+													<Text fontWeight="bold">:</Text>
+												</Center>
+												<Input
+													type="text"
+													placeholder="value"
+													value={headerData[WebhookInputHeaderFields.VALUE]}
+													isInvalid={
+														!validator[WebhookInputDataFields.HEADERS][index]?.[
+															WebhookInputHeaderFields.VALUE
+														]
+													}
+													onChange={(e) =>
+														inputChangehandler(
+															WebhookInputDataFields.HEADERS,
+															e.target.value,
+															WebhookInputHeaderFields.VALUE,
+															index
+														)
+													}
+													width="65%"
+												/>
+												<InputRightElement width="3rem">
+													<Button
+														width="6rem"
+														colorScheme="blackAlpha"
+														variant="ghost"
+														padding="0"
+														onClick={() =>
+															updateHeaders(ArrayInputOperations.REMOVE, index)
+														}
+													>
+														<FaMinusCircle />
+													</Button>
+												</InputRightElement>
+											</InputGroup>
+										</Flex>
+									)
+								)}
+							</Flex>
+						</Flex>
+					</ModalBody>
+					<ModalFooter>
+						<Button
+							colorScheme={
+								verifiedStatus === webhookVerifiedStatus.VERIFIED
+									? 'green'
+									: verifiedStatus === webhookVerifiedStatus.PENDING
+									? 'yellow'
+									: 'red'
+							}
+							variant="outline"
+							onClick={verifyEndpoint}
+							isLoading={verifyingEndpoint}
+							isDisabled={!validateData()}
+							marginRight="5"
+							leftIcon={
+								verifiedStatus === webhookVerifiedStatus.VERIFIED ? (
+									<BiCheckCircle />
+								) : verifiedStatus === webhookVerifiedStatus.PENDING ? (
+									<BiErrorCircle />
+								) : (
+									<BiError />
+								)
+							}
+						>
+							{verifiedStatus === webhookVerifiedStatus.VERIFIED
+								? 'Endpoint Verified'
+								: verifiedStatus === webhookVerifiedStatus.PENDING
+								? 'Test Endpoint'
+								: 'Endpoint Not Verified'}
+						</Button>
+						<Button
+							colorScheme="blue"
+							variant="solid"
+							onClick={saveData}
+							isDisabled={!validateData()}
+						>
+							<Center h="100%" pt="5%">
+								Save
+							</Center>
+						</Button>
+					</ModalFooter>
+				</ModalContent>
+			</Modal>
+		</>
+	);
+};
+
+export default UpdateWebhookModal;

dashboard/src/components/ViewWebhookLogsModal.tsx

@@ -0,0 +1,426 @@
+import React, { useEffect, useState } from 'react';
+import dayjs from 'dayjs';
+import {
+	Button,
+	Center,
+	Flex,
+	MenuItem,
+	Modal,
+	ModalBody,
+	ModalCloseButton,
+	ModalContent,
+	ModalFooter,
+	ModalHeader,
+	ModalOverlay,
+	useDisclosure,
+	Text,
+	Spinner,
+	Table,
+	Th,
+	Thead,
+	Tr,
+	Tbody,
+	IconButton,
+	NumberDecrementStepper,
+	NumberIncrementStepper,
+	NumberInput,
+	NumberInputField,
+	NumberInputStepper,
+	Select,
+	TableCaption,
+	Tooltip,
+	Td,
+	Tag,
+} from '@chakra-ui/react';
+import { useClient } from 'urql';
+import {
+	FaAngleDoubleLeft,
+	FaAngleDoubleRight,
+	FaAngleLeft,
+	FaAngleRight,
+	FaExclamationCircle,
+	FaRegClone,
+} from 'react-icons/fa';
+import { copyTextToClipboard } from '../utils';
+import { WebhookLogsQuery } from '../graphql/queries';
+import { pageLimits } from '../constants';
+
+interface paginationPropTypes {
+	limit: number;
+	page: number;
+	offset: number;
+	total: number;
+	maxPages: number;
+}
+
+interface deleteWebhookModalInputPropTypes {
+	webhookId: string;
+	eventName: string;
+}
+
+interface webhookLogsDataTypes {
+	id: string;
+	http_status: number;
+	request: string;
+	response: string;
+	created_at: number;
+}
+
+const ViewWebhookLogsModal = ({
+	webhookId,
+	eventName,
+}: deleteWebhookModalInputPropTypes) => {
+	const client = useClient();
+	const { isOpen, onOpen, onClose } = useDisclosure();
+	const [loading, setLoading] = useState<boolean>(false);
+	const [webhookLogs, setWebhookLogs] = useState<webhookLogsDataTypes[]>([]);
+	const [paginationProps, setPaginationProps] = useState<paginationPropTypes>({
+		limit: 5,
+		page: 1,
+		offset: 0,
+		total: 0,
+		maxPages: 1,
+	});
+	const getMaxPages = (pagination: paginationPropTypes) => {
+		const { limit, total } = pagination;
+		if (total > 1) {
+			return total % limit === 0
+				? total / limit
+				: parseInt(`${total / limit}`) + 1;
+		} else return 1;
+	};
+	const fetchWebhookLogsData = async () => {
+		setLoading(true);
+		const res = await client
+			.query(WebhookLogsQuery, {
+				params: {
+					webhook_id: webhookId,
+					pagination: {
+						limit: paginationProps.limit,
+						page: paginationProps.page,
+					},
+				},
+			})
+			.toPromise();
+		if (res.data?._webhook_logs) {
+			const { pagination, webhook_logs } = res.data?._webhook_logs;
+			const maxPages = getMaxPages(pagination);
+			if (webhook_logs?.length) {
+				setWebhookLogs(webhook_logs);
+				setPaginationProps({ ...paginationProps, ...pagination, maxPages });
+			} else {
+				if (paginationProps.page !== 1) {
+					setPaginationProps({
+						...paginationProps,
+						...pagination,
+						maxPages,
+						page: 1,
+					});
+				}
+			}
+		}
+		setLoading(false);
+	};
+	const paginationHandler = (value: Record<string, number>) => {
+		setPaginationProps({ ...paginationProps, ...value });
+	};
+	useEffect(() => {
+		isOpen && fetchWebhookLogsData();
+	}, [isOpen, paginationProps.page, paginationProps.limit]);
+	return (
+		<>
+			<MenuItem onClick={onOpen}>View Logs</MenuItem>
+			<Modal isOpen={isOpen} onClose={onClose} size="4xl">
+				<ModalOverlay />
+				<ModalContent>
+					<ModalHeader>Webhook Logs - {eventName}</ModalHeader>
+					<ModalCloseButton />
+					<ModalBody>
+						<Flex
+							flexDirection="column"
+							border="1px"
+							borderRadius="md"
+							borderColor="gray.200"
+							p="5"
+						>
+							{!loading ? (
+								webhookLogs.length ? (
+									<Table variant="simple">
+										<Thead>
+											<Tr>
+												<Th>ID</Th>
+												<Th>Created At</Th>
+												<Th>Http Status</Th>
+												<Th>Request</Th>
+												<Th>Response</Th>
+											</Tr>
+										</Thead>
+										<Tbody>
+											{webhookLogs.map((logData: webhookLogsDataTypes) => (
+												<Tr key={logData.id} style={{ fontSize: 14 }}>
+													<Td>
+														<Text fontSize="sm">{`${logData.id.substring(
+															0,
+															5
+														)}***${logData.id.substring(
+															logData.id.length - 5,
+															logData.id.length
+														)}`}</Text>
+													</Td>
+													<Td>
+														{dayjs(logData.created_at * 1000).format(
+															'MMM DD, YYYY'
+														)}
+													</Td>
+													<Td>
+														<Tag
+															size="sm"
+															variant="outline"
+															colorScheme={
+																logData.http_status >= 400 ? 'red' : 'green'
+															}
+														>
+															{logData.http_status}
+														</Tag>
+													</Td>
+													<Td>
+														<Flex alignItems="center">
+															<Tooltip
+																bg="gray.300"
+																color="black"
+																label={logData.request || 'null'}
+															>
+																<Tag
+																	size="sm"
+																	variant="outline"
+																	colorScheme={
+																		logData.request ? 'gray' : 'yellow'
+																	}
+																>
+																	{logData.request ? 'Payload' : 'No Data'}
+																</Tag>
+															</Tooltip>
+															{logData.request && (
+																<Button
+																	size="xs"
+																	variant="outline"
+																	marginLeft="5px"
+																	h="21px"
+																	onClick={() =>
+																		copyTextToClipboard(logData.request)
+																	}
+																>
+																	<FaRegClone color="#bfbfbf" />
+																</Button>
+															)}
+														</Flex>
+													</Td>
+													<Td>
+														<Flex alignItems="center">
+															<Tooltip
+																bg="gray.300"
+																color="black"
+																label={logData.response || 'null'}
+															>
+																<Tag
+																	size="sm"
+																	variant="outline"
+																	colorScheme={
+																		logData.response ? 'gray' : 'yellow'
+																	}
+																>
+																	{logData.response ? 'Preview' : 'No Data'}
+																</Tag>
+															</Tooltip>
+															{logData.response && (
+																<Button
+																	size="xs"
+																	variant="outline"
+																	marginLeft="5px"
+																	h="21px"
+																	onClick={() =>
+																		copyTextToClipboard(logData.response)
+																	}
+																>
+																	<FaRegClone color="#bfbfbf" />
+																</Button>
+															)}
+														</Flex>
+													</Td>
+												</Tr>
+											))}
+										</Tbody>
+										{(paginationProps.maxPages > 1 ||
+											paginationProps.total >= 5) && (
+											<TableCaption>
+												<Flex
+													justifyContent="space-between"
+													alignItems="center"
+													m="2% 0"
+												>
+													<Flex flex="1">
+														<Tooltip label="First Page">
+															<IconButton
+																aria-label="icon button"
+																onClick={() =>
+																	paginationHandler({
+																		page: 1,
+																	})
+																}
+																isDisabled={paginationProps.page <= 1}
+																mr={4}
+																icon={<FaAngleDoubleLeft />}
+															/>
+														</Tooltip>
+														<Tooltip label="Previous Page">
+															<IconButton
+																aria-label="icon button"
+																onClick={() =>
+																	paginationHandler({
+																		page: paginationProps.page - 1,
+																	})
+																}
+																isDisabled={paginationProps.page <= 1}
+																icon={<FaAngleLeft />}
+															/>
+														</Tooltip>
+													</Flex>
+													<Flex
+														flex="8"
+														justifyContent="space-evenly"
+														alignItems="center"
+													>
+														<Text mr={8}>
+															Page{' '}
+															<Text fontWeight="bold" as="span">
+																{paginationProps.page}
+															</Text>{' '}
+															of{' '}
+															<Text fontWeight="bold" as="span">
+																{paginationProps.maxPages}
+															</Text>
+														</Text>
+														<Flex alignItems="center">
+															<Text flexShrink="0">Go to page:</Text>{' '}
+															<NumberInput
+																ml={2}
+																mr={8}
+																w={28}
+																min={1}
+																max={paginationProps.maxPages}
+																onChange={(value) =>
+																	paginationHandler({
+																		page: parseInt(value),
+																	})
+																}
+																value={paginationProps.page}
+															>
+																<NumberInputField />
+																<NumberInputStepper>
+																	<NumberIncrementStepper />
+																	<NumberDecrementStepper />
+																</NumberInputStepper>
+															</NumberInput>
+														</Flex>
+														<Select
+															w={32}
+															value={paginationProps.limit}
+															onChange={(e) =>
+																paginationHandler({
+																	page: 1,
+																	limit: parseInt(e.target.value),
+																})
+															}
+														>
+															{pageLimits.map((pageSize) => (
+																<option key={pageSize} value={pageSize}>
+																	Show {pageSize}
+																</option>
+															))}
+														</Select>
+													</Flex>
+													<Flex flex="1">
+														<Tooltip label="Next Page">
+															<IconButton
+																aria-label="icon button"
+																onClick={() =>
+																	paginationHandler({
+																		page: paginationProps.page + 1,
+																	})
+																}
+																isDisabled={
+																	paginationProps.page >=
+																	paginationProps.maxPages
+																}
+																icon={<FaAngleRight />}
+															/>
+														</Tooltip>
+														<Tooltip label="Last Page">
+															<IconButton
+																aria-label="icon button"
+																onClick={() =>
+																	paginationHandler({
+																		page: paginationProps.maxPages,
+																	})
+																}
+																isDisabled={
+																	paginationProps.page >=
+																	paginationProps.maxPages
+																}
+																ml={4}
+																icon={<FaAngleDoubleRight />}
+															/>
+														</Tooltip>
+													</Flex>
+												</Flex>
+											</TableCaption>
+										)}
+									</Table>
+								) : (
+									<Flex
+										flexDirection="column"
+										minH="25vh"
+										justifyContent="center"
+										alignItems="center"
+									>
+										<Center w="50px" marginRight="1.5%">
+											<FaExclamationCircle
+												style={{ color: '#f0f0f0', fontSize: 70 }}
+											/>
+										</Center>
+										<Text
+											fontSize="2xl"
+											paddingRight="1%"
+											fontWeight="bold"
+											color="#d9d9d9"
+										>
+											No Data
+										</Text>
+									</Flex>
+								)
+							) : (
+								<Center minH="25vh">
+									<Spinner />
+								</Center>
+							)}
+						</Flex>
+					</ModalBody>
+					<ModalFooter>
+						<Button
+							colorScheme="blue"
+							variant="solid"
+							onClick={onClose}
+							isDisabled={false}
+						>
+							<Center h="100%" pt="5%">
+								Close
+							</Center>
+						</Button>
+					</ModalFooter>
+				</ModalContent>
+			</Modal>
+		</>
+	);
+};
+
+export default ViewWebhookLogsModal;

dashboard/src/constants.ts

@@ -153,3 +153,38 @@ export const envSubViews = {
 	ADMIN_SECRET: 'admin-secret',
 	DB_CRED: 'db-cred',
 };
+
+export enum WebhookInputDataFields {
+	ID = 'id',
+	EVENT_NAME = 'event_name',
+	ENDPOINT = 'endpoint',
+	ENABLED = 'enabled',
+	HEADERS = 'headers',
+}
+
+export enum WebhookInputHeaderFields {
+	KEY = 'key',
+	VALUE = 'value',
+}
+
+export enum UpdateWebhookModalViews {
+	ADD = 'add',
+	Edit = 'edit',
+}
+
+export const pageLimits: number[] = [5, 10, 15];
+
+export const webhookEventNames = {
+	USER_SIGNUP: 'user.signup',
+	USER_CREATED: 'user.created',
+	USER_LOGIN: 'user.login',
+	USER_DELETED: 'user.deleted',
+	USER_ACCESS_ENABLED: 'user.access_enabled',
+	USER_ACCESS_REVOKED: 'user.access_revoked',
+};
+
+export enum webhookVerifiedStatus {
+	VERIFIED = 'verified',
+	NOT_VERIFIED = 'not_verified',
+	PENDING = 'verification_pending',
+}

dashboard/src/graphql/mutation/index.ts

@@ -79,3 +79,36 @@ export const GenerateKeys = `
     }
   }
 `;
+
+export const AddWebhook = `
+  mutation addWebhook($params: AddWebhookRequest!) {
+    _add_webhook(params: $params) {
+      message
+    }
+  }
+`;
+
+export const EditWebhook = `
+  mutation editWebhook($params: UpdateWebhookRequest!) {
+    _update_webhook(params: $params) {
+      message
+    }
+  }
+`;
+
+export const DeleteWebhook = `
+  mutation deleteWebhook($params: WebhookRequest!) {
+    _delete_webhook(params: $params) {
+      message
+    }
+  }
+`;
+
+export const TestEndpoint = `
+  mutation testEndpoint($params: TestEndpointRequest!) {
+    _test_endpoint(params: $params) {
+      http_status
+      response
+    }
+  }
+`;

dashboard/src/graphql/queries/index.ts

@@ -89,6 +89,7 @@ export const UserDetailsQuery = `
         roles
         created_at
         revoked_timestamp
+        is_multi_factor_auth_enabled
       }
     }
   }
@@ -101,3 +102,43 @@ export const EmailVerificationQuery = `
     }
   }
 `;
+
+export const WebhooksDataQuery = `
+  query getWebhooksData($params: PaginatedInput!) {
+    _webhooks(params: $params){
+      webhooks{
+        id
+        event_name
+        endpoint
+        enabled
+        headers
+      }
+      pagination{
+        limit
+        page
+        offset
+        total
+      }
+    }
+  }
+`;
+
+export const WebhookLogsQuery = `
+  query getWebhookLogs($params: ListWebhookLogRequest!) {
+    _webhook_logs(params: $params) {
+      webhook_logs {
+        id
+        http_status
+        request
+        response
+        created_at
+      }
+      pagination {
+        limit
+        page
+        offset
+        total
+      }
+    }
+  }
+`;

dashboard/src/pages/Users.tsx

@@ -68,6 +68,7 @@ interface userDataTypes {
 	roles: [string];
 	created_at: number;
 	revoked_timestamp: number;
+	is_multi_factor_auth_enabled?: boolean;
 }
 
 const enum updateAccessActions {
@@ -250,6 +251,34 @@ export default function Users() {
 				break;
 		}
 	};
+	const multiFactorAuthUpdateHandler = async (user: userDataTypes) => {
+		const res = await client
+			.mutation(UpdateUser, {
+				params: {
+					id: user.id,
+					is_multi_factor_auth_enabled: !user.is_multi_factor_auth_enabled,
+				},
+			})
+			.toPromise();
+		if (res.data?._update_user?.id) {
+			toast({
+				title: `Multi factor authentication ${
+					user.is_multi_factor_auth_enabled ? 'disabled' : 'enabled'
+				} for user`,
+				isClosable: true,
+				status: 'success',
+				position: 'bottom-right',
+			});
+			updateUserList();
+			return;
+		}
+		toast({
+			title: 'Multi factor authentication update failed for user',
+			isClosable: true,
+			status: 'error',
+			position: 'bottom-right',
+		});
+	};
 
 	return (
 		<Box m="5" py="5" px="10" bg="white" rounded="md">
@@ -273,6 +302,7 @@ export default function Users() {
 								<Th>Roles</Th>
 								<Th>Verified</Th>
 								<Th>Access</Th>
+								<Th>MFA</Th>
 								<Th>Actions</Th>
 							</Tr>
 						</Thead>
@@ -305,6 +335,19 @@ export default function Users() {
 												{user.revoked_timestamp ? 'Revoked' : 'Enabled'}
 											</Tag>
 										</Td>
+										<Td>
+											<Tag
+												size="sm"
+												variant="outline"
+												colorScheme={
+													user.is_multi_factor_auth_enabled ? 'green' : 'red'
+												}
+											>
+												{user.is_multi_factor_auth_enabled
+													? 'Enabled'
+													: 'Disabled'}
+											</Tag>
+										</Td>
 										<Td>
 											<Menu>
 												<MenuButton as={Button} variant="unstyled" size="sm">
@@ -357,6 +400,19 @@ export default function Users() {
 															Revoke Access
 														</MenuItem>
 													)}
+													{user.is_multi_factor_auth_enabled ? (
+														<MenuItem
+															onClick={() => multiFactorAuthUpdateHandler(user)}
+														>
+															Disable MFA
+														</MenuItem>
+													) : (
+														<MenuItem
+															onClick={() => multiFactorAuthUpdateHandler(user)}
+														>
+															Enable MFA
+														</MenuItem>
+													)}
 												</MenuList>
 											</Menu>
 										</Td>

dashboard/src/pages/Webhooks.tsx

@@ -0,0 +1,370 @@
+import React, { useEffect, useState } from 'react';
+import { useClient } from 'urql';
+import {
+	Box,
+	Button,
+	Center,
+	Flex,
+	IconButton,
+	Menu,
+	MenuButton,
+	MenuItem,
+	MenuList,
+	NumberDecrementStepper,
+	NumberIncrementStepper,
+	NumberInput,
+	NumberInputField,
+	NumberInputStepper,
+	Select,
+	Spinner,
+	Table,
+	TableCaption,
+	Tag,
+	Tbody,
+	Td,
+	Text,
+	Th,
+	Thead,
+	Tooltip,
+	Tr,
+} from '@chakra-ui/react';
+import {
+	FaAngleDoubleLeft,
+	FaAngleDoubleRight,
+	FaAngleDown,
+	FaAngleLeft,
+	FaAngleRight,
+	FaExclamationCircle,
+} from 'react-icons/fa';
+import UpdateWebhookModal from '../components/UpdateWebhookModal';
+import {
+	pageLimits,
+	WebhookInputDataFields,
+	UpdateWebhookModalViews,
+} from '../constants';
+import { WebhooksDataQuery } from '../graphql/queries';
+import DeleteWebhookModal from '../components/DeleteWebhookModal';
+import ViewWebhookLogsModal from '../components/ViewWebhookLogsModal';
+
+interface paginationPropTypes {
+	limit: number;
+	page: number;
+	offset: number;
+	total: number;
+	maxPages: number;
+}
+
+interface webhookDataTypes {
+	[WebhookInputDataFields.ID]: string;
+	[WebhookInputDataFields.EVENT_NAME]: string;
+	[WebhookInputDataFields.ENDPOINT]: string;
+	[WebhookInputDataFields.ENABLED]: boolean;
+	[WebhookInputDataFields.HEADERS]?: Record<string, string>;
+}
+
+const Webhooks = () => {
+	const client = useClient();
+	const [loading, setLoading] = useState<boolean>(false);
+	const [webhookData, setWebhookData] = useState<webhookDataTypes[]>([]);
+	const [paginationProps, setPaginationProps] = useState<paginationPropTypes>({
+		limit: 5,
+		page: 1,
+		offset: 0,
+		total: 0,
+		maxPages: 1,
+	});
+	const getMaxPages = (pagination: paginationPropTypes) => {
+		const { limit, total } = pagination;
+		if (total > 1) {
+			return total % limit === 0
+				? total / limit
+				: parseInt(`${total / limit}`) + 1;
+		} else return 1;
+	};
+	const fetchWebookData = async () => {
+		setLoading(true);
+		const res = await client
+			.query(WebhooksDataQuery, {
+				params: {
+					pagination: {
+						limit: paginationProps.limit,
+						page: paginationProps.page,
+					},
+				},
+			})
+			.toPromise();
+		if (res.data?._webhooks) {
+			const { pagination, webhooks } = res.data?._webhooks;
+			const maxPages = getMaxPages(pagination);
+			if (webhooks?.length) {
+				setWebhookData(webhooks);
+				setPaginationProps({ ...paginationProps, ...pagination, maxPages });
+			} else {
+				if (paginationProps.page !== 1) {
+					setPaginationProps({
+						...paginationProps,
+						...pagination,
+						maxPages,
+						page: 1,
+					});
+				}
+			}
+		}
+		setLoading(false);
+	};
+	const paginationHandler = (value: Record<string, number>) => {
+		setPaginationProps({ ...paginationProps, ...value });
+	};
+	useEffect(() => {
+		fetchWebookData();
+	}, [paginationProps.page, paginationProps.limit]);
+	return (
+		<Box m="5" py="5" px="10" bg="white" rounded="md">
+			<Flex margin="2% 0" justifyContent="space-between" alignItems="center">
+				<Text fontSize="md" fontWeight="bold">
+					Webhooks
+				</Text>
+				<UpdateWebhookModal
+					view={UpdateWebhookModalViews.ADD}
+					fetchWebookData={fetchWebookData}
+				/>
+			</Flex>
+			{!loading ? (
+				webhookData.length ? (
+					<Table variant="simple">
+						<Thead>
+							<Tr>
+								<Th>Event Name</Th>
+								<Th>Endpoint</Th>
+								<Th>Enabled</Th>
+								<Th>Headers</Th>
+								<Th>Actions</Th>
+							</Tr>
+						</Thead>
+						<Tbody>
+							{webhookData.map((webhook: webhookDataTypes) => (
+								<Tr
+									key={webhook[WebhookInputDataFields.ID]}
+									style={{ fontSize: 14 }}
+								>
+									<Td maxW="300">
+										{webhook[WebhookInputDataFields.EVENT_NAME]}
+									</Td>
+									<Td>{webhook[WebhookInputDataFields.ENDPOINT]}</Td>
+									<Td>
+										<Tag
+											size="sm"
+											variant="outline"
+											colorScheme={
+												webhook[WebhookInputDataFields.ENABLED]
+													? 'green'
+													: 'yellow'
+											}
+										>
+											{webhook[WebhookInputDataFields.ENABLED].toString()}
+										</Tag>
+									</Td>
+									<Td>
+										<Tooltip
+											bg="gray.300"
+											color="black"
+											label={JSON.stringify(
+												webhook[WebhookInputDataFields.HEADERS],
+												null,
+												' '
+											)}
+										>
+											<Tag size="sm" variant="outline" colorScheme="gray">
+												{Object.keys(
+													webhook[WebhookInputDataFields.HEADERS] || {}
+												)?.length.toString()}
+											</Tag>
+										</Tooltip>
+									</Td>
+									<Td>
+										<Menu>
+											<MenuButton as={Button} variant="unstyled" size="sm">
+												<Flex
+													justifyContent="space-between"
+													alignItems="center"
+												>
+													<Text fontSize="sm" fontWeight="light">
+														Menu
+													</Text>
+													<FaAngleDown style={{ marginLeft: 10 }} />
+												</Flex>
+											</MenuButton>
+											<MenuList>
+												<UpdateWebhookModal
+													view={UpdateWebhookModalViews.Edit}
+													selectedWebhook={webhook}
+													fetchWebookData={fetchWebookData}
+												/>
+												<DeleteWebhookModal
+													webhookId={webhook[WebhookInputDataFields.ID]}
+													eventName={webhook[WebhookInputDataFields.EVENT_NAME]}
+													fetchWebookData={fetchWebookData}
+												/>
+												<ViewWebhookLogsModal
+													webhookId={webhook[WebhookInputDataFields.ID]}
+													eventName={webhook[WebhookInputDataFields.EVENT_NAME]}
+												/>
+											</MenuList>
+										</Menu>
+									</Td>
+								</Tr>
+							))}
+						</Tbody>
+						{(paginationProps.maxPages > 1 || paginationProps.total >= 5) && (
+							<TableCaption>
+								<Flex
+									justifyContent="space-between"
+									alignItems="center"
+									m="2% 0"
+								>
+									<Flex flex="1">
+										<Tooltip label="First Page">
+											<IconButton
+												aria-label="icon button"
+												onClick={() =>
+													paginationHandler({
+														page: 1,
+													})
+												}
+												isDisabled={paginationProps.page <= 1}
+												mr={4}
+												icon={<FaAngleDoubleLeft />}
+											/>
+										</Tooltip>
+										<Tooltip label="Previous Page">
+											<IconButton
+												aria-label="icon button"
+												onClick={() =>
+													paginationHandler({
+														page: paginationProps.page - 1,
+													})
+												}
+												isDisabled={paginationProps.page <= 1}
+												icon={<FaAngleLeft />}
+											/>
+										</Tooltip>
+									</Flex>
+									<Flex
+										flex="8"
+										justifyContent="space-evenly"
+										alignItems="center"
+									>
+										<Text mr={8}>
+											Page{' '}
+											<Text fontWeight="bold" as="span">
+												{paginationProps.page}
+											</Text>{' '}
+											of{' '}
+											<Text fontWeight="bold" as="span">
+												{paginationProps.maxPages}
+											</Text>
+										</Text>
+										<Flex alignItems="center">
+											<Text flexShrink="0">Go to page:</Text>{' '}
+											<NumberInput
+												ml={2}
+												mr={8}
+												w={28}
+												min={1}
+												max={paginationProps.maxPages}
+												onChange={(value) =>
+													paginationHandler({
+														page: parseInt(value),
+													})
+												}
+												value={paginationProps.page}
+											>
+												<NumberInputField />
+												<NumberInputStepper>
+													<NumberIncrementStepper />
+													<NumberDecrementStepper />
+												</NumberInputStepper>
+											</NumberInput>
+										</Flex>
+										<Select
+											w={32}
+											value={paginationProps.limit}
+											onChange={(e) =>
+												paginationHandler({
+													page: 1,
+													limit: parseInt(e.target.value),
+												})
+											}
+										>
+											{pageLimits.map((pageSize) => (
+												<option key={pageSize} value={pageSize}>
+													Show {pageSize}
+												</option>
+											))}
+										</Select>
+									</Flex>
+									<Flex flex="1">
+										<Tooltip label="Next Page">
+											<IconButton
+												aria-label="icon button"
+												onClick={() =>
+													paginationHandler({
+														page: paginationProps.page + 1,
+													})
+												}
+												isDisabled={
+													paginationProps.page >= paginationProps.maxPages
+												}
+												icon={<FaAngleRight />}
+											/>
+										</Tooltip>
+										<Tooltip label="Last Page">
+											<IconButton
+												aria-label="icon button"
+												onClick={() =>
+													paginationHandler({
+														page: paginationProps.maxPages,
+													})
+												}
+												isDisabled={
+													paginationProps.page >= paginationProps.maxPages
+												}
+												ml={4}
+												icon={<FaAngleDoubleRight />}
+											/>
+										</Tooltip>
+									</Flex>
+								</Flex>
+							</TableCaption>
+						)}
+					</Table>
+				) : (
+					<Flex
+						flexDirection="column"
+						minH="25vh"
+						justifyContent="center"
+						alignItems="center"
+					>
+						<Center w="50px" marginRight="1.5%">
+							<FaExclamationCircle style={{ color: '#f0f0f0', fontSize: 70 }} />
+						</Center>
+						<Text
+							fontSize="2xl"
+							paddingRight="1%"
+							fontWeight="bold"
+							color="#d9d9d9"
+						>
+							No Data
+						</Text>
+					</Flex>
+				)
+			) : (
+				<Center minH="25vh">
+					<Spinner />
+				</Center>
+			)}
+		</Box>
+	);
+};
+
+export default Webhooks;

dashboard/src/routes/index.tsx

@@ -8,6 +8,7 @@ const Auth = lazy(() => import('../pages/Auth'));
 const Environment = lazy(() => import('../pages/Environment'));
 const Home = lazy(() => import('../pages/Home'));
 const Users = lazy(() => import('../pages/Users'));
+const Webhooks = lazy(() => import('../pages/Webhooks'));
 
 export const AppRoutes = () => {
 	const { isLoggedIn } = useAuthContext();
@@ -29,6 +30,7 @@ export const AppRoutes = () => {
 								<Route path="/:sec" element={<Environment />} />
 							</Route>
 							<Route path="users" element={<Users />} />
+							<Route path="webhooks" element={<Webhooks />} />
 							<Route path="*" element={<Home />} />
 						</Route>
 					</Routes>

server/constants/env.go

@@ -47,6 +47,8 @@ const (
 	EnvKeySmtpPassword = "SMTP_PASSWORD"
 	// EnvKeySenderEmail key for env variable SENDER_EMAIL
 	EnvKeySenderEmail = "SENDER_EMAIL"
+	// EnvKeyIsEmailServiceEnabled key for env variable IS_EMAIL_SERVICE_ENABLED
+	EnvKeyIsEmailServiceEnabled = "IS_EMAIL_SERVICE_ENABLED"
 	// EnvKeyJwtType key for env variable JWT_TYPE
 	EnvKeyJwtType = "JWT_TYPE"
 	// EnvKeyJwtSecret key for env variable JWT_SECRET
@@ -117,6 +119,12 @@ const (
 	EnvKeyDisableRedisForEnv = "DISABLE_REDIS_FOR_ENV"
 	// EnvKeyDisableStrongPassword key for env variable DISABLE_STRONG_PASSWORD
 	EnvKeyDisableStrongPassword = "DISABLE_STRONG_PASSWORD"
+	// EnvKeyEnforceMultiFactorAuthentication is key for env variable ENFORCE_MULTI_FACTOR_AUTHENTICATION
+	// If enforced and changed later on, existing user will have MFA but new user will not have MFA
+	EnvKeyEnforceMultiFactorAuthentication = "ENFORCE_MULTI_FACTOR_AUTHENTICATION"
+	// EnvKeyDisableMultiFactorAuthentication is key for env variable DISABLE_MULTI_FACTOR_AUTHENTICATION
+	// this variable is used to completely disable multi factor authentication. It will have no effect on profile preference
+	EnvKeyDisableMultiFactorAuthentication = "DISABLE_MULTI_FACTOR_AUTHENTICATION"
 
 	// Slice variables
 	// EnvKeyRoles key for env variable ROLES

server/constants/oauth_info_urls.go

@@ -8,6 +8,9 @@ const (
 	FacebookUserInfoURL = "https://graph.facebook.com/me?fields=id,first_name,last_name,name,email,picture&access_token="
 	// Ref: https://docs.github.com/en/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps#3-your-github-app-accesses-the-api-with-the-users-access-token
 	GithubUserInfoURL = "https://api.github.com/user"
+	// Get github user emails when user info email is empty Ref: https://stackoverflow.com/a/35387123
+	GithubUserEmails = "https://api/github.com/user/emails"
+
 	// Ref: https://docs.microsoft.com/en-us/linkedin/shared/integrations/people/profile-api
 	LinkedInUserInfoURL = "https://api.linkedin.com/v2/me?projection=(id,localizedFirstName,localizedLastName,emailAddress,profilePicture(displayImage~:playableStreams))"
 	LinkedInEmailURL    = "https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))"

server/db/models/email_templates.go

@@ -0,0 +1,33 @@
+package models
+
+import (
+	"strings"
+
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
+)
+
+// EmailTemplate model for database
+type EmailTemplate struct {
+	Key       string `json:"_key,omitempty" bson:"_key,omitempty" cql:"_key,omitempty"` // for arangodb
+	ID        string `gorm:"primaryKey;type:char(36)" json:"_id" bson:"_id" cql:"id"`
+	EventName string `gorm:"unique" json:"event_name" bson:"event_name" cql:"event_name"`
+	Template  string `gorm:"type:text" json:"template" bson:"template" cql:"template"`
+	CreatedAt int64  `json:"created_at" bson:"created_at" cql:"created_at"`
+	UpdatedAt int64  `json:"updated_at" bson:"updated_at" cql:"updated_at"`
+}
+
+// AsAPIEmailTemplate to return email template as graphql response object
+func (e *EmailTemplate) AsAPIEmailTemplate() *model.EmailTemplate {
+	id := e.ID
+	if strings.Contains(id, Collections.EmailTemplate+"/") {
+		id = strings.TrimPrefix(id, Collections.EmailTemplate+"/")
+	}
+	return &model.EmailTemplate{
+		ID:        id,
+		EventName: e.EventName,
+		Template:  e.Template,
+		CreatedAt: refs.NewInt64Ref(e.CreatedAt),
+		UpdatedAt: refs.NewInt64Ref(e.UpdatedAt),
+	}
+}

server/db/models/model.go

@@ -8,6 +8,8 @@ type CollectionList struct {
 	Env                 string
 	Webhook             string
 	WebhookLog          string
+	EmailTemplate       string
+	OTP                 string
 }
 
 var (
@@ -19,7 +21,9 @@ var (
 		VerificationRequest: Prefix + "verification_requests",
 		Session:             Prefix + "sessions",
 		Env:                 Prefix + "env",
-		Webhook:             Prefix + "webhook",
+		Webhook:             Prefix + "webhooks",
-		WebhookLog:          Prefix + "webhook_log",
+		WebhookLog:          Prefix + "webhook_logs",
+		EmailTemplate:       Prefix + "email_templates",
+		OTP:                 Prefix + "otps",
 	}
 )

server/db/models/otp.go

@@ -0,0 +1,12 @@
+package models
+
+// OTP model for database
+type OTP struct {
+	Key       string `json:"_key,omitempty" bson:"_key,omitempty" cql:"_key,omitempty"` // for arangodb
+	ID        string `gorm:"primaryKey;type:char(36)" json:"_id" bson:"_id" cql:"id"`
+	Email     string `gorm:"unique" json:"email" bson:"email" cql:"email"`
+	Otp       string `json:"otp" bson:"otp" cql:"otp"`
+	ExpiresAt int64  `json:"expires_at" bson:"expires_at" cql:"expires_at"`
+	CreatedAt int64  `json:"created_at" bson:"created_at" cql:"created_at"`
+	UpdatedAt int64  `json:"updated_at" bson:"updated_at" cql:"updated_at"`
+}

server/db/models/user.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 )
 
 // Note: any change here should be reflected in providers/casandra/provider.go as it does not have model support in collection creation
@@ -28,6 +29,7 @@ type User struct {
 	Picture                  *string `gorm:"type:text" json:"picture" bson:"picture" cql:"picture"`
 	Roles                    string  `json:"roles" bson:"roles" cql:"roles"`
 	RevokedTimestamp         *int64  `json:"revoked_timestamp" bson:"revoked_timestamp" cql:"revoked_timestamp"`
+	IsMultiFactorAuthEnabled *bool   `json:"is_multi_factor_auth_enabled" bson:"is_multi_factor_auth_enabled" cql:"is_multi_factor_auth_enabled"`
 	UpdatedAt                int64   `json:"updated_at" bson:"updated_at" cql:"updated_at"`
 	CreatedAt                int64   `json:"created_at" bson:"created_at" cql:"created_at"`
 }
@@ -35,16 +37,13 @@ type User struct {
 func (user *User) AsAPIUser() *model.User {
 	isEmailVerified := user.EmailVerifiedAt != nil
 	isPhoneVerified := user.PhoneNumberVerifiedAt != nil
-	email := user.Email
-	createdAt := user.CreatedAt
-	updatedAt := user.UpdatedAt
 
-	id := user.ID
+	// id := user.ID
-	if strings.Contains(id, Collections.WebhookLog+"/") {
+	// if strings.Contains(id, Collections.User+"/") {
-		id = strings.TrimPrefix(id, Collections.WebhookLog+"/")
+	// 	id = strings.TrimPrefix(id, Collections.User+"/")
-	}
+	// }
 	return &model.User{
-		ID:                  id,
+		ID:                       user.ID,
 		Email:                    user.Email,
 		EmailVerified:            isEmailVerified,
 		SignupMethods:            user.SignupMethods,
@@ -52,7 +51,7 @@ func (user *User) AsAPIUser() *model.User {
 		FamilyName:               user.FamilyName,
 		MiddleName:               user.MiddleName,
 		Nickname:                 user.Nickname,
-		PreferredUsername:   &email,
+		PreferredUsername:        refs.NewStringRef(user.Email),
 		Gender:                   user.Gender,
 		Birthdate:                user.Birthdate,
 		PhoneNumber:              user.PhoneNumber,
@@ -60,7 +59,8 @@ func (user *User) AsAPIUser() *model.User {
 		Picture:                  user.Picture,
 		Roles:                    strings.Split(user.Roles, ","),
 		RevokedTimestamp:         user.RevokedTimestamp,
-		CreatedAt:           &createdAt,
+		IsMultiFactorAuthEnabled: user.IsMultiFactorAuthEnabled,
-		UpdatedAt:           &updatedAt,
+		CreatedAt:                refs.NewInt64Ref(user.CreatedAt),
+		UpdatedAt:                refs.NewInt64Ref(user.UpdatedAt),
 	}
 }

server/db/models/verification_requests.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 )
 
 // Note: any change here should be reflected in providers/casandra/provider.go as it does not have model support in collection creation
@@ -23,28 +24,20 @@ type VerificationRequest struct {
 }
 
 func (v *VerificationRequest) AsAPIVerificationRequest() *model.VerificationRequest {
-	token := v.Token
-	createdAt := v.CreatedAt
-	updatedAt := v.UpdatedAt
-	email := v.Email
-	nonce := v.Nonce
-	redirectURI := v.RedirectURI
-	expires := v.ExpiresAt
-	identifier := v.Identifier
-
 	id := v.ID
-	if strings.Contains(id, Collections.WebhookLog+"/") {
+	if strings.Contains(id, Collections.VerificationRequest+"/") {
-		id = strings.TrimPrefix(id, Collections.WebhookLog+"/")
+		id = strings.TrimPrefix(id, Collections.VerificationRequest+"/")
 	}
+
 	return &model.VerificationRequest{
 		ID:          id,
-		Token:       &token,
+		Token:       refs.NewStringRef(v.Token),
-		Identifier:  &identifier,
+		Identifier:  refs.NewStringRef(v.Identifier),
-		Expires:     &expires,
+		Expires:     refs.NewInt64Ref(v.ExpiresAt),
-		Email:       &email,
+		Email:       refs.NewStringRef(v.Email),
-		Nonce:       &nonce,
+		Nonce:       refs.NewStringRef(v.Nonce),
-		RedirectURI: &redirectURI,
+		RedirectURI: refs.NewStringRef(v.RedirectURI),
-		CreatedAt:   &createdAt,
+		CreatedAt:   refs.NewInt64Ref(v.CreatedAt),
-		UpdatedAt:   &updatedAt,
+		UpdatedAt:   refs.NewInt64Ref(v.UpdatedAt),
 	}
 }

server/db/models/webhook.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 )
 
 // Note: any change here should be reflected in providers/casandra/provider.go as it does not have model support in collection creation
@@ -21,6 +22,7 @@ type Webhook struct {
 	UpdatedAt int64  `json:"updated_at" bson:"updated_at" cql:"updated_at"`
 }
 
+// AsAPIWebhook to return webhook as graphql response object
 func (w *Webhook) AsAPIWebhook() *model.Webhook {
 	headersMap := make(map[string]interface{})
 	json.Unmarshal([]byte(w.Headers), &headersMap)
@@ -29,13 +31,14 @@ func (w *Webhook) AsAPIWebhook() *model.Webhook {
 	if strings.Contains(id, Collections.Webhook+"/") {
 		id = strings.TrimPrefix(id, Collections.Webhook+"/")
 	}
+
 	return &model.Webhook{
 		ID:        id,
-		EventName: &w.EventName,
+		EventName: refs.NewStringRef(w.EventName),
-		Endpoint:  &w.EndPoint,
+		Endpoint:  refs.NewStringRef(w.EndPoint),
 		Headers:   headersMap,
-		Enabled:   &w.Enabled,
+		Enabled:   refs.NewBoolRef(w.Enabled),
-		CreatedAt: &w.CreatedAt,
+		CreatedAt: refs.NewInt64Ref(w.CreatedAt),
-		UpdatedAt: &w.UpdatedAt,
+		UpdatedAt: refs.NewInt64Ref(w.UpdatedAt),
 	}
 }

server/db/models/webhook_log.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 )
 
 // Note: any change here should be reflected in providers/casandra/provider.go as it does not have model support in collection creation
@@ -20,6 +21,7 @@ type WebhookLog struct {
 	UpdatedAt  int64  `json:"updated_at" bson:"updated_at" cql:"updated_at"`
 }
 
+// AsAPIWebhookLog to return webhook log as graphql response object
 func (w *WebhookLog) AsAPIWebhookLog() *model.WebhookLog {
 	id := w.ID
 	if strings.Contains(id, Collections.WebhookLog+"/") {
@@ -27,11 +29,11 @@ func (w *WebhookLog) AsAPIWebhookLog() *model.WebhookLog {
 	}
 	return &model.WebhookLog{
 		ID:         id,
-		HTTPStatus: &w.HttpStatus,
+		HTTPStatus: refs.NewInt64Ref(w.HttpStatus),
-		Response:   &w.Response,
+		Response:   refs.NewStringRef(w.Response),
-		Request:    &w.Request,
+		Request:    refs.NewStringRef(w.Request),
-		WebhookID:  &w.WebhookID,
+		WebhookID:  refs.NewStringRef(w.WebhookID),
-		CreatedAt:  &w.CreatedAt,
+		CreatedAt:  refs.NewInt64Ref(w.CreatedAt),
-		UpdatedAt:  &w.UpdatedAt,
+		UpdatedAt:  refs.NewInt64Ref(w.UpdatedAt),
 	}
 }

server/db/providers/arangodb/email_template.go

@@ -0,0 +1,152 @@
+package arangodb
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/arangodb/go-driver"
+	arangoDriver "github.com/arangodb/go-driver"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/google/uuid"
+)
+
+// AddEmailTemplate to add EmailTemplate
+func (p *provider) AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	if emailTemplate.ID == "" {
+		emailTemplate.ID = uuid.New().String()
+		emailTemplate.Key = emailTemplate.ID
+	}
+
+	emailTemplate.Key = emailTemplate.ID
+	emailTemplate.CreatedAt = time.Now().Unix()
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	emailTemplateCollection, _ := p.db.Collection(ctx, models.Collections.EmailTemplate)
+	_, err := emailTemplateCollection.CreateDocument(ctx, emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// UpdateEmailTemplate to update EmailTemplate
+func (p *provider) UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	emailTemplateCollection, _ := p.db.Collection(ctx, models.Collections.EmailTemplate)
+	meta, err := emailTemplateCollection.UpdateDocument(ctx, emailTemplate.Key, emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+
+	emailTemplate.Key = meta.Key
+	emailTemplate.ID = meta.ID.String()
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// ListEmailTemplates to list EmailTemplate
+func (p *provider) ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error) {
+	emailTemplates := []*model.EmailTemplate{}
+
+	query := fmt.Sprintf("FOR d in %s SORT d.created_at DESC LIMIT %d, %d RETURN d", models.Collections.EmailTemplate, pagination.Offset, pagination.Limit)
+
+	sctx := driver.WithQueryFullCount(ctx)
+	cursor, err := p.db.Query(sctx, query, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close()
+
+	paginationClone := pagination
+	paginationClone.Total = cursor.Statistics().FullCount()
+
+	for {
+		var emailTemplate models.EmailTemplate
+		meta, err := cursor.ReadDocument(ctx, &emailTemplate)
+
+		if arangoDriver.IsNoMoreDocuments(err) {
+			break
+		} else if err != nil {
+			return nil, err
+		}
+
+		if meta.Key != "" {
+			emailTemplates = append(emailTemplates, emailTemplate.AsAPIEmailTemplate())
+		}
+	}
+
+	return &model.EmailTemplates{
+		Pagination:     &paginationClone,
+		EmailTemplates: emailTemplates,
+	}, nil
+}
+
+// GetEmailTemplateByID to get EmailTemplate by id
+func (p *provider) GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	query := fmt.Sprintf("FOR d in %s FILTER d._key == @email_template_id RETURN d", models.Collections.EmailTemplate)
+	bindVars := map[string]interface{}{
+		"email_template_id": emailTemplateID,
+	}
+
+	cursor, err := p.db.Query(ctx, query, bindVars)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close()
+
+	for {
+		if !cursor.HasMore() {
+			if emailTemplate.Key == "" {
+				return nil, fmt.Errorf("email template not found")
+			}
+			break
+		}
+		_, err := cursor.ReadDocument(ctx, &emailTemplate)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// GetEmailTemplateByEventName to get EmailTemplate by event_name
+func (p *provider) GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	query := fmt.Sprintf("FOR d in %s FILTER d.event_name == @event_name RETURN d", models.Collections.EmailTemplate)
+	bindVars := map[string]interface{}{
+		"event_name": eventName,
+	}
+
+	cursor, err := p.db.Query(ctx, query, bindVars)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close()
+
+	for {
+		if !cursor.HasMore() {
+			if emailTemplate.Key == "" {
+				return nil, fmt.Errorf("email template not found")
+			}
+			break
+		}
+		_, err := cursor.ReadDocument(ctx, &emailTemplate)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// DeleteEmailTemplate to delete EmailTemplate
+func (p *provider) DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error {
+	eventTemplateCollection, _ := p.db.Collection(ctx, models.Collections.EmailTemplate)
+	_, err := eventTemplateCollection.RemoveDocument(ctx, emailTemplate.ID)
+	if err != nil {
+		return err
+	}
+	return nil
+}

server/db/providers/arangodb/env.go

@@ -15,6 +15,7 @@ import (
 func (p *provider) AddEnv(ctx context.Context, env models.Env) (models.Env, error) {
 	if env.ID == "" {
 		env.ID = uuid.New().String()
+		env.Key = env.ID
 	}
 
 	env.CreatedAt = time.Now().Unix()

server/db/providers/arangodb/otp.go

@@ -0,0 +1,92 @@
+package arangodb
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/arangodb/go-driver"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/google/uuid"
+)
+
+// UpsertOTP to add or update otp
+func (p *provider) UpsertOTP(ctx context.Context, otpParam *models.OTP) (*models.OTP, error) {
+	otp, _ := p.GetOTPByEmail(ctx, otpParam.Email)
+	shouldCreate := false
+	if otp == nil {
+		id := uuid.NewString()
+		otp = &models.OTP{
+			ID:        id,
+			Key:       id,
+			Otp:       otpParam.Otp,
+			Email:     otpParam.Email,
+			ExpiresAt: otpParam.ExpiresAt,
+			CreatedAt: time.Now().Unix(),
+		}
+		shouldCreate = true
+	} else {
+		otp.Otp = otpParam.Otp
+		otp.ExpiresAt = otpParam.ExpiresAt
+	}
+
+	otp.UpdatedAt = time.Now().Unix()
+	otpCollection, _ := p.db.Collection(ctx, models.Collections.OTP)
+
+	var meta driver.DocumentMeta
+	var err error
+	if shouldCreate {
+		meta, err = otpCollection.CreateDocument(ctx, otp)
+	} else {
+		meta, err = otpCollection.UpdateDocument(ctx, otp.Key, otp)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	otp.Key = meta.Key
+	otp.ID = meta.ID.String()
+	return otp, nil
+}
+
+// GetOTPByEmail to get otp for a given email address
+func (p *provider) GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error) {
+	var otp models.OTP
+	query := fmt.Sprintf("FOR d in %s FILTER d.email == @email RETURN d", models.Collections.OTP)
+	bindVars := map[string]interface{}{
+		"email": emailAddress,
+	}
+
+	cursor, err := p.db.Query(ctx, query, bindVars)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close()
+
+	for {
+		if !cursor.HasMore() {
+			if otp.Key == "" {
+				return nil, fmt.Errorf("email template not found")
+			}
+			break
+		}
+		_, err := cursor.ReadDocument(ctx, &otp)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return &otp, nil
+}
+
+// DeleteOTP to delete otp
+func (p *provider) DeleteOTP(ctx context.Context, otp *models.OTP) error {
+	otpCollection, _ := p.db.Collection(ctx, models.Collections.OTP)
+	_, err := otpCollection.RemoveDocument(ctx, otp.ID)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

server/db/providers/arangodb/provider.go

@@ -134,6 +134,34 @@ func NewProvider() (*provider, error) {
 		Sparse: true,
 	})
 
+	emailTemplateCollectionExists, err := arangodb.CollectionExists(ctx, models.Collections.EmailTemplate)
+	if !emailTemplateCollectionExists {
+		_, err = arangodb.CreateCollection(ctx, models.Collections.EmailTemplate, nil)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	emailTemplateCollection, _ := arangodb.Collection(nil, models.Collections.EmailTemplate)
+	emailTemplateCollection.EnsureHashIndex(ctx, []string{"event_name"}, &arangoDriver.EnsureHashIndexOptions{
+		Unique: true,
+		Sparse: true,
+	})
+
+	otpCollectionExists, err := arangodb.CollectionExists(ctx, models.Collections.OTP)
+	if !otpCollectionExists {
+		_, err = arangodb.CreateCollection(ctx, models.Collections.OTP, nil)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	otpCollection, _ := arangodb.Collection(nil, models.Collections.OTP)
+	otpCollection.EnsureHashIndex(ctx, []string{"email"}, &arangoDriver.EnsureHashIndexOptions{
+		Unique: true,
+		Sparse: true,
+	})
+
 	return &provider{
 		db: arangodb,
 	}, err

server/db/providers/arangodb/session.go

@@ -12,6 +12,7 @@ import (
 func (p *provider) AddSession(ctx context.Context, session models.Session) error {
 	if session.ID == "" {
 		session.ID = uuid.New().String()
+		session.Key = session.ID
 	}
 
 	session.CreatedAt = time.Now().Unix()

server/db/providers/arangodb/user.go

@@ -2,22 +2,26 @@ package arangodb
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/arangodb/go-driver"
 	arangoDriver "github.com/arangodb/go-driver"
+	"github.com/google/uuid"
+
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/db/models"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
-	"github.com/google/uuid"
 )
 
 // AddUser to save user information in database
 func (p *provider) AddUser(ctx context.Context, user models.User) (models.User, error) {
 	if user.ID == "" {
 		user.ID = uuid.New().String()
+		user.Key = user.ID
 	}
 
 	if user.Roles == "" {
@@ -65,7 +69,7 @@ func (p *provider) DeleteUser(ctx context.Context, user models.User) error {
 
 	query := fmt.Sprintf(`FOR d IN %s FILTER d.user_id == @user_id REMOVE { _key: d._key } IN %s`, models.Collections.Session, models.Collections.Session)
 	bindVars := map[string]interface{}{
-		"user_id": user.ID,
+		"user_id": user.Key,
 	}
 	cursor, err := p.db.Query(ctx, query, bindVars)
 	if err != nil {
@@ -174,3 +178,36 @@ func (p *provider) GetUserByID(ctx context.Context, id string) (models.User, err
 
 	return user, nil
 }
+
+// UpdateUsers to update multiple users, with parameters of user IDs slice
+// If ids set to nil / empty all the users will be updated
+func (p *provider) UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error {
+	// set updated_at time for all users
+	data["updated_at"] = time.Now().Unix()
+
+	userInfoBytes, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	query := ""
+	if ids != nil && len(ids) > 0 {
+		keysArray := ""
+		for _, id := range ids {
+			keysArray += fmt.Sprintf("'%s', ", id)
+		}
+		keysArray = strings.Trim(keysArray, " ")
+		keysArray = strings.TrimSuffix(keysArray, ",")
+		query = fmt.Sprintf("FOR u IN %s FILTER u._id IN [%s] UPDATE u._key with %s IN %s", models.Collections.User, keysArray, string(userInfoBytes), models.Collections.User)
+	} else {
+		query = fmt.Sprintf("FOR u IN %s UPDATE u._key with %s IN %s", models.Collections.User, string(userInfoBytes), models.Collections.User)
+	}
+
+	_, err = p.db.Query(ctx, query, nil)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

server/db/providers/arangodb/verification_requests.go

@@ -15,6 +15,7 @@ import (
 func (p *provider) AddVerificationRequest(ctx context.Context, verificationRequest models.VerificationRequest) (models.VerificationRequest, error) {
 	if verificationRequest.ID == "" {
 		verificationRequest.ID = uuid.New().String()
+		verificationRequest.Key = verificationRequest.ID
 	}
 
 	verificationRequest.CreatedAt = time.Now().Unix()

server/db/providers/arangodb/webhook.go

@@ -16,6 +16,7 @@ import (
 func (p *provider) AddWebhook(ctx context.Context, webhook models.Webhook) (*model.Webhook, error) {
 	if webhook.ID == "" {
 		webhook.ID = uuid.New().String()
+		webhook.Key = webhook.ID
 	}
 
 	webhook.Key = webhook.ID

server/db/providers/arangodb/webhook_log.go

@@ -16,6 +16,7 @@ import (
 func (p *provider) AddWebhookLog(ctx context.Context, webhookLog models.WebhookLog) (*model.WebhookLog, error) {
 	if webhookLog.ID == "" {
 		webhookLog.ID = uuid.New().String()
+		webhookLog.Key = webhookLog.ID
 	}
 
 	webhookLog.Key = webhookLog.ID

server/db/providers/cassandradb/email_template.go

@@ -0,0 +1,159 @@
+package cassandradb
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/gocql/gocql"
+	"github.com/google/uuid"
+)
+
+// AddEmailTemplate to add EmailTemplate
+func (p *provider) AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	if emailTemplate.ID == "" {
+		emailTemplate.ID = uuid.New().String()
+	}
+
+	emailTemplate.Key = emailTemplate.ID
+	emailTemplate.CreatedAt = time.Now().Unix()
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	existingEmailTemplate, _ := p.GetEmailTemplateByEventName(ctx, emailTemplate.EventName)
+	if existingEmailTemplate != nil {
+		return nil, fmt.Errorf("Email template with %s event_name already exists", emailTemplate.EventName)
+	}
+
+	insertQuery := fmt.Sprintf("INSERT INTO %s (id, event_name, template,  created_at, updated_at) VALUES ('%s', '%s', '%s', %d, %d)", KeySpace+"."+models.Collections.EmailTemplate, emailTemplate.ID, emailTemplate.EventName, emailTemplate.Template, emailTemplate.CreatedAt, emailTemplate.UpdatedAt)
+	err := p.db.Query(insertQuery).Exec()
+	if err != nil {
+		return nil, err
+	}
+
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// UpdateEmailTemplate to update EmailTemplate
+func (p *provider) UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	bytes, err := json.Marshal(emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+	// use decoder instead of json.Unmarshall, because it converts int64 -> float64 after unmarshalling
+	decoder := json.NewDecoder(strings.NewReader(string(bytes)))
+	decoder.UseNumber()
+	emailTemplateMap := map[string]interface{}{}
+	err = decoder.Decode(&emailTemplateMap)
+	if err != nil {
+		return nil, err
+	}
+
+	updateFields := ""
+	for key, value := range emailTemplateMap {
+		if key == "_id" {
+			continue
+		}
+
+		if key == "_key" {
+			continue
+		}
+
+		if value == nil {
+			updateFields += fmt.Sprintf("%s = null,", key)
+			continue
+		}
+
+		valueType := reflect.TypeOf(value)
+		if valueType.Name() == "string" {
+			updateFields += fmt.Sprintf("%s = '%s', ", key, value.(string))
+		} else {
+			updateFields += fmt.Sprintf("%s = %v, ", key, value)
+		}
+	}
+	updateFields = strings.Trim(updateFields, " ")
+	updateFields = strings.TrimSuffix(updateFields, ",")
+
+	query := fmt.Sprintf("UPDATE %s SET %s WHERE id = '%s'", KeySpace+"."+models.Collections.EmailTemplate, updateFields, emailTemplate.ID)
+	err = p.db.Query(query).Exec()
+	if err != nil {
+		return nil, err
+	}
+
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// ListEmailTemplates to list EmailTemplate
+func (p *provider) ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error) {
+	emailTemplates := []*model.EmailTemplate{}
+	paginationClone := pagination
+
+	totalCountQuery := fmt.Sprintf(`SELECT COUNT(*) FROM %s`, KeySpace+"."+models.Collections.EmailTemplate)
+	err := p.db.Query(totalCountQuery).Consistency(gocql.One).Scan(&paginationClone.Total)
+	if err != nil {
+		return nil, err
+	}
+
+	// there is no offset in cassandra
+	// so we fetch till limit + offset
+	// and return the results from offset to limit
+	query := fmt.Sprintf("SELECT id, event_name, template, created_at, updated_at FROM %s LIMIT %d", KeySpace+"."+models.Collections.EmailTemplate, pagination.Limit+pagination.Offset)
+
+	scanner := p.db.Query(query).Iter().Scanner()
+	counter := int64(0)
+	for scanner.Next() {
+		if counter >= pagination.Offset {
+			var emailTemplate models.EmailTemplate
+			err := scanner.Scan(&emailTemplate.ID, &emailTemplate.EventName, &emailTemplate.Template, &emailTemplate.CreatedAt, &emailTemplate.UpdatedAt)
+			if err != nil {
+				return nil, err
+			}
+			emailTemplates = append(emailTemplates, emailTemplate.AsAPIEmailTemplate())
+		}
+		counter++
+	}
+
+	return &model.EmailTemplates{
+		Pagination:     &paginationClone,
+		EmailTemplates: emailTemplates,
+	}, nil
+}
+
+// GetEmailTemplateByID to get EmailTemplate by id
+func (p *provider) GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	query := fmt.Sprintf(`SELECT id, event_name, template, created_at, updated_at FROM %s WHERE id = '%s' LIMIT 1`, KeySpace+"."+models.Collections.EmailTemplate, emailTemplateID)
+	err := p.db.Query(query).Consistency(gocql.One).Scan(&emailTemplate.ID, &emailTemplate.EventName, &emailTemplate.Template, &emailTemplate.CreatedAt, &emailTemplate.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// GetEmailTemplateByEventName to get EmailTemplate by event_name
+func (p *provider) GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	query := fmt.Sprintf(`SELECT id, event_name, template, created_at, updated_at FROM %s WHERE event_name = '%s' LIMIT 1 ALLOW FILTERING`, KeySpace+"."+models.Collections.EmailTemplate, eventName)
+	err := p.db.Query(query).Consistency(gocql.One).Scan(&emailTemplate.ID, &emailTemplate.EventName, &emailTemplate.Template, &emailTemplate.CreatedAt, &emailTemplate.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// DeleteEmailTemplate to delete EmailTemplate
+func (p *provider) DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error {
+	query := fmt.Sprintf("DELETE FROM %s WHERE id = '%s'", KeySpace+"."+models.Collections.EmailTemplate, emailTemplate.ID)
+	err := p.db.Query(query).Exec()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

server/db/providers/cassandradb/otp.go

@@ -0,0 +1,67 @@
+package cassandradb
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/gocql/gocql"
+	"github.com/google/uuid"
+)
+
+// UpsertOTP to add or update otp
+func (p *provider) UpsertOTP(ctx context.Context, otpParam *models.OTP) (*models.OTP, error) {
+	otp, _ := p.GetOTPByEmail(ctx, otpParam.Email)
+	shouldCreate := false
+	if otp == nil {
+		shouldCreate = true
+		otp = &models.OTP{
+			ID:        uuid.NewString(),
+			Otp:       otpParam.Otp,
+			Email:     otpParam.Email,
+			ExpiresAt: otpParam.ExpiresAt,
+			CreatedAt: time.Now().Unix(),
+			UpdatedAt: time.Now().Unix(),
+		}
+	} else {
+		otp.Otp = otpParam.Otp
+		otp.ExpiresAt = otpParam.ExpiresAt
+	}
+
+	otp.UpdatedAt = time.Now().Unix()
+	query := ""
+	if shouldCreate {
+		query = fmt.Sprintf(`INSERT INTO %s (id, email, otp, expires_at, created_at, updated_at) VALUES ('%s', '%s', '%s', %d, %d, %d)`, KeySpace+"."+models.Collections.OTP, otp.ID, otp.Email, otp.Otp, otp.ExpiresAt, otp.CreatedAt, otp.UpdatedAt)
+	} else {
+		query = fmt.Sprintf(`UPDATE %s SET otp = '%s', expires_at = %d, updated_at = %d WHERE id = '%s'`, KeySpace+"."+models.Collections.OTP, otp.Otp, otp.ExpiresAt, otp.UpdatedAt, otp.ID)
+	}
+
+	err := p.db.Query(query).Exec()
+	if err != nil {
+		return nil, err
+	}
+
+	return otp, nil
+}
+
+// GetOTPByEmail to get otp for a given email address
+func (p *provider) GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error) {
+	var otp models.OTP
+	query := fmt.Sprintf(`SELECT id, email, otp, expires_at, created_at, updated_at FROM %s WHERE email = '%s' LIMIT 1 ALLOW FILTERING`, KeySpace+"."+models.Collections.OTP, emailAddress)
+	err := p.db.Query(query).Consistency(gocql.One).Scan(&otp.ID, &otp.Email, &otp.Otp, &otp.ExpiresAt, &otp.CreatedAt, &otp.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &otp, nil
+}
+
+// DeleteOTP to delete otp
+func (p *provider) DeleteOTP(ctx context.Context, otp *models.OTP) error {
+	query := fmt.Sprintf("DELETE FROM %s WHERE id = '%s'", KeySpace+"."+models.Collections.OTP, otp.ID)
+	err := p.db.Query(query).Exec()
+	if err != nil {
+		return err
+	}
+	return nil
+}

server/db/providers/cassandradb/provider.go

@@ -13,6 +13,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/gocql/gocql"
 	cansandraDriver "github.com/gocql/gocql"
+	log "github.com/sirupsen/logrus"
 )
 
 type provider struct {
@@ -99,6 +100,7 @@ func NewProvider() (*provider, error) {
 	cassandraClient.Consistency = gocql.LocalQuorum
 	cassandraClient.ConnectTimeout = 10 * time.Second
 	cassandraClient.ProtoVersion = 4
+	cassandraClient.Timeout = 30 * time.Minute // for large data
 
 	session, err := cassandraClient.CreateSession()
 	if err != nil {
@@ -159,6 +161,13 @@ func NewProvider() (*provider, error) {
 	if err != nil {
 		return nil, err
 	}
+	// add is_multi_factor_auth_enabled on users table
+	userTableAlterQuery := fmt.Sprintf(`ALTER TABLE %s.%s ADD is_multi_factor_auth_enabled boolean`, KeySpace, models.Collections.User)
+	err = session.Query(userTableAlterQuery).Exec()
+	if err != nil {
+		log.Debug("Failed to alter table as column exists: ", err)
+		// return nil, err
+	}
 
 	// token is reserved keyword in cassandra, hence we need to use jwt_token
 	verificationRequestCollectionQuery := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s.%s (id text, jwt_token text, identifier text, expires_at bigint, email text, nonce text, redirect_uri text, created_at bigint, updated_at bigint, PRIMARY KEY (id))", KeySpace, models.Collections.VerificationRequest)
@@ -204,6 +213,28 @@ func NewProvider() (*provider, error) {
 		return nil, err
 	}
 
+	emailTemplateCollectionQuery := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s.%s (id text, event_name text, template text, updated_at bigint, created_at bigint, PRIMARY KEY (id))", KeySpace, models.Collections.EmailTemplate)
+	err = session.Query(emailTemplateCollectionQuery).Exec()
+	if err != nil {
+		return nil, err
+	}
+	emailTemplateIndexQuery := fmt.Sprintf("CREATE INDEX IF NOT EXISTS authorizer_email_template_event_name ON %s.%s (event_name)", KeySpace, models.Collections.EmailTemplate)
+	err = session.Query(emailTemplateIndexQuery).Exec()
+	if err != nil {
+		return nil, err
+	}
+
+	otpCollection := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s.%s (id text, email text, otp text, expires_at bigint, updated_at bigint, created_at bigint, PRIMARY KEY (id))", KeySpace, models.Collections.OTP)
+	err = session.Query(otpCollection).Exec()
+	if err != nil {
+		return nil, err
+	}
+	otpIndexQuery := fmt.Sprintf("CREATE INDEX IF NOT EXISTS authorizer_otp_email ON %s.%s (email)", KeySpace, models.Collections.OTP)
+	err = session.Query(otpIndexQuery).Exec()
+	if err != nil {
+		return nil, err
+	}
+
 	return &provider{
 		db: session,
 	}, err

server/db/providers/cassandradb/user.go

@@ -107,7 +107,7 @@ func (p *provider) UpdateUser(ctx context.Context, user models.User) (models.Use
 		}
 
 		if value == nil {
-			updateFields += fmt.Sprintf("%s = null,", key)
+			updateFields += fmt.Sprintf("%s = null, ", key)
 			continue
 		}
 
@@ -122,7 +122,6 @@ func (p *provider) UpdateUser(ctx context.Context, user models.User) (models.Use
 	updateFields = strings.TrimSuffix(updateFields, ",")
 
 	query := fmt.Sprintf("UPDATE %s SET %s WHERE id = '%s'", KeySpace+"."+models.Collections.User, updateFields, user.ID)
-
 	err = p.db.Query(query).Exec()
 	if err != nil {
 		return user, err
@@ -173,14 +172,14 @@ func (p *provider) ListUsers(ctx context.Context, pagination model.Pagination) (
 	// there is no offset in cassandra
 	// so we fetch till limit + offset
 	// and return the results from offset to limit
-	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, created_at, updated_at FROM %s LIMIT %d", KeySpace+"."+models.Collections.User, pagination.Limit+pagination.Offset)
+	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, is_multi_factor_auth_enabled, created_at, updated_at FROM %s LIMIT %d", KeySpace+"."+models.Collections.User, pagination.Limit+pagination.Offset)
 
 	scanner := p.db.Query(query).Iter().Scanner()
 	counter := int64(0)
 	for scanner.Next() {
 		if counter >= pagination.Offset {
 			var user models.User
-			err := scanner.Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.CreatedAt, &user.UpdatedAt)
+			err := scanner.Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.IsMultiFactorAuthEnabled, &user.CreatedAt, &user.UpdatedAt)
 			if err != nil {
 				return nil, err
 			}
@@ -197,8 +196,8 @@ func (p *provider) ListUsers(ctx context.Context, pagination model.Pagination) (
 // GetUserByEmail to get user information from database using email address
 func (p *provider) GetUserByEmail(ctx context.Context, email string) (models.User, error) {
 	var user models.User
-	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, created_at, updated_at FROM %s WHERE email = '%s' LIMIT 1 ALLOW FILTERING", KeySpace+"."+models.Collections.User, email)
+	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, is_multi_factor_auth_enabled, created_at, updated_at FROM %s WHERE email = '%s' LIMIT 1 ALLOW FILTERING", KeySpace+"."+models.Collections.User, email)
-	err := p.db.Query(query).Consistency(gocql.One).Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.CreatedAt, &user.UpdatedAt)
+	err := p.db.Query(query).Consistency(gocql.One).Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.IsMultiFactorAuthEnabled, &user.CreatedAt, &user.UpdatedAt)
 	if err != nil {
 		return user, err
 	}
@@ -208,10 +207,95 @@ func (p *provider) GetUserByEmail(ctx context.Context, email string) (models.Use
 // GetUserByID to get user information from database using user ID
 func (p *provider) GetUserByID(ctx context.Context, id string) (models.User, error) {
 	var user models.User
-	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, created_at, updated_at FROM %s WHERE id = '%s' LIMIT 1", KeySpace+"."+models.Collections.User, id)
+	query := fmt.Sprintf("SELECT id, email, email_verified_at, password, signup_methods, given_name, family_name, middle_name, nickname, birthdate, phone_number, phone_number_verified_at, picture, roles, revoked_timestamp, is_multi_factor_auth_enabled, created_at, updated_at FROM %s WHERE id = '%s' LIMIT 1", KeySpace+"."+models.Collections.User, id)
-	err := p.db.Query(query).Consistency(gocql.One).Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.CreatedAt, &user.UpdatedAt)
+	err := p.db.Query(query).Consistency(gocql.One).Scan(&user.ID, &user.Email, &user.EmailVerifiedAt, &user.Password, &user.SignupMethods, &user.GivenName, &user.FamilyName, &user.MiddleName, &user.Nickname, &user.Birthdate, &user.PhoneNumber, &user.PhoneNumberVerifiedAt, &user.Picture, &user.Roles, &user.RevokedTimestamp, &user.IsMultiFactorAuthEnabled, &user.CreatedAt, &user.UpdatedAt)
 	if err != nil {
 		return user, err
 	}
 	return user, nil
 }
+
+// UpdateUsers to update multiple users, with parameters of user IDs slice
+// If ids set to nil / empty all the users will be updated
+func (p *provider) UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error {
+	// set updated_at time for all users
+	data["updated_at"] = time.Now().Unix()
+
+	updateFields := ""
+	for key, value := range data {
+		if key == "_id" {
+			continue
+		}
+
+		if key == "_key" {
+			continue
+		}
+
+		if value == nil {
+			updateFields += fmt.Sprintf("%s = null,", key)
+			continue
+		}
+
+		valueType := reflect.TypeOf(value)
+		if valueType.Name() == "string" {
+			updateFields += fmt.Sprintf("%s = '%s', ", key, value.(string))
+		} else {
+			updateFields += fmt.Sprintf("%s = %v, ", key, value)
+		}
+	}
+	updateFields = strings.Trim(updateFields, " ")
+	updateFields = strings.TrimSuffix(updateFields, ",")
+
+	query := ""
+	if ids != nil && len(ids) > 0 {
+		idsString := ""
+		for _, id := range ids {
+			idsString += fmt.Sprintf("'%s', ", id)
+		}
+		idsString = strings.Trim(idsString, " ")
+		idsString = strings.TrimSuffix(idsString, ",")
+		query = fmt.Sprintf("UPDATE %s SET %s WHERE id IN (%s)", KeySpace+"."+models.Collections.User, updateFields, idsString)
+		err := p.db.Query(query).Exec()
+		if err != nil {
+			return err
+		}
+	} else {
+		// get all ids
+		getUserIDsQuery := fmt.Sprintf(`SELECT id FROM %s`, KeySpace+"."+models.Collections.User)
+		scanner := p.db.Query(getUserIDsQuery).Iter().Scanner()
+		// only 100 ids are allowed in 1 query
+		// hence we need create multiple update queries
+		idsString := ""
+		idsStringArray := []string{idsString}
+		counter := 1
+		for scanner.Next() {
+			var id string
+			err := scanner.Scan(&id)
+			if err == nil {
+				idsString += fmt.Sprintf("'%s', ", id)
+			}
+			counter++
+			if counter > 100 {
+				idsStringArray = append(idsStringArray, idsString)
+				counter = 1
+				idsString = ""
+			} else {
+				// update the last index of array when count is less than 100
+				idsStringArray[len(idsStringArray)-1] = idsString
+			}
+		}
+
+		for _, idStr := range idsStringArray {
+			idStr = strings.Trim(idStr, " ")
+			idStr = strings.TrimSuffix(idStr, ",")
+			query = fmt.Sprintf("UPDATE %s SET %s WHERE id IN (%s)", KeySpace+"."+models.Collections.User, updateFields, idStr)
+			err := p.db.Query(query).Exec()
+			if err != nil {
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}

server/db/providers/mongodb/email_template.go

@@ -0,0 +1,115 @@
+package mongodb
+
+import (
+	"context"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/google/uuid"
+	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/mongo/options"
+)
+
+// AddEmailTemplate to add EmailTemplate
+func (p *provider) AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	if emailTemplate.ID == "" {
+		emailTemplate.ID = uuid.New().String()
+	}
+
+	emailTemplate.Key = emailTemplate.ID
+	emailTemplate.CreatedAt = time.Now().Unix()
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	_, err := emailTemplateCollection.InsertOne(ctx, emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// UpdateEmailTemplate to update EmailTemplate
+func (p *provider) UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	_, err := emailTemplateCollection.UpdateOne(ctx, bson.M{"_id": bson.M{"$eq": emailTemplate.ID}}, bson.M{"$set": emailTemplate}, options.MergeUpdateOptions())
+	if err != nil {
+		return nil, err
+	}
+
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// ListEmailTemplates to list EmailTemplate
+func (p *provider) ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error) {
+	var emailTemplates []*model.EmailTemplate
+	opts := options.Find()
+	opts.SetLimit(pagination.Limit)
+	opts.SetSkip(pagination.Offset)
+	opts.SetSort(bson.M{"created_at": -1})
+
+	paginationClone := pagination
+
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	count, err := emailTemplateCollection.CountDocuments(ctx, bson.M{}, options.Count())
+	if err != nil {
+		return nil, err
+	}
+
+	paginationClone.Total = count
+
+	cursor, err := emailTemplateCollection.Find(ctx, bson.M{}, opts)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	for cursor.Next(ctx) {
+		var emailTemplate models.EmailTemplate
+		err := cursor.Decode(&emailTemplate)
+		if err != nil {
+			return nil, err
+		}
+		emailTemplates = append(emailTemplates, emailTemplate.AsAPIEmailTemplate())
+	}
+
+	return &model.EmailTemplates{
+		Pagination:     &paginationClone,
+		EmailTemplates: emailTemplates,
+	}, nil
+}
+
+// GetEmailTemplateByID to get EmailTemplate by id
+func (p *provider) GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	err := emailTemplateCollection.FindOne(ctx, bson.M{"_id": emailTemplateID}).Decode(&emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// GetEmailTemplateByEventName to get EmailTemplate by event_name
+func (p *provider) GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	err := emailTemplateCollection.FindOne(ctx, bson.M{"event_name": eventName}).Decode(&emailTemplate)
+	if err != nil {
+		return nil, err
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// DeleteEmailTemplate to delete EmailTemplate
+func (p *provider) DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error {
+	emailTemplateCollection := p.db.Collection(models.Collections.EmailTemplate, options.Collection())
+	_, err := emailTemplateCollection.DeleteOne(nil, bson.M{"_id": emailTemplate.ID}, options.Delete())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

server/db/providers/mongodb/otp.go

@@ -0,0 +1,70 @@
+package mongodb
+
+import (
+	"context"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/google/uuid"
+	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/mongo/options"
+)
+
+// UpsertOTP to add or update otp
+func (p *provider) UpsertOTP(ctx context.Context, otpParam *models.OTP) (*models.OTP, error) {
+	otp, _ := p.GetOTPByEmail(ctx, otpParam.Email)
+	shouldCreate := false
+	if otp == nil {
+		id := uuid.NewString()
+		otp = &models.OTP{
+			ID:        id,
+			Key:       id,
+			Otp:       otpParam.Otp,
+			Email:     otpParam.Email,
+			ExpiresAt: otpParam.ExpiresAt,
+			CreatedAt: time.Now().Unix(),
+		}
+		shouldCreate = true
+	} else {
+		otp.Otp = otpParam.Otp
+		otp.ExpiresAt = otpParam.ExpiresAt
+	}
+	otp.UpdatedAt = time.Now().Unix()
+	otpCollection := p.db.Collection(models.Collections.OTP, options.Collection())
+
+	var err error
+	if shouldCreate {
+		_, err = otpCollection.InsertOne(ctx, otp)
+	} else {
+		_, err = otpCollection.UpdateOne(ctx, bson.M{"_id": bson.M{"$eq": otp.ID}}, bson.M{"$set": otp}, options.MergeUpdateOptions())
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return otp, nil
+}
+
+// GetOTPByEmail to get otp for a given email address
+func (p *provider) GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error) {
+	var otp models.OTP
+
+	otpCollection := p.db.Collection(models.Collections.OTP, options.Collection())
+	err := otpCollection.FindOne(ctx, bson.M{"email": emailAddress}).Decode(&otp)
+	if err != nil {
+		return nil, err
+	}
+
+	return &otp, nil
+}
+
+// DeleteOTP to delete otp
+func (p *provider) DeleteOTP(ctx context.Context, otp *models.OTP) error {
+	otpCollection := p.db.Collection(models.Collections.OTP, options.Collection())
+	_, err := otpCollection.DeleteOne(nil, bson.M{"_id": otp.ID}, options.Delete())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

server/db/providers/mongodb/provider.go

@@ -101,6 +101,24 @@ func NewProvider() (*provider, error) {
 		},
 	}, options.CreateIndexes())
 
+	mongodb.CreateCollection(ctx, models.Collections.EmailTemplate, options.CreateCollection())
+	emailTemplateCollection := mongodb.Collection(models.Collections.EmailTemplate, options.Collection())
+	emailTemplateCollection.Indexes().CreateMany(ctx, []mongo.IndexModel{
+		{
+			Keys:    bson.M{"event_name": 1},
+			Options: options.Index().SetUnique(true).SetSparse(true),
+		},
+	}, options.CreateIndexes())
+
+	mongodb.CreateCollection(ctx, models.Collections.OTP, options.CreateCollection())
+	otpCollection := mongodb.Collection(models.Collections.OTP, options.Collection())
+	otpCollection.Indexes().CreateMany(ctx, []mongo.IndexModel{
+		{
+			Keys:    bson.M{"email": 1},
+			Options: options.Index().SetUnique(true).SetSparse(true),
+		},
+	}, options.CreateIndexes())
+
 	return &provider{
 		db: mongodb,
 	}, nil

server/db/providers/mongodb/user.go

@@ -9,7 +9,9 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/google/uuid"
+	log "github.com/sirupsen/logrus"
 	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/mongo"
 	"go.mongodb.org/mongo-driver/mongo/options"
 )
 
@@ -129,3 +131,27 @@ func (p *provider) GetUserByID(ctx context.Context, id string) (models.User, err
 
 	return user, nil
 }
+
+// UpdateUsers to update multiple users, with parameters of user IDs slice
+// If ids set to nil / empty all the users will be updated
+func (p *provider) UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error {
+	// set updated_at time for all users
+	data["updated_at"] = time.Now().Unix()
+
+	userCollection := p.db.Collection(models.Collections.User, options.Collection())
+
+	var res *mongo.UpdateResult
+	var err error
+	if ids != nil && len(ids) > 0 {
+		res, err = userCollection.UpdateMany(ctx, bson.M{"_id": bson.M{"$in": ids}}, bson.M{"$set": data})
+	} else {
+		res, err = userCollection.UpdateMany(ctx, bson.M{}, bson.M{"$set": data})
+	}
+
+	if err != nil {
+		return err
+	} else {
+		log.Info("Updated users: ", res.ModifiedCount)
+	}
+	return nil
+}

server/db/providers/provider_template/email_template.go

@@ -0,0 +1,48 @@
+package provider_template
+
+import (
+	"context"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/google/uuid"
+)
+
+// AddEmailTemplate to add EmailTemplate
+func (p *provider) AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	if emailTemplate.ID == "" {
+		emailTemplate.ID = uuid.New().String()
+	}
+
+	emailTemplate.Key = emailTemplate.ID
+	emailTemplate.CreatedAt = time.Now().Unix()
+	emailTemplate.UpdatedAt = time.Now().Unix()
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// UpdateEmailTemplate to update EmailTemplate
+func (p *provider) UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	emailTemplate.UpdatedAt = time.Now().Unix()
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// ListEmailTemplates to list EmailTemplate
+func (p *provider) ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error) {
+	return nil, nil
+}
+
+// GetEmailTemplateByID to get EmailTemplate by id
+func (p *provider) GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error) {
+	return nil, nil
+}
+
+// GetEmailTemplateByEventName to get EmailTemplate by event_name
+func (p *provider) GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error) {
+	return nil, nil
+}
+
+// DeleteEmailTemplate to delete EmailTemplate
+func (p *provider) DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error {
+	return nil
+}

server/db/providers/provider_template/otp.go

@@ -0,0 +1,22 @@
+package provider_template
+
+import (
+	"context"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+)
+
+// UpsertOTP to add or update otp
+func (p *provider) UpsertOTP(ctx context.Context, otp *models.OTP) (*models.OTP, error) {
+	return nil, nil
+}
+
+// GetOTPByEmail to get otp for a given email address
+func (p *provider) GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error) {
+	return nil, nil
+}
+
+// DeleteOTP to delete otp
+func (p *provider) DeleteOTP(ctx context.Context, otp *models.OTP) error {
+	return nil
+}

server/db/providers/provider_template/user.go

@@ -60,3 +60,12 @@ func (p *provider) GetUserByID(ctx context.Context, id string) (models.User, err
 
 	return user, nil
 }
+
+// UpdateUsers to update multiple users, with parameters of user IDs slice
+// If ids set to nil / empty all the users will be updated
+func (p *provider) UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error {
+	// set updated_at time for all users
+	data["updated_at"] = time.Now().Unix()
+
+	return nil
+}

server/db/providers/providers.go

@@ -20,6 +20,9 @@ type Provider interface {
 	GetUserByEmail(ctx context.Context, email string) (models.User, error)
 	// GetUserByID to get user information from database using user ID
 	GetUserByID(ctx context.Context, id string) (models.User, error)
+	// UpdateUsers to update multiple users, with parameters of user IDs slice
+	// If ids set to nil / empty all the users will be updated
+	UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error
 
 	// AddVerification to save verification request in database
 	AddVerificationRequest(ctx context.Context, verificationRequest models.VerificationRequest) (models.VerificationRequest, error)
@@ -59,4 +62,24 @@ type Provider interface {
 	AddWebhookLog(ctx context.Context, webhookLog models.WebhookLog) (*model.WebhookLog, error)
 	// ListWebhookLogs to list webhook logs
 	ListWebhookLogs(ctx context.Context, pagination model.Pagination, webhookID string) (*model.WebhookLogs, error)
+
+	// AddEmailTemplate to add EmailTemplate
+	AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error)
+	// UpdateEmailTemplate to update EmailTemplate
+	UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error)
+	// ListEmailTemplates to list EmailTemplate
+	ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error)
+	// GetEmailTemplateByID to get EmailTemplate by id
+	GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error)
+	// GetEmailTemplateByEventName to get EmailTemplate by event_name
+	GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error)
+	// DeleteEmailTemplate to delete EmailTemplate
+	DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error
+
+	// UpsertOTP to add or update otp
+	UpsertOTP(ctx context.Context, otp *models.OTP) (*models.OTP, error)
+	// GetOTPByEmail to get otp for a given email address
+	GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error)
+	// DeleteOTP to delete otp
+	DeleteOTP(ctx context.Context, otp *models.OTP) error
 }

server/db/providers/sql/email_template.go

@@ -0,0 +1,100 @@
+package sql
+
+import (
+	"context"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/google/uuid"
+)
+
+// AddEmailTemplate to add EmailTemplate
+func (p *provider) AddEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	if emailTemplate.ID == "" {
+		emailTemplate.ID = uuid.New().String()
+	}
+
+	emailTemplate.Key = emailTemplate.ID
+	emailTemplate.CreatedAt = time.Now().Unix()
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	res := p.db.Create(&emailTemplate)
+	if res.Error != nil {
+		return nil, res.Error
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// UpdateEmailTemplate to update EmailTemplate
+func (p *provider) UpdateEmailTemplate(ctx context.Context, emailTemplate models.EmailTemplate) (*model.EmailTemplate, error) {
+	emailTemplate.UpdatedAt = time.Now().Unix()
+
+	res := p.db.Save(&emailTemplate)
+	if res.Error != nil {
+		return nil, res.Error
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// ListEmailTemplates to list EmailTemplate
+func (p *provider) ListEmailTemplate(ctx context.Context, pagination model.Pagination) (*model.EmailTemplates, error) {
+	var emailTemplates []models.EmailTemplate
+
+	result := p.db.Limit(int(pagination.Limit)).Offset(int(pagination.Offset)).Order("created_at DESC").Find(&emailTemplates)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+
+	var total int64
+	totalRes := p.db.Model(&models.EmailTemplate{}).Count(&total)
+	if totalRes.Error != nil {
+		return nil, totalRes.Error
+	}
+
+	paginationClone := pagination
+	paginationClone.Total = total
+
+	responseEmailTemplates := []*model.EmailTemplate{}
+	for _, w := range emailTemplates {
+		responseEmailTemplates = append(responseEmailTemplates, w.AsAPIEmailTemplate())
+	}
+	return &model.EmailTemplates{
+		Pagination:     &paginationClone,
+		EmailTemplates: responseEmailTemplates,
+	}, nil
+}
+
+// GetEmailTemplateByID to get EmailTemplate by id
+func (p *provider) GetEmailTemplateByID(ctx context.Context, emailTemplateID string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+
+	result := p.db.Where("id = ?", emailTemplateID).First(&emailTemplate)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// GetEmailTemplateByEventName to get EmailTemplate by event_name
+func (p *provider) GetEmailTemplateByEventName(ctx context.Context, eventName string) (*model.EmailTemplate, error) {
+	var emailTemplate models.EmailTemplate
+
+	result := p.db.Where("event_name = ?", eventName).First(&emailTemplate)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return emailTemplate.AsAPIEmailTemplate(), nil
+}
+
+// DeleteEmailTemplate to delete EmailTemplate
+func (p *provider) DeleteEmailTemplate(ctx context.Context, emailTemplate *model.EmailTemplate) error {
+	result := p.db.Delete(&models.EmailTemplate{
+		ID: emailTemplate.ID,
+	})
+	if result.Error != nil {
+		return result.Error
+	}
+
+	return nil
+}

server/db/providers/sql/otp.go

@@ -0,0 +1,53 @@
+package sql
+
+import (
+	"context"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/google/uuid"
+	"gorm.io/gorm/clause"
+)
+
+// UpsertOTP to add or update otp
+func (p *provider) UpsertOTP(ctx context.Context, otp *models.OTP) (*models.OTP, error) {
+	if otp.ID == "" {
+		otp.ID = uuid.New().String()
+	}
+
+	otp.Key = otp.ID
+	otp.CreatedAt = time.Now().Unix()
+	otp.UpdatedAt = time.Now().Unix()
+
+	res := p.db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "email"}},
+		DoUpdates: clause.AssignmentColumns([]string{"otp", "expires_at", "updated_at"}),
+	}).Create(&otp)
+	if res.Error != nil {
+		return nil, res.Error
+	}
+
+	return otp, nil
+}
+
+// GetOTPByEmail to get otp for a given email address
+func (p *provider) GetOTPByEmail(ctx context.Context, emailAddress string) (*models.OTP, error) {
+	var otp models.OTP
+
+	result := p.db.Where("email = ?", emailAddress).First(&otp)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return &otp, nil
+}
+
+// DeleteOTP to delete otp
+func (p *provider) DeleteOTP(ctx context.Context, otp *models.OTP) error {
+	result := p.db.Delete(&models.OTP{
+		ID: otp.ID,
+	})
+	if result.Error != nil {
+		return result.Error
+	}
+	return nil
+}

server/db/providers/sql/provider.go

@@ -40,6 +40,7 @@ func NewProvider() (*provider, error) {
 		NamingStrategy: schema.NamingStrategy{
 			TablePrefix: models.Prefix,
 		},
+		AllowGlobalUpdate: true,
 	}
 
 	dbType := memorystore.RequiredEnvStoreObj.GetRequiredEnv().DatabaseType
@@ -60,7 +61,7 @@ func NewProvider() (*provider, error) {
 		return nil, err
 	}
 
-	err = sqlDB.AutoMigrate(&models.User{}, &models.VerificationRequest{}, &models.Session{}, &models.Env{}, &models.Webhook{}, models.WebhookLog{})
+	err = sqlDB.AutoMigrate(&models.User{}, &models.VerificationRequest{}, &models.Session{}, &models.Env{}, &models.Webhook{}, models.WebhookLog{}, models.EmailTemplate{}, &models.OTP{})
 	if err != nil {
 		return nil, err
 	}

server/db/providers/sql/user.go

@@ -9,6 +9,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/google/uuid"
+	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 )
 
@@ -121,3 +122,22 @@ func (p *provider) GetUserByID(ctx context.Context, id string) (models.User, err
 
 	return user, nil
 }
+
+// UpdateUsers to update multiple users, with parameters of user IDs slice
+// If ids set to nil / empty all the users will be updated
+func (p *provider) UpdateUsers(ctx context.Context, data map[string]interface{}, ids []string) error {
+	// set updated_at time for all users
+	data["updated_at"] = time.Now().Unix()
+
+	var res *gorm.DB
+	if ids != nil && len(ids) > 0 {
+		res = p.db.Model(&models.User{}).Where("id in ?", ids).Updates(data)
+	} else {
+		res = p.db.Model(&models.User{}).Updates(data)
+	}
+
+	if res.Error != nil {
+		return res.Error
+	}
+	return nil
+}

server/email/invite_email.go

@@ -70,7 +70,7 @@ func InviteEmail(toEmail, token, verificationURL, redirectURI string) error {
                                                                                         <tr style="background: rgb(249,250,251);padding: 10px;margin-bottom:10px;border-radius:5px;">
                                                                                             <td class="esd-block-text es-m-txt-c es-p15t" align="center" style="padding:10px;padding-bottom:30px;">
                                                                                                 <p>Hi there 👋</p>
-                                                                                                <p>Join us! You are invited to sign-up for <b>{{.org_name}}</b>. Please accept the invitation by clicking the clicking the button below.</p> <br/>
+                                                                                                <p>Join us! You are invited to sign-up for <b>{{.org_name}}</b>. Please accept the invitation by clicking the button below.</p> <br/>
                                                                                                 <a 
                                                                                                 clicktracking="off" href="{{.verification_url}}" class="es-button" target="_blank" style="text-decoration: none;padding:10px 15px;background-color: rgba(59,130,246,1);color: #fff;font-size: 1em;border-radius:5px;">Get Started</a>
                                                                                             </td>

server/email/otp.go

@@ -0,0 +1,118 @@
+package email
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+)
+
+// SendOtpMail to send otp email
+func SendOtpMail(toEmail, otp string) error {
+	// The receiver needs to be in slice as the receive supports multiple receiver
+	Receiver := []string{toEmail}
+
+	Subject := "OTP for your multi factor authentication"
+	message := `
+	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+    <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">
+        <head>
+            <meta charset="UTF-8">
+            <meta content="width=device-width, initial-scale=1" name="viewport">
+            <meta name="x-apple-disable-message-reformatting">
+            <meta http-equiv="X-UA-Compatible" content="IE=edge">
+            <meta content="telephone=no" name="format-detection">
+            <title></title>
+            <!--[if (mso 16)]>
+            <style type="text/css">
+            a {}
+            </style>
+            <![endif]-->
+            <!--[if gte mso 9]><style>sup { font-size: 100%% !important; }</style><![endif]-->
+            <!--[if gte mso 9]>
+        <xml>
+            <o:OfficeDocumentSettings>
+            <o:AllowPNG></o:AllowPNG>
+            <o:PixelsPerInch>96</o:PixelsPerInch>
+            </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+        </head>
+        <body style="font-family: sans-serif;">
+            <div class="es-wrapper-color">
+                <!--[if gte mso 9]>
+                    <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
+                        <v:fill type="tile" color="#ffffff"></v:fill>
+                    </v:background>
+                <![endif]-->
+                <table class="es-wrapper" width="100%%" cellspacing="0" cellpadding="0">
+                    <tbody>
+                        <tr>
+                            <td class="esd-email-paddings" valign="top">
+                                <table class="es-content esd-footer-popover" cellspacing="0" cellpadding="0" align="center">
+                                    <tbody>
+                                        <tr>
+                                            <td class="esd-stripe" align="center">
+                                                <table class="es-content-body" style="border-left:1px solid transparent;border-right:1px solid transparent;border-top:1px solid transparent;border-bottom:1px solid transparent;padding:20px 0px;" width="600" cellspacing="0" cellpadding="0" bgcolor="#ffffff" align="center">
+                                                    <tbody>
+                                                        <tr>
+                                                            <td class="esd-structure es-p20t es-p40b es-p40r es-p40l" esd-custom-block-id="8537" align="left">
+                                                                <table width="100%%" cellspacing="0" cellpadding="0">
+                                                                    <tbody>
+                                                                        <tr>
+                                                                            <td class="esd-container-frame" width="518" align="left">
+                                                                                <table width="100%%" cellspacing="0" cellpadding="0">
+                                                                                    <tbody>
+                                                                                        <tr>
+                                                                                            <td class="esd-block-image es-m-txt-c es-p5b" style="font-size:0;padding:10px" align="center"><a target="_blank" clicktracking="off"><img src="{{.org_logo}}" alt="icon" style="display: block;" title="icon" width="30"></a></td>
+                                                                                        </tr>
+                                                                                        
+                                                                                        <tr style="background: rgb(249,250,251);padding: 10px;margin-bottom:10px;border-radius:5px;">
+                                                                                            <td class="esd-block-text es-m-txt-c es-p15t" align="center" style="padding:10px;padding-bottom:30px;">
+                                                                                                <p>Hey there 👋</p>
+                                                                                                <b>{{.otp}}</b> is your one time password (OTP) for accessing {{.org_name}}. Please keep your OTP confidential and it will expire in 1 minute.
+                                                                                            </td>
+                                                                                        </tr>
+                                                                                    </tbody>
+                                                                                </table>
+                                                                            </td>
+                                                                        </tr>
+                                                                    </tbody>
+                                                                </table>
+                                                            </td>
+                                                        </tr>
+                                                    </tbody>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </tbody>
+                                </table>
+                            </td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+            <div style="position: absolute; left: -9999px; top: -9999px; margin: 0px;"></div>
+        </body>
+    </html>
+	`
+	data := make(map[string]interface{}, 3)
+	var err error
+	data["org_logo"], err = memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyOrganizationLogo)
+	if err != nil {
+		return err
+	}
+	data["org_name"], err = memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyOrganizationName)
+	if err != nil {
+		return err
+	}
+	data["otp"] = otp
+	message = addEmailTemplate(message, data, "otp.tmpl")
+	// bodyMessage := sender.WriteHTMLEmail(Receiver, Subject, message)
+
+	err = SendMail(Receiver, Subject, message)
+	if err != nil {
+		log.Warn("error sending email: ", err)
+	}
+	return err
+}

server/env/env.go

@@ -84,6 +84,8 @@ func InitAllEnv() error {
 	osDisableSignUp := os.Getenv(constants.EnvKeyDisableSignUp)
 	osDisableRedisForEnv := os.Getenv(constants.EnvKeyDisableRedisForEnv)
 	osDisableStrongPassword := os.Getenv(constants.EnvKeyDisableStrongPassword)
+	osEnforceMultiFactorAuthentication := os.Getenv(constants.EnvKeyEnforceMultiFactorAuthentication)
+	osDisableMultiFactorAuthentication := os.Getenv(constants.EnvKeyDisableMultiFactorAuthentication)
 
 	// os slice vars
 	osAllowedOrigins := os.Getenv(constants.EnvKeyAllowedOrigins)
@@ -490,10 +492,49 @@ func InitAllEnv() error {
 		}
 	}
 
+	if _, ok := envData[constants.EnvKeyEnforceMultiFactorAuthentication]; !ok {
+		envData[constants.EnvKeyEnforceMultiFactorAuthentication] = osEnforceMultiFactorAuthentication == "true"
+	}
+	if osEnforceMultiFactorAuthentication != "" {
+		boolValue, err := strconv.ParseBool(osEnforceMultiFactorAuthentication)
+		if err != nil {
+			return err
+		}
+		if boolValue != envData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) {
+			envData[constants.EnvKeyEnforceMultiFactorAuthentication] = boolValue
+		}
+	}
+
+	if _, ok := envData[constants.EnvKeyDisableMultiFactorAuthentication]; !ok {
+		envData[constants.EnvKeyDisableMultiFactorAuthentication] = osDisableMultiFactorAuthentication == "true"
+	}
+	if osDisableMultiFactorAuthentication != "" {
+		boolValue, err := strconv.ParseBool(osDisableMultiFactorAuthentication)
+		if err != nil {
+			return err
+		}
+		if boolValue != envData[constants.EnvKeyDisableMultiFactorAuthentication].(bool) {
+			envData[constants.EnvKeyDisableMultiFactorAuthentication] = boolValue
+		}
+	}
+
 	// no need to add nil check as its already done above
 	if envData[constants.EnvKeySmtpHost] == "" || envData[constants.EnvKeySmtpUsername] == "" || envData[constants.EnvKeySmtpPassword] == "" || envData[constants.EnvKeySenderEmail] == "" && envData[constants.EnvKeySmtpPort] == "" {
 		envData[constants.EnvKeyDisableEmailVerification] = true
 		envData[constants.EnvKeyDisableMagicLinkLogin] = true
+		envData[constants.EnvKeyIsEmailServiceEnabled] = false
+	}
+
+	if envData[constants.EnvKeySmtpHost] != "" || envData[constants.EnvKeySmtpUsername] != "" || envData[constants.EnvKeySmtpPassword] != "" || envData[constants.EnvKeySenderEmail] != "" && envData[constants.EnvKeySmtpPort] != "" {
+		envData[constants.EnvKeyIsEmailServiceEnabled] = true
+	}
+
+	if envData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) && !envData[constants.EnvKeyIsEmailServiceEnabled].(bool) {
+		return errors.New("to enable multi factor authentication, please enable email service")
+	}
+
+	if !envData[constants.EnvKeyIsEmailServiceEnabled].(bool) {
+		envData[constants.EnvKeyDisableMultiFactorAuthentication] = true
 	}
 
 	if envData[constants.EnvKeyDisableEmailVerification].(bool) {

server/env/persist_env.go

@@ -201,7 +201,7 @@ func PersistEnv() error {
 				envValue := strings.TrimSpace(os.Getenv(key))
 				if envValue != "" {
 					switch key {
-					case constants.EnvKeyIsProd, constants.EnvKeyDisableBasicAuthentication, constants.EnvKeyDisableEmailVerification, constants.EnvKeyDisableLoginPage, constants.EnvKeyDisableMagicLinkLogin, constants.EnvKeyDisableSignUp, constants.EnvKeyDisableRedisForEnv, constants.EnvKeyDisableStrongPassword:
+					case constants.EnvKeyIsProd, constants.EnvKeyDisableBasicAuthentication, constants.EnvKeyDisableEmailVerification, constants.EnvKeyDisableLoginPage, constants.EnvKeyDisableMagicLinkLogin, constants.EnvKeyDisableSignUp, constants.EnvKeyDisableRedisForEnv, constants.EnvKeyDisableStrongPassword, constants.EnvKeyIsEmailServiceEnabled, constants.EnvKeyEnforceMultiFactorAuthentication, constants.EnvKeyDisableMultiFactorAuthentication:
 						if envValueBool, err := strconv.ParseBool(envValue); err == nil {
 							if value.(bool) != envValueBool {
 								storeData[key] = envValueBool
@@ -221,6 +221,8 @@ func PersistEnv() error {
 		// handle derivative cases like disabling email verification & magic login
 		// in case SMTP is off but env is set to true
 		if storeData[constants.EnvKeySmtpHost] == "" || storeData[constants.EnvKeySmtpUsername] == "" || storeData[constants.EnvKeySmtpPassword] == "" || storeData[constants.EnvKeySenderEmail] == "" && storeData[constants.EnvKeySmtpPort] == "" {
+			storeData[constants.EnvKeyIsEmailServiceEnabled] = false
+
 			if !storeData[constants.EnvKeyDisableEmailVerification].(bool) {
 				storeData[constants.EnvKeyDisableEmailVerification] = true
 				hasChanged = true

server/go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/gin-gonic/gin v1.7.2
 	github.com/go-playground/validator/v10 v10.8.0 // indirect
 	github.com/go-redis/redis/v8 v8.11.0
-	github.com/gocql/gocql v1.0.0
+	github.com/gocql/gocql v1.2.0
 	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0

server/go.sum

@@ -110,8 +110,8 @@ github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfC
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/gocql/gocql v1.0.0 h1:UnbTERpP72VZ/viKE1Q1gPtmLvyTZTvuAstvSRydw/c=
+github.com/gocql/gocql v1.2.0 h1:TZhsCd7fRuye4VyHr3WCvWwIQaZUmjsqnSIXK9FcVCE=
-github.com/gocql/gocql v1.0.0/go.mod h1:3gM2c4D3AnkISwBxGnMMsS8Oy4y2lhbPRsH4xnJrHG8=
+github.com/gocql/gocql v1.2.0/go.mod h1:3gM2c4D3AnkISwBxGnMMsS8Oy4y2lhbPRsH4xnJrHG8=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=

server/graph/model/models_gen.go

@@ -2,6 +2,11 @@
 
 package model
 
+type AddEmailTemplateRequest struct {
+	EventName string `json:"event_name"`
+	Template  string `json:"template"`
+}
+
 type AddWebhookRequest struct {
 	EventName string                 `json:"event_name"`
 	Endpoint  string                 `json:"endpoint"`
@@ -19,6 +24,7 @@ type AdminSignupInput struct {
 
 type AuthResponse struct {
 	Message             string  `json:"message"`
+	ShouldShowOtpScreen *bool   `json:"should_show_otp_screen"`
 	AccessToken         *string `json:"access_token"`
 	IDToken             *string `json:"id_token"`
 	RefreshToken        *string `json:"refresh_token"`
@@ -26,10 +32,27 @@ type AuthResponse struct {
 	User                *User   `json:"user"`
 }
 
+type DeleteEmailTemplateRequest struct {
+	ID string `json:"id"`
+}
+
 type DeleteUserInput struct {
 	Email string `json:"email"`
 }
 
+type EmailTemplate struct {
+	ID        string `json:"id"`
+	EventName string `json:"event_name"`
+	Template  string `json:"template"`
+	CreatedAt *int64 `json:"created_at"`
+	UpdatedAt *int64 `json:"updated_at"`
+}
+
+type EmailTemplates struct {
+	Pagination     *Pagination      `json:"pagination"`
+	EmailTemplates []*EmailTemplate `json:"EmailTemplates"`
+}
+
 type Env struct {
 	AccessTokenExpiryTime            *string  `json:"ACCESS_TOKEN_EXPIRY_TIME"`
 	AdminSecret                      *string  `json:"ADMIN_SECRET"`
@@ -63,6 +86,8 @@ type Env struct {
 	DisableSignUp                    bool     `json:"DISABLE_SIGN_UP"`
 	DisableRedisForEnv               bool     `json:"DISABLE_REDIS_FOR_ENV"`
 	DisableStrongPassword            bool     `json:"DISABLE_STRONG_PASSWORD"`
+	DisableMultiFactorAuthentication bool     `json:"DISABLE_MULTI_FACTOR_AUTHENTICATION"`
+	EnforceMultiFactorAuthentication bool     `json:"ENFORCE_MULTI_FACTOR_AUTHENTICATION"`
 	Roles                            []string `json:"ROLES"`
 	ProtectedRoles                   []string `json:"PROTECTED_ROLES"`
 	DefaultRoles                     []string `json:"DEFAULT_ROLES"`
@@ -140,6 +165,7 @@ type Meta struct {
 	IsMagicLinkLoginEnabled      bool   `json:"is_magic_link_login_enabled"`
 	IsSignUpEnabled              bool   `json:"is_sign_up_enabled"`
 	IsStrongPasswordEnabled      bool   `json:"is_strong_password_enabled"`
+	IsMultiFactorAuthEnabled     bool   `json:"is_multi_factor_auth_enabled"`
 }
 
 type OAuthRevokeInput struct {
@@ -162,6 +188,10 @@ type PaginationInput struct {
 	Page  *int64 `json:"page"`
 }
 
+type ResendOTPRequest struct {
+	Email string `json:"email"`
+}
+
 type ResendVerifyEmailInput struct {
 	Email      string `json:"email"`
 	Identifier string `json:"identifier"`
@@ -197,6 +227,7 @@ type SignUpInput struct {
 	Roles                    []string `json:"roles"`
 	Scope                    []string `json:"scope"`
 	RedirectURI              *string  `json:"redirect_uri"`
+	IsMultiFactorAuthEnabled *bool    `json:"is_multi_factor_auth_enabled"`
 }
 
 type TestEndpointRequest struct {
@@ -207,13 +238,19 @@ type TestEndpointRequest struct {
 
 type TestEndpointResponse struct {
 	HTTPStatus *int64  `json:"http_status"`
-	Response   map[string]interface{} `json:"response"`
+	Response   *string `json:"response"`
 }
 
 type UpdateAccessInput struct {
 	UserID string `json:"user_id"`
 }
 
+type UpdateEmailTemplateRequest struct {
+	ID        string  `json:"id"`
+	EventName *string `json:"event_name"`
+	Template  *string `json:"template"`
+}
+
 type UpdateEnvInput struct {
 	AccessTokenExpiryTime            *string  `json:"ACCESS_TOKEN_EXPIRY_TIME"`
 	AdminSecret                      *string  `json:"ADMIN_SECRET"`
@@ -238,6 +275,8 @@ type UpdateEnvInput struct {
 	DisableSignUp                    *bool    `json:"DISABLE_SIGN_UP"`
 	DisableRedisForEnv               *bool    `json:"DISABLE_REDIS_FOR_ENV"`
 	DisableStrongPassword            *bool    `json:"DISABLE_STRONG_PASSWORD"`
+	DisableMultiFactorAuthentication *bool    `json:"DISABLE_MULTI_FACTOR_AUTHENTICATION"`
+	EnforceMultiFactorAuthentication *bool    `json:"ENFORCE_MULTI_FACTOR_AUTHENTICATION"`
 	Roles                            []string `json:"ROLES"`
 	ProtectedRoles                   []string `json:"PROTECTED_ROLES"`
 	DefaultRoles                     []string `json:"DEFAULT_ROLES"`
@@ -269,6 +308,7 @@ type UpdateProfileInput struct {
 	Birthdate                *string `json:"birthdate"`
 	PhoneNumber              *string `json:"phone_number"`
 	Picture                  *string `json:"picture"`
+	IsMultiFactorAuthEnabled *bool   `json:"is_multi_factor_auth_enabled"`
 }
 
 type UpdateUserInput struct {
@@ -284,6 +324,7 @@ type UpdateUserInput struct {
 	PhoneNumber              *string   `json:"phone_number"`
 	Picture                  *string   `json:"picture"`
 	Roles                    []*string `json:"roles"`
+	IsMultiFactorAuthEnabled *bool     `json:"is_multi_factor_auth_enabled"`
 }
 
 type UpdateWebhookRequest struct {
@@ -313,6 +354,7 @@ type User struct {
 	CreatedAt                *int64   `json:"created_at"`
 	UpdatedAt                *int64   `json:"updated_at"`
 	RevokedTimestamp         *int64   `json:"revoked_timestamp"`
+	IsMultiFactorAuthEnabled *bool    `json:"is_multi_factor_auth_enabled"`
 }
 
 type Users struct {
@@ -351,6 +393,11 @@ type VerifyEmailInput struct {
 	Token string `json:"token"`
 }
 
+type VerifyOTPRequest struct {
+	Email string `json:"email"`
+	Otp   string `json:"otp"`
+}
+
 type Webhook struct {
 	ID        string                 `json:"id"`
 	EventName *string                `json:"event_name"`

server/graph/schema.graphqls

@@ -25,6 +25,7 @@ type Meta {
 	is_magic_link_login_enabled: Boolean!
 	is_sign_up_enabled: Boolean!
 	is_strong_password_enabled: Boolean!
+	is_multi_factor_auth_enabled: Boolean!
 }
 
 type User {
@@ -47,6 +48,7 @@ type User {
 	created_at: Int64
 	updated_at: Int64
 	revoked_timestamp: Int64
+	is_multi_factor_auth_enabled: Boolean
 }
 
 type Users {
@@ -78,6 +80,7 @@ type Error {
 
 type AuthResponse {
 	message: String!
+	should_show_otp_screen: Boolean
 	access_token: String
 	id_token: String
 	refresh_token: String
@@ -122,6 +125,8 @@ type Env {
 	DISABLE_SIGN_UP: Boolean!
 	DISABLE_REDIS_FOR_ENV: Boolean!
 	DISABLE_STRONG_PASSWORD: Boolean!
+	DISABLE_MULTI_FACTOR_AUTHENTICATION: Boolean!
+	ENFORCE_MULTI_FACTOR_AUTHENTICATION: Boolean!
 	ROLES: [String!]
 	PROTECTED_ROLES: [String!]
 	DEFAULT_ROLES: [String!]
@@ -150,6 +155,54 @@ type GenerateJWTKeysResponse {
 	private_key: String
 }
 
+type Webhook {
+	id: ID!
+	event_name: String
+	endpoint: String
+	enabled: Boolean
+	headers: Map
+	created_at: Int64
+	updated_at: Int64
+}
+
+type Webhooks {
+	pagination: Pagination!
+	webhooks: [Webhook!]!
+}
+
+type WebhookLog {
+	id: ID!
+	http_status: Int64
+	response: String
+	request: String
+	webhook_id: ID
+	created_at: Int64
+	updated_at: Int64
+}
+
+type TestEndpointResponse {
+	http_status: Int64
+	response: String
+}
+
+type WebhookLogs {
+	pagination: Pagination!
+	webhook_logs: [WebhookLog!]!
+}
+
+type EmailTemplate {
+	id: ID!
+	event_name: String!
+	template: String!
+	created_at: Int64
+	updated_at: Int64
+}
+
+type EmailTemplates {
+	pagination: Pagination!
+	EmailTemplates: [EmailTemplate!]!
+}
+
 input UpdateEnvInput {
 	ACCESS_TOKEN_EXPIRY_TIME: String
 	ADMIN_SECRET: String
@@ -174,6 +227,8 @@ input UpdateEnvInput {
 	DISABLE_SIGN_UP: Boolean
 	DISABLE_REDIS_FOR_ENV: Boolean
 	DISABLE_STRONG_PASSWORD: Boolean
+	DISABLE_MULTI_FACTOR_AUTHENTICATION: Boolean
+	ENFORCE_MULTI_FACTOR_AUTHENTICATION: Boolean
 	ROLES: [String!]
 	PROTECTED_ROLES: [String!]
 	DEFAULT_ROLES: [String!]
@@ -215,6 +270,7 @@ input SignUpInput {
 	roles: [String!]
 	scope: [String!]
 	redirect_uri: String
+	is_multi_factor_auth_enabled: Boolean
 }
 
 input LoginInput {
@@ -246,6 +302,7 @@ input UpdateProfileInput {
 	birthdate: String
 	phone_number: String
 	picture: String
+	is_multi_factor_auth_enabled: Boolean
 }
 
 input UpdateUserInput {
@@ -261,6 +318,7 @@ input UpdateUserInput {
 	phone_number: String
 	picture: String
 	roles: [String]
+	is_multi_factor_auth_enabled: Boolean
 }
 
 input ForgotPasswordInput {
@@ -324,36 +382,6 @@ input GenerateJWTKeysInput {
 	type: String!
 }
 
-type Webhook {
-	id: ID!
-	event_name: String
-	endpoint: String
-	enabled: Boolean
-	headers: Map
-	created_at: Int64
-	updated_at: Int64
-}
-
-type Webhooks {
-	pagination: Pagination!
-	webhooks: [Webhook!]!
-}
-
-type WebhookLog {
-	id: ID!
-	http_status: Int64
-	response: String
-	request: String
-	webhook_id: ID
-	created_at: Int64
-	updated_at: Int64
-}
-
-type TestEndpointResponse {
-	http_status: Int64
-	response: Map
-}
-
 input ListWebhookLogRequest {
 	pagination: PaginationInput
 	webhook_id: String
@@ -384,9 +412,28 @@ input TestEndpointRequest {
 	headers: Map
 }
 
-type WebhookLogs {
+input AddEmailTemplateRequest {
-	pagination: Pagination!
+	event_name: String!
-	webhook_logs: [WebhookLog!]!
+	template: String!
+}
+
+input UpdateEmailTemplateRequest {
+	id: ID!
+	event_name: String
+	template: String
+}
+
+input DeleteEmailTemplateRequest {
+	id: ID!
+}
+
+input VerifyOTPRequest {
+	email: String!
+	otp: String!
+}
+
+input ResendOTPRequest {
+	email: String!
 }
 
 type Mutation {
@@ -400,6 +447,8 @@ type Mutation {
 	forgot_password(params: ForgotPasswordInput!): Response!
 	reset_password(params: ResetPasswordInput!): Response!
 	revoke(params: OAuthRevokeInput!): Response!
+	verify_otp(params: VerifyOTPRequest!): AuthResponse!
+	resend_otp(params: ResendOTPRequest!): Response!
 	# admin only apis
 	_delete_user(params: DeleteUserInput!): Response!
 	_update_user(params: UpdateUserInput!): User!
@@ -415,6 +464,9 @@ type Mutation {
 	_update_webhook(params: UpdateWebhookRequest!): Response!
 	_delete_webhook(params: WebhookRequest!): Response!
 	_test_endpoint(params: TestEndpointRequest!): TestEndpointResponse!
+	_add_email_template(params: AddEmailTemplateRequest!): Response!
+	_update_email_template(params: UpdateEmailTemplateRequest!): Response!
+	_delete_email_template(params: DeleteEmailTemplateRequest!): Response!
 }
 
 type Query {
@@ -430,4 +482,5 @@ type Query {
 	_webhook(params: WebhookRequest!): Webhook!
 	_webhooks(params: PaginatedInput): Webhooks!
 	_webhook_logs(params: ListWebhookLogRequest): WebhookLogs!
+	_email_templates(params: PaginatedInput): EmailTemplates!
 }

server/graph/schema.resolvers.go

@@ -51,6 +51,14 @@ func (r *mutationResolver) Revoke(ctx context.Context, params model.OAuthRevokeI
 	return resolvers.RevokeResolver(ctx, params)
 }
 
+func (r *mutationResolver) VerifyOtp(ctx context.Context, params model.VerifyOTPRequest) (*model.AuthResponse, error) {
+	return resolvers.VerifyOtpResolver(ctx, params)
+}
+
+func (r *mutationResolver) ResendOtp(ctx context.Context, params model.ResendOTPRequest) (*model.Response, error) {
+	return resolvers.ResendOTPResolver(ctx, params)
+}
+
 func (r *mutationResolver) DeleteUser(ctx context.Context, params model.DeleteUserInput) (*model.Response, error) {
 	return resolvers.DeleteUserResolver(ctx, params)
 }
@@ -107,6 +115,18 @@ func (r *mutationResolver) TestEndpoint(ctx context.Context, params model.TestEn
 	return resolvers.TestEndpointResolver(ctx, params)
 }
 
+func (r *mutationResolver) AddEmailTemplate(ctx context.Context, params model.AddEmailTemplateRequest) (*model.Response, error) {
+	return resolvers.AddEmailTemplateResolver(ctx, params)
+}
+
+func (r *mutationResolver) UpdateEmailTemplate(ctx context.Context, params model.UpdateEmailTemplateRequest) (*model.Response, error) {
+	return resolvers.UpdateEmailTemplateResolver(ctx, params)
+}
+
+func (r *mutationResolver) DeleteEmailTemplate(ctx context.Context, params model.DeleteEmailTemplateRequest) (*model.Response, error) {
+	return resolvers.DeleteEmailTemplateResolver(ctx, params)
+}
+
 func (r *queryResolver) Meta(ctx context.Context) (*model.Meta, error) {
 	return resolvers.MetaResolver(ctx)
 }
@@ -151,6 +171,10 @@ func (r *queryResolver) WebhookLogs(ctx context.Context, params *model.ListWebho
 	return resolvers.WebhookLogsResolver(ctx, params)
 }
 
+func (r *queryResolver) EmailTemplates(ctx context.Context, params *model.PaginatedInput) (*model.EmailTemplates, error) {
+	return resolvers.EmailTemplatesResolver(ctx, params)
+}
+
 // Mutation returns generated.MutationResolver implementation.
 func (r *Resolver) Mutation() generated.MutationResolver { return &mutationResolver{r} }
 

server/handlers/oauth_callback.go

@@ -320,12 +320,60 @@ func processGithubUserInfo(code string) (models.User, error) {
 	}
 
 	picture := userRawData["avatar_url"]
+	email := userRawData["email"]
+
+	if email == "" {
+		type GithubUserEmails struct {
+			Email   string `json:"email"`
+			Primary bool   `json:"primary"`
+		}
+
+		// fetch using /users/email endpoint
+		req, err := http.NewRequest("GET", constants.GithubUserEmails, nil)
+		if err != nil {
+			log.Debug("Failed to create github emails request: ", err)
+			return user, fmt.Errorf("error creating github user info request: %s", err.Error())
+		}
+		req.Header = http.Header{
+			"Authorization": []string{fmt.Sprintf("token %s", oauth2Token.AccessToken)},
+		}
+
+		response, err := client.Do(req)
+		if err != nil {
+			log.Debug("Failed to request github user email: ", err)
+			return user, err
+		}
+
+		defer response.Body.Close()
+		body, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			log.Debug("Failed to read github user email response body: ", err)
+			return user, fmt.Errorf("failed to read github response body: %s", err.Error())
+		}
+		if response.StatusCode >= 400 {
+			log.Debug("Failed to request github user email: ", string(body))
+			return user, fmt.Errorf("failed to request github user info: %s", string(body))
+		}
+
+		emailData := []GithubUserEmails{}
+		err = json.Unmarshal(body, &emailData)
+		if err != nil {
+			log.Debug("Failed to parse github user email: ", err)
+		}
+
+		for _, userEmail := range emailData {
+			email = userEmail.Email
+			if userEmail.Primary {
+				break
+			}
+		}
+	}
 
 	user = models.User{
 		GivenName:  &firstName,
 		FamilyName: &lastName,
 		Picture:    &picture,
-		Email:      userRawData["email"],
+		Email:      email,
 	}
 
 	return user, nil

server/memorystore/memory_store.go

@@ -31,6 +31,9 @@ func InitMemStore() error {
 		constants.EnvKeyDisableLoginPage:                 false,
 		constants.EnvKeyDisableSignUp:                    false,
 		constants.EnvKeyDisableStrongPassword:            false,
+		constants.EnvKeyIsEmailServiceEnabled:            false,
+		constants.EnvKeyEnforceMultiFactorAuthentication: false,
+		constants.EnvKeyDisableMultiFactorAuthentication: false,
 	}
 
 	requiredEnvs := RequiredEnvStoreObj.GetRequiredEnv()

server/memorystore/providers/inmemory/stores/session_store.go

@@ -39,6 +39,7 @@ func (s *SessionStore) Set(key string, subKey, value string) {
 func (s *SessionStore) RemoveAll(key string) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
+
 	delete(s.store, key)
 }
 
@@ -53,6 +54,9 @@ func (s *SessionStore) Remove(key, subKey string) {
 
 // Get all the values for given key
 func (s *SessionStore) GetAll(key string) map[string]string {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
 	if _, ok := s.store[key]; !ok {
 		s.store[key] = make(map[string]string)
 	}
@@ -63,6 +67,7 @@ func (s *SessionStore) GetAll(key string) map[string]string {
 func (s *SessionStore) RemoveByNamespace(namespace string) error {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
+
 	for key := range s.store {
 		if strings.Contains(key, namespace+":") {
 			delete(s.store, key)

server/memorystore/providers/redis/store.go

@@ -160,7 +160,7 @@ func (c *provider) GetEnvStore() (map[string]interface{}, error) {
 		return nil, err
 	}
 	for key, value := range data {
-		if key == constants.EnvKeyDisableBasicAuthentication || key == constants.EnvKeyDisableEmailVerification || key == constants.EnvKeyDisableLoginPage || key == constants.EnvKeyDisableMagicLinkLogin || key == constants.EnvKeyDisableRedisForEnv || key == constants.EnvKeyDisableSignUp || key == constants.EnvKeyDisableStrongPassword {
+		if key == constants.EnvKeyDisableBasicAuthentication || key == constants.EnvKeyDisableEmailVerification || key == constants.EnvKeyDisableLoginPage || key == constants.EnvKeyDisableMagicLinkLogin || key == constants.EnvKeyDisableRedisForEnv || key == constants.EnvKeyDisableSignUp || key == constants.EnvKeyDisableStrongPassword || key == constants.EnvKeyIsEmailServiceEnabled || key == constants.EnvKeyEnforceMultiFactorAuthentication || key == constants.EnvKeyDisableMultiFactorAuthentication {
 			boolValue, err := strconv.ParseBool(value)
 			if err != nil {
 				return res, err

server/refs/bool.go

@@ -0,0 +1,14 @@
+package refs
+
+// NewBoolRef returns a reference to a bool with given value
+func NewBoolRef(v bool) *bool {
+	return &v
+}
+
+// BoolValue returns the value of the given bool ref
+func BoolValue(r *bool) bool {
+	if r == nil {
+		return false
+	}
+	return *r
+}

server/refs/int.go

@@ -0,0 +1,14 @@
+package refs
+
+// NewInt64Ref returns a reference to a int64 with given value
+func NewInt64Ref(v int64) *int64 {
+	return &v
+}
+
+// Int64Value returns the value of the given bool ref
+func Int64Value(r *int64) int64 {
+	if r == nil {
+		return 0
+	}
+	return *r
+}

server/refs/string.go

@@ -1,4 +1,4 @@
-package utils
+package refs
 
 // NewStringRef returns a reference to a string with given value
 func NewStringRef(v string) *string {
@@ -16,15 +16,4 @@ func StringValue(r *string, defaultValue ...string) string {
 	return ""
 }
 
-// NewBoolRef returns a reference to a bool with given value
-func NewBoolRef(v bool) *bool {
-	return &v
-}
 
-// BoolValue returns the value of the given bool ref
-func BoolValue(r *bool) bool {
-	if r == nil {
-		return false
-	}
-	return *r
-}

server/resolvers/add_email_template.go

@@ -0,0 +1,53 @@
+package resolvers
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/token"
+	"github.com/authorizerdev/authorizer/server/utils"
+	"github.com/authorizerdev/authorizer/server/validators"
+	log "github.com/sirupsen/logrus"
+)
+
+// TODO add template validator
+
+// AddEmailTemplateResolver resolver for add email template mutation
+func AddEmailTemplateResolver(ctx context.Context, params model.AddEmailTemplateRequest) (*model.Response, error) {
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		log.Debug("Failed to get GinContext: ", err)
+		return nil, err
+	}
+
+	if !token.IsSuperAdmin(gc) {
+		log.Debug("Not logged in as super admin")
+		return nil, fmt.Errorf("unauthorized")
+	}
+
+	if !validators.IsValidEmailTemplateEventName(params.EventName) {
+		log.Debug("Invalid Event Name: ", params.EventName)
+		return nil, fmt.Errorf("invalid event name %s", params.EventName)
+	}
+
+	if strings.TrimSpace(params.Template) == "" {
+		return nil, fmt.Errorf("empty template not allowed")
+	}
+
+	_, err = db.Provider.AddEmailTemplate(ctx, models.EmailTemplate{
+		EventName: params.EventName,
+		Template:  params.Template,
+	})
+	if err != nil {
+		log.Debug("Failed to add email template: ", err)
+		return nil, err
+	}
+
+	return &model.Response{
+		Message: `Email template added successfully`,
+	}, nil
+}

server/resolvers/add_webhook.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/db/models"
@@ -32,6 +33,11 @@ func AddWebhookResolver(ctx context.Context, params model.AddWebhookRequest) (*m
 		return nil, fmt.Errorf("invalid event name %s", params.EventName)
 	}
 
+	if strings.TrimSpace(params.Endpoint) == "" {
+		log.Debug("empty endpoint not allowed")
+		return nil, fmt.Errorf("empty endpoint not allowed")
+	}
+
 	headerBytes, err := json.Marshal(params.Headers)
 	if err != nil {
 		return nil, err

server/resolvers/delete_email_template.go

@@ -0,0 +1,49 @@
+package resolvers
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/token"
+	"github.com/authorizerdev/authorizer/server/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+// DeleteEmailTemplateResolver resolver to delete email template and its relevant logs
+func DeleteEmailTemplateResolver(ctx context.Context, params model.DeleteEmailTemplateRequest) (*model.Response, error) {
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		log.Debug("Failed to get GinContext: ", err)
+		return nil, err
+	}
+
+	if !token.IsSuperAdmin(gc) {
+		log.Debug("Not logged in as super admin")
+		return nil, fmt.Errorf("unauthorized")
+	}
+
+	if params.ID == "" {
+		log.Debug("email template is required")
+		return nil, fmt.Errorf("email template ID required")
+	}
+
+	log := log.WithField("email_template_id", params.ID)
+
+	emailTemplate, err := db.Provider.GetEmailTemplateByID(ctx, params.ID)
+	if err != nil {
+		log.Debug("failed to get email template: ", err)
+		return nil, err
+	}
+
+	err = db.Provider.DeleteEmailTemplate(ctx, emailTemplate)
+	if err != nil {
+		log.Debug("failed to delete email template: ", err)
+		return nil, err
+	}
+
+	return &model.Response{
+		Message: "Email templated deleted successfully",
+	}, nil
+}

server/resolvers/email_templates.go

@@ -0,0 +1,35 @@
+package resolvers
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/token"
+	"github.com/authorizerdev/authorizer/server/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+// EmailTemplatesResolver resolver for getting the list of email templates based on pagination
+func EmailTemplatesResolver(ctx context.Context, params *model.PaginatedInput) (*model.EmailTemplates, error) {
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		log.Debug("Failed to get GinContext: ", err)
+		return nil, err
+	}
+
+	if !token.IsSuperAdmin(gc) {
+		log.Debug("Not logged in as super admin")
+		return nil, fmt.Errorf("unauthorized")
+	}
+
+	pagination := utils.GetPagination(params)
+
+	emailTemplates, err := db.Provider.ListEmailTemplate(ctx, pagination)
+	if err != nil {
+		log.Debug("failed to get email templates: ", err)
+		return nil, err
+	}
+	return emailTemplates, nil
+}

server/resolvers/env.go

@@ -10,6 +10,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 )
@@ -38,10 +39,10 @@ func EnvResolver(ctx context.Context) (*model.Env, error) {
 	}
 
 	if val, ok := store[constants.EnvKeyAccessTokenExpiryTime]; ok {
-		res.AccessTokenExpiryTime = utils.NewStringRef(val.(string))
+		res.AccessTokenExpiryTime = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyAdminSecret]; ok {
-		res.AdminSecret = utils.NewStringRef(val.(string))
+		res.AdminSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyClientID]; ok {
 		res.ClientID = val.(string)
@@ -50,103 +51,103 @@ func EnvResolver(ctx context.Context) (*model.Env, error) {
 		res.ClientSecret = val.(string)
 	}
 	if val, ok := store[constants.EnvKeyDatabaseURL]; ok {
-		res.DatabaseURL = utils.NewStringRef(val.(string))
+		res.DatabaseURL = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabaseName]; ok {
-		res.DatabaseName = utils.NewStringRef(val.(string))
+		res.DatabaseName = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabaseType]; ok {
-		res.DatabaseType = utils.NewStringRef(val.(string))
+		res.DatabaseType = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabaseUsername]; ok {
-		res.DatabaseUsername = utils.NewStringRef(val.(string))
+		res.DatabaseUsername = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabasePassword]; ok {
-		res.DatabasePassword = utils.NewStringRef(val.(string))
+		res.DatabasePassword = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabaseHost]; ok {
-		res.DatabaseHost = utils.NewStringRef(val.(string))
+		res.DatabaseHost = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyDatabasePort]; ok {
-		res.DatabasePort = utils.NewStringRef(val.(string))
+		res.DatabasePort = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyCustomAccessTokenScript]; ok {
-		res.CustomAccessTokenScript = utils.NewStringRef(val.(string))
+		res.CustomAccessTokenScript = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeySmtpHost]; ok {
-		res.SMTPHost = utils.NewStringRef(val.(string))
+		res.SMTPHost = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeySmtpPort]; ok {
-		res.SMTPPort = utils.NewStringRef(val.(string))
+		res.SMTPPort = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeySmtpUsername]; ok {
-		res.SMTPUsername = utils.NewStringRef(val.(string))
+		res.SMTPUsername = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeySmtpPassword]; ok {
-		res.SMTPPassword = utils.NewStringRef(val.(string))
+		res.SMTPPassword = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeySenderEmail]; ok {
-		res.SenderEmail = utils.NewStringRef(val.(string))
+		res.SenderEmail = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyJwtType]; ok {
-		res.JwtType = utils.NewStringRef(val.(string))
+		res.JwtType = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyJwtSecret]; ok {
-		res.JwtSecret = utils.NewStringRef(val.(string))
+		res.JwtSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyJwtRoleClaim]; ok {
-		res.JwtRoleClaim = utils.NewStringRef(val.(string))
+		res.JwtRoleClaim = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyJwtPublicKey]; ok {
-		res.JwtPublicKey = utils.NewStringRef(val.(string))
+		res.JwtPublicKey = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyJwtPrivateKey]; ok {
-		res.JwtPrivateKey = utils.NewStringRef(val.(string))
+		res.JwtPrivateKey = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyAppURL]; ok {
-		res.AppURL = utils.NewStringRef(val.(string))
+		res.AppURL = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyRedisURL]; ok {
-		res.RedisURL = utils.NewStringRef(val.(string))
+		res.RedisURL = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyResetPasswordURL]; ok {
-		res.ResetPasswordURL = utils.NewStringRef(val.(string))
+		res.ResetPasswordURL = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyGoogleClientID]; ok {
-		res.GoogleClientID = utils.NewStringRef(val.(string))
+		res.GoogleClientID = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyGoogleClientSecret]; ok {
-		res.GoogleClientSecret = utils.NewStringRef(val.(string))
+		res.GoogleClientSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyFacebookClientID]; ok {
-		res.FacebookClientID = utils.NewStringRef(val.(string))
+		res.FacebookClientID = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyFacebookClientSecret]; ok {
-		res.FacebookClientSecret = utils.NewStringRef(val.(string))
+		res.FacebookClientSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyGithubClientID]; ok {
-		res.GithubClientID = utils.NewStringRef(val.(string))
+		res.GithubClientID = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyGithubClientSecret]; ok {
-		res.GithubClientSecret = utils.NewStringRef(val.(string))
+		res.GithubClientSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyLinkedInClientID]; ok {
-		res.LinkedinClientID = utils.NewStringRef(val.(string))
+		res.LinkedinClientID = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyLinkedInClientSecret]; ok {
-		res.LinkedinClientSecret = utils.NewStringRef(val.(string))
+		res.LinkedinClientSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyAppleClientID]; ok {
-		res.AppleClientID = utils.NewStringRef(val.(string))
+		res.AppleClientID = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyAppleClientSecret]; ok {
-		res.AppleClientSecret = utils.NewStringRef(val.(string))
+		res.AppleClientSecret = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyOrganizationName]; ok {
-		res.OrganizationName = utils.NewStringRef(val.(string))
+		res.OrganizationName = refs.NewStringRef(val.(string))
 	}
 	if val, ok := store[constants.EnvKeyOrganizationLogo]; ok {
-		res.OrganizationLogo = utils.NewStringRef(val.(string))
+		res.OrganizationLogo = refs.NewStringRef(val.(string))
 	}
 
 	// string slice vars
@@ -169,6 +170,8 @@ func EnvResolver(ctx context.Context) (*model.Env, error) {
 	res.DisableLoginPage = store[constants.EnvKeyDisableLoginPage].(bool)
 	res.DisableSignUp = store[constants.EnvKeyDisableSignUp].(bool)
 	res.DisableStrongPassword = store[constants.EnvKeyDisableStrongPassword].(bool)
+	res.EnforceMultiFactorAuthentication = store[constants.EnvKeyEnforceMultiFactorAuthentication].(bool)
+	res.DisableMultiFactorAuthentication = store[constants.EnvKeyDisableMultiFactorAuthentication].(bool)
 
 	return res, nil
 }

server/resolvers/invite_members.go

@@ -16,6 +16,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/authorizerdev/authorizer/server/parsers"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -35,13 +36,13 @@ func InviteMembersResolver(ctx context.Context, params model.InviteMemberInput)
 	}
 
 	// this feature is only allowed if email server is configured
-	isEmailVerificationDisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableEmailVerification)
+	EnvKeyIsEmailServiceEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyIsEmailServiceEnabled)
 	if err != nil {
 		log.Debug("Error getting email verification disabled: ", err)
-		isEmailVerificationDisabled = true
+		EnvKeyIsEmailServiceEnabled = false
 	}
 
-	if isEmailVerificationDisabled {
+	if !EnvKeyIsEmailServiceEnabled {
 		log.Debug("Email server is not configured")
 		return nil, errors.New("email sending is disabled")
 	}
@@ -136,6 +137,15 @@ func InviteMembersResolver(ctx context.Context, params model.InviteMemberInput)
 			user.SignupMethods = constants.AuthRecipeMethodBasicAuth
 			verificationRequest.Identifier = constants.VerificationTypeForgotPassword
 
+			isMFAEnforced, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyEnforceMultiFactorAuthentication)
+			if err != nil {
+				log.Debug("MFA service not enabled: ", err)
+				isMFAEnforced = false
+			}
+
+			if isMFAEnforced {
+				user.IsMultiFactorAuthEnabled = refs.NewBoolRef(true)
+			}
 			verifyEmailURL = appURL + "/setup-password"
 
 		}

server/resolvers/login.go

@@ -13,8 +13,10 @@ import (
 	"github.com/authorizerdev/authorizer/server/cookie"
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/email"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -97,6 +99,42 @@ func LoginResolver(ctx context.Context, params model.LoginInput) (*model.AuthRes
 		scope = params.Scope
 	}
 
+	isEmailServiceEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyIsEmailServiceEnabled)
+	if err != nil || !isEmailServiceEnabled {
+		log.Debug("Email service not enabled: ", err)
+	}
+
+	isMFADisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableMultiFactorAuthentication)
+	if err != nil || !isEmailServiceEnabled {
+		log.Debug("MFA service not enabled: ", err)
+	}
+
+	// If email service is not enabled continue the process in any way
+	if refs.BoolValue(user.IsMultiFactorAuthEnabled) && isEmailServiceEnabled && !isMFADisabled {
+		otp := utils.GenerateOTP()
+		otpData, err := db.Provider.UpsertOTP(ctx, &models.OTP{
+			Email:     user.Email,
+			Otp:       otp,
+			ExpiresAt: time.Now().Add(1 * time.Minute).Unix(),
+		})
+		if err != nil {
+			log.Debug("Failed to add otp: ", err)
+			return nil, err
+		}
+
+		go func() {
+			err := email.SendOtpMail(user.Email, otpData.Otp)
+			if err != nil {
+				log.Debug("Failed to send otp email: ", err)
+			}
+		}()
+
+		return &model.AuthResponse{
+			Message:             "Please check the OTP in your inbox",
+			ShouldShowOtpScreen: refs.NewBoolRef(true),
+		}, nil
+	}
+
 	authToken, err := token.CreateAuthToken(gc, user, roles, scope, constants.AuthRecipeMethodBasicAuth)
 	if err != nil {
 		log.Debug("Failed to create auth token", err)

server/resolvers/meta.go

@@ -107,6 +107,12 @@ func MetaResolver(ctx context.Context) (*model.Meta, error) {
 		isSignUpDisabled = true
 	}
 
+	isMultiFactorAuthenticationEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableMultiFactorAuthentication)
+	if err != nil {
+		log.Debug("Failed to get Disable Multi Factor Authentication from environment variable", err)
+		isSignUpDisabled = true
+	}
+
 	metaInfo := model.Meta{
 		Version:                      constants.VERSION,
 		ClientID:                     clientID,
@@ -120,6 +126,7 @@ func MetaResolver(ctx context.Context) (*model.Meta, error) {
 		IsMagicLinkLoginEnabled:      !isMagicLinkLoginDisabled,
 		IsSignUpEnabled:              !isSignUpDisabled,
 		IsStrongPasswordEnabled:      !isStrongPasswordDisabled,
+		IsMultiFactorAuthEnabled:     !isMultiFactorAuthenticationEnabled,
 	}
 	return &metaInfo, nil
 }

server/resolvers/resend_otp.go

@@ -0,0 +1,96 @@
+package resolvers
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/email"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/utils"
+)
+
+// ResendOTPResolver is a resolver for resend otp mutation
+func ResendOTPResolver(ctx context.Context, params model.ResendOTPRequest) (*model.Response, error) {
+	log := log.WithFields(log.Fields{
+		"email": params.Email,
+	})
+	params.Email = strings.ToLower(params.Email)
+	user, err := db.Provider.GetUserByEmail(ctx, params.Email)
+	if err != nil {
+		log.Debug("Failed to get user by email: ", err)
+		return nil, fmt.Errorf(`user with this email not found`)
+	}
+
+	if user.RevokedTimestamp != nil {
+		log.Debug("User access is revoked")
+		return nil, fmt.Errorf(`user access has been revoked`)
+	}
+
+	if user.EmailVerifiedAt == nil {
+		log.Debug("User email is not verified")
+		return nil, fmt.Errorf(`email not verified`)
+	}
+
+	if !refs.BoolValue(user.IsMultiFactorAuthEnabled) {
+		log.Debug("User multi factor authentication is not enabled")
+		return nil, fmt.Errorf(`multi factor authentication not enabled`)
+	}
+
+	isEmailServiceEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyIsEmailServiceEnabled)
+	if err != nil || !isEmailServiceEnabled {
+		log.Debug("Email service not enabled: ", err)
+		return nil, errors.New("email service not enabled")
+	}
+
+	isMFADisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableMultiFactorAuthentication)
+	if err != nil || isMFADisabled {
+		log.Debug("MFA service not enabled: ", err)
+		return nil, errors.New("multi factor authentication is disabled for this instance")
+	}
+
+	// get otp by email
+	otpData, err := db.Provider.GetOTPByEmail(ctx, params.Email)
+	if err != nil {
+		log.Debug("Failed to get otp for given email: ", err)
+		return nil, err
+	}
+
+	if otpData == nil {
+		log.Debug("No otp found for given email: ", params.Email)
+		return &model.Response{
+			Message: "Failed to get for given email",
+		}, errors.New("failed to get otp for given email")
+	}
+
+	otp := utils.GenerateOTP()
+	otpData, err = db.Provider.UpsertOTP(ctx, &models.OTP{
+		Email:     user.Email,
+		Otp:       otp,
+		ExpiresAt: time.Now().Add(1 * time.Minute).Unix(),
+	})
+	if err != nil {
+		log.Debug("Error generating new otp: ", err)
+		return nil, err
+	}
+
+	go func() {
+		err := email.SendOtpMail(params.Email, otp)
+		if err != nil {
+			log.Debug("Error sending otp email: ", otp)
+		}
+	}()
+
+	return &model.Response{
+		Message: `OTP has been sent. Please check your inbox`,
+	}, nil
+}

server/resolvers/reset_password.go

@@ -14,6 +14,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/authorizerdev/authorizer/server/parsers"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -84,6 +85,16 @@ func ResetPasswordResolver(ctx context.Context, params model.ResetPasswordInput)
 	signupMethod := user.SignupMethods
 	if !strings.Contains(signupMethod, constants.AuthRecipeMethodBasicAuth) {
 		signupMethod = signupMethod + "," + constants.AuthRecipeMethodBasicAuth
+
+		isMFAEnforced, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyEnforceMultiFactorAuthentication)
+		if err != nil {
+			log.Debug("MFA service not enabled: ", err)
+			isMFAEnforced = false
+		}
+
+		if isMFAEnforced {
+			user.IsMultiFactorAuthEnabled = refs.NewBoolRef(true)
+		}
 	}
 	user.SignupMethods = signupMethod
 

server/resolvers/signup.go

@@ -17,6 +17,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/authorizerdev/authorizer/server/parsers"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -157,6 +158,20 @@ func SignupResolver(ctx context.Context, params model.SignUpInput) (*model.AuthR
 		user.Picture = params.Picture
 	}
 
+	if params.IsMultiFactorAuthEnabled != nil {
+		user.IsMultiFactorAuthEnabled = params.IsMultiFactorAuthEnabled
+	}
+
+	isMFAEnforced, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyEnforceMultiFactorAuthentication)
+	if err != nil {
+		log.Debug("MFA service not enabled: ", err)
+		isMFAEnforced = false
+	}
+
+	if isMFAEnforced {
+		user.IsMultiFactorAuthEnabled = refs.NewBoolRef(true)
+	}
+
 	user.SignupMethods = constants.AuthRecipeMethodBasicAuth
 	isEmailVerificationDisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableEmailVerification)
 	if err != nil {

server/resolvers/test_endpoint.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -41,8 +42,8 @@ func TestEndpointResolver(ctx context.Context, params model.TestEndpointRequest)
 		Email:         "test_endpoint@foo.com",
 		EmailVerified: true,
 		SignupMethods: constants.AuthRecipeMethodMagicLinkLogin,
-		GivenName:     utils.NewStringRef("Foo"),
+		GivenName:     refs.NewStringRef("Foo"),
-		FamilyName:    utils.NewStringRef("Bar"),
+		FamilyName:    refs.NewStringRef("Bar"),
 	}
 
 	userBytes, err := json.Marshal(user)
@@ -95,15 +96,9 @@ func TestEndpointResolver(ctx context.Context, params model.TestEndpointRequest)
 		return nil, err
 	}
 
-	response := map[string]interface{}{}
-	if err := json.Unmarshal(body, &response); err != nil {
-		log.Debug("error un-marshalling response: ", err)
-		return nil, err
-	}
-
 	statusCode := int64(resp.StatusCode)
 	return &model.TestEndpointResponse{
 		HTTPStatus: &statusCode,
-		Response:   response,
+		Response:   refs.NewStringRef(string(body)),
 	}, nil
 }

server/resolvers/update_email_template.go

@@ -0,0 +1,70 @@
+package resolvers
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/token"
+	"github.com/authorizerdev/authorizer/server/utils"
+	"github.com/authorizerdev/authorizer/server/validators"
+	log "github.com/sirupsen/logrus"
+)
+
+// TODO add template validator
+
+// UpdateEmailTemplateResolver resolver for update email template mutation
+func UpdateEmailTemplateResolver(ctx context.Context, params model.UpdateEmailTemplateRequest) (*model.Response, error) {
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		log.Debug("Failed to get GinContext: ", err)
+		return nil, err
+	}
+
+	if !token.IsSuperAdmin(gc) {
+		log.Debug("Not logged in as super admin")
+		return nil, fmt.Errorf("unauthorized")
+	}
+
+	emailTemplate, err := db.Provider.GetEmailTemplateByID(ctx, params.ID)
+	if err != nil {
+		log.Debug("failed to get email template: ", err)
+		return nil, err
+	}
+
+	emailTemplateDetails := models.EmailTemplate{
+		ID:        emailTemplate.ID,
+		Key:       emailTemplate.ID,
+		EventName: emailTemplate.EventName,
+		CreatedAt: refs.Int64Value(emailTemplate.CreatedAt),
+	}
+
+	if params.EventName != nil && emailTemplateDetails.EventName != refs.StringValue(params.EventName) {
+		if isValid := validators.IsValidEmailTemplateEventName(refs.StringValue(params.EventName)); !isValid {
+			log.Debug("invalid event name: ", refs.StringValue(params.EventName))
+			return nil, fmt.Errorf("invalid event name %s", refs.StringValue(params.EventName))
+		}
+		emailTemplateDetails.EventName = refs.StringValue(params.EventName)
+	}
+
+	if params.Template != nil && emailTemplateDetails.Template != refs.StringValue(params.Template) {
+		if strings.TrimSpace(refs.StringValue(params.Template)) == "" {
+			log.Debug("empty template not allowed")
+			return nil, fmt.Errorf("empty template not allowed")
+		}
+		emailTemplateDetails.Template = refs.StringValue(params.Template)
+	}
+
+	_, err = db.Provider.UpdateEmailTemplate(ctx, emailTemplateDetails)
+	if err != nil {
+		return nil, err
+	}
+
+	return &model.Response{
+		Message: `Email template updated successfully.`,
+	}, nil
+}

server/resolvers/update_env.go

@@ -234,6 +234,8 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
 	// handle derivative cases like disabling email verification & magic login
 	// in case SMTP is off but env is set to true
 	if updatedData[constants.EnvKeySmtpHost] == "" || updatedData[constants.EnvKeySmtpUsername] == "" || updatedData[constants.EnvKeySmtpPassword] == "" || updatedData[constants.EnvKeySenderEmail] == "" && updatedData[constants.EnvKeySmtpPort] == "" {
+		updatedData[constants.EnvKeyIsEmailServiceEnabled] = false
+		updatedData[constants.EnvKeyDisableMultiFactorAuthentication] = true
 		if !updatedData[constants.EnvKeyDisableEmailVerification].(bool) {
 			updatedData[constants.EnvKeyDisableEmailVerification] = true
 		}
@@ -243,6 +245,16 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
 		}
 	}
 
+	if updatedData[constants.EnvKeySmtpHost] != "" || updatedData[constants.EnvKeySmtpUsername] != "" || updatedData[constants.EnvKeySmtpPassword] != "" || updatedData[constants.EnvKeySenderEmail] != "" && updatedData[constants.EnvKeySmtpPort] != "" {
+		updatedData[constants.EnvKeyIsEmailServiceEnabled] = true
+	}
+
+	if !currentData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) && updatedData[constants.EnvKeyEnforceMultiFactorAuthentication].(bool) && !updatedData[constants.EnvKeyDisableMultiFactorAuthentication].(bool) {
+		go db.Provider.UpdateUsers(ctx, map[string]interface{}{
+			"is_multi_factor_auth_enabled": true,
+		}, nil)
+	}
+
 	// check the roles change
 	if len(params.Roles) > 0 {
 		if len(params.DefaultRoles) > 0 {
@@ -265,8 +277,6 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
 		}
 	}
 
-	go clearSessionIfRequired(currentData, updatedData)
-
 	// Update local store
 	memorystore.Provider.UpdateEnvStore(updatedData)
 	jwk, err := crypto.GenerateJWKBasedOnEnv()
@@ -320,6 +330,8 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
 		return res, err
 	}
 
+	go clearSessionIfRequired(currentData, updatedData)
+
 	res = &model.Response{
 		Message: "configurations updated successfully",
 	}

server/resolvers/update_profile.go

@@ -2,6 +2,7 @@ package resolvers
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -17,6 +18,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/authorizerdev/authorizer/server/parsers"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -45,7 +47,7 @@ func UpdateProfileResolver(ctx context.Context, params model.UpdateProfileInput)
 	}
 
 	// validate if all params are not empty
-	if params.GivenName == nil && params.FamilyName == nil && params.Picture == nil && params.MiddleName == nil && params.Nickname == nil && params.OldPassword == nil && params.Email == nil && params.Birthdate == nil && params.Gender == nil && params.PhoneNumber == nil {
+	if params.GivenName == nil && params.FamilyName == nil && params.Picture == nil && params.MiddleName == nil && params.Nickname == nil && params.OldPassword == nil && params.Email == nil && params.Birthdate == nil && params.Gender == nil && params.PhoneNumber == nil && params.NewPassword == nil && params.ConfirmNewPassword == nil && params.IsMultiFactorAuthEnabled == nil {
 		log.Debug("All params are empty")
 		return res, fmt.Errorf("please enter at least one param to update")
 	}
@@ -61,70 +63,131 @@ func UpdateProfileResolver(ctx context.Context, params model.UpdateProfileInput)
 		return res, err
 	}
 
-	if params.GivenName != nil && user.GivenName != params.GivenName {
+	if params.GivenName != nil && refs.StringValue(user.GivenName) != refs.StringValue(params.GivenName) {
 		user.GivenName = params.GivenName
 	}
 
-	if params.FamilyName != nil && user.FamilyName != params.FamilyName {
+	if params.FamilyName != nil && refs.StringValue(user.FamilyName) != refs.StringValue(params.FamilyName) {
 		user.FamilyName = params.FamilyName
 	}
 
-	if params.MiddleName != nil && user.MiddleName != params.MiddleName {
+	if params.MiddleName != nil && refs.StringValue(user.MiddleName) != refs.StringValue(params.MiddleName) {
 		user.MiddleName = params.MiddleName
 	}
 
-	if params.Nickname != nil && user.Nickname != params.Nickname {
+	if params.Nickname != nil && refs.StringValue(user.Nickname) != refs.StringValue(params.Nickname) {
 		user.Nickname = params.Nickname
 	}
 
-	if params.Birthdate != nil && user.Birthdate != params.Birthdate {
+	if params.Birthdate != nil && refs.StringValue(user.Birthdate) != refs.StringValue(params.Birthdate) {
 		user.Birthdate = params.Birthdate
 	}
 
-	if params.Gender != nil && user.Gender != params.Gender {
+	if params.Gender != nil && refs.StringValue(user.Gender) != refs.StringValue(params.Gender) {
 		user.Gender = params.Gender
 	}
 
-	if params.PhoneNumber != nil && user.PhoneNumber != params.PhoneNumber {
+	if params.PhoneNumber != nil && refs.StringValue(user.PhoneNumber) != refs.StringValue(params.PhoneNumber) {
 		user.PhoneNumber = params.PhoneNumber
 	}
 
-	if params.Picture != nil && user.Picture != params.Picture {
+	if params.Picture != nil && refs.StringValue(user.Picture) != refs.StringValue(params.Picture) {
 		user.Picture = params.Picture
 	}
 
-	if params.OldPassword != nil {
+	if params.IsMultiFactorAuthEnabled != nil && refs.BoolValue(user.IsMultiFactorAuthEnabled) != refs.BoolValue(params.IsMultiFactorAuthEnabled) {
-		if err = bcrypt.CompareHashAndPassword([]byte(*user.Password), []byte(*params.OldPassword)); err != nil {
+		if refs.BoolValue(params.IsMultiFactorAuthEnabled) {
-			log.Debug("Failed to compare hash and old password: ", err)
+			isEnvServiceEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyIsEmailServiceEnabled)
-			return res, fmt.Errorf("incorrect old password")
+			if err != nil || !isEnvServiceEnabled {
+				log.Debug("Email service not enabled:")
+				return nil, errors.New("email service not enabled, so cannot enable multi factor authentication")
+			}
 		}
 
-		if params.NewPassword == nil {
+		isMFAEnforced, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyEnforceMultiFactorAuthentication)
-			log.Debug("Failed to get new password: ")
+		if err != nil {
-			return res, fmt.Errorf("new password is required")
+			log.Debug("MFA service not enabled: ", err)
+			isMFAEnforced = false
 		}
 
-		if params.ConfirmNewPassword == nil {
+		if isMFAEnforced && !refs.BoolValue(params.IsMultiFactorAuthEnabled) {
-			log.Debug("Failed to get confirm new password: ")
+			log.Debug("Cannot disable mfa service as it is enforced:")
+			return nil, errors.New("cannot disable multi factor authentication as it is enforced by organization")
+		}
+
+		user.IsMultiFactorAuthEnabled = params.IsMultiFactorAuthEnabled
+	}
+
+	isPasswordChanging := false
+	if params.NewPassword != nil && params.ConfirmNewPassword == nil {
+		isPasswordChanging = true
+		log.Debug("confirm password is empty")
 		return res, fmt.Errorf("confirm password is required")
 	}
 
-		if *params.ConfirmNewPassword != *params.NewPassword {
+	if params.ConfirmNewPassword != nil && params.NewPassword == nil {
+		isPasswordChanging = true
+		log.Debug("new password is empty")
+		return res, fmt.Errorf("new password is required")
+	}
+
+	if params.NewPassword != nil && params.ConfirmNewPassword != nil {
+		isPasswordChanging = true
+	}
+
+	if isPasswordChanging && user.Password != nil && params.OldPassword == nil {
+		log.Debug("old password is empty")
+		return res, fmt.Errorf("old password is required")
+	}
+
+	if isPasswordChanging && user.Password != nil && params.OldPassword != nil {
+		if err = bcrypt.CompareHashAndPassword([]byte(refs.StringValue(user.Password)), []byte(refs.StringValue(params.OldPassword))); err != nil {
+			log.Debug("Failed to compare hash and old password: ", err)
+			return res, fmt.Errorf("incorrect old password")
+		}
+	}
+
+	shouldAddBasicSignUpMethod := false
+	isBasicAuthDisabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyDisableBasicAuthentication)
+	if err != nil {
+		log.Debug("Error getting basic auth disabled: ", err)
+		isBasicAuthDisabled = true
+	}
+
+	if params.NewPassword != nil && params.ConfirmNewPassword != nil {
+		if isBasicAuthDisabled {
+			log.Debug("Cannot update password as basic authentication is disabled")
+			return res, fmt.Errorf(`basic authentication is disabled for this instance`)
+		}
+
+		if refs.StringValue(params.ConfirmNewPassword) != refs.StringValue(params.NewPassword) {
 			log.Debug("Failed to compare new password and confirm new password")
 			return res, fmt.Errorf(`password and confirm password does not match`)
 		}
 
-		password, _ := crypto.EncryptPassword(*params.NewPassword)
+		if user.Password == nil || refs.StringValue(user.Password) == "" {
+			shouldAddBasicSignUpMethod = true
+		}
 
+		if err := validators.IsValidPassword(refs.StringValue(params.NewPassword)); err != nil {
+			log.Debug("Invalid password")
+			return res, err
+		}
+
+		password, _ := crypto.EncryptPassword(refs.StringValue(params.NewPassword))
 		user.Password = &password
+
+		if shouldAddBasicSignUpMethod {
+			user.SignupMethods = user.SignupMethods + "," + constants.AuthRecipeMethodBasicAuth
+		}
 	}
 
 	hasEmailChanged := false
 
-	if params.Email != nil && user.Email != *params.Email {
+	if params.Email != nil && user.Email != refs.StringValue(params.Email) {
 		// check if valid email
 		if !validators.IsValidEmail(*params.Email) {
-			log.Debug("Failed to validate email: ", *params.Email)
+			log.Debug("Failed to validate email: ", refs.StringValue(params.Email))
 			return res, fmt.Errorf("invalid email address")
 		}
 		newEmail := strings.ToLower(*params.Email)

server/resolvers/update_user.go

@@ -2,6 +2,7 @@ package resolvers
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -15,6 +16,7 @@ import (
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
 	"github.com/authorizerdev/authorizer/server/parsers"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -45,7 +47,7 @@ func UpdateUserResolver(ctx context.Context, params model.UpdateUserInput) (*mod
 		"user_id": params.ID,
 	})
 
-	if params.GivenName == nil && params.FamilyName == nil && params.Picture == nil && params.MiddleName == nil && params.Nickname == nil && params.Email == nil && params.Birthdate == nil && params.Gender == nil && params.PhoneNumber == nil && params.Roles == nil {
+	if params.GivenName == nil && params.FamilyName == nil && params.Picture == nil && params.MiddleName == nil && params.Nickname == nil && params.Email == nil && params.Birthdate == nil && params.Gender == nil && params.PhoneNumber == nil && params.Roles == nil && params.IsMultiFactorAuthEnabled == nil {
 		log.Debug("No params to update")
 		return res, fmt.Errorf("please enter atleast one param to update")
 	}
@@ -56,38 +58,49 @@ func UpdateUserResolver(ctx context.Context, params model.UpdateUserInput) (*mod
 		return res, fmt.Errorf(`User not found`)
 	}
 
-	if params.GivenName != nil && user.GivenName != params.GivenName {
+	if params.GivenName != nil && refs.StringValue(user.GivenName) != refs.StringValue(params.GivenName) {
 		user.GivenName = params.GivenName
 	}
 
-	if params.FamilyName != nil && user.FamilyName != params.FamilyName {
+	if params.FamilyName != nil && refs.StringValue(user.FamilyName) != refs.StringValue(params.FamilyName) {
 		user.FamilyName = params.FamilyName
 	}
 
-	if params.MiddleName != nil && user.MiddleName != params.MiddleName {
+	if params.MiddleName != nil && refs.StringValue(user.MiddleName) != refs.StringValue(params.MiddleName) {
 		user.MiddleName = params.MiddleName
 	}
 
-	if params.Nickname != nil && user.Nickname != params.Nickname {
+	if params.Nickname != nil && refs.StringValue(user.Nickname) != refs.StringValue(params.Nickname) {
 		user.Nickname = params.Nickname
 	}
 
-	if params.Birthdate != nil && user.Birthdate != params.Birthdate {
+	if params.Birthdate != nil && refs.StringValue(user.Birthdate) != refs.StringValue(params.Birthdate) {
 		user.Birthdate = params.Birthdate
 	}
 
-	if params.Gender != nil && user.Gender != params.Gender {
+	if params.Gender != nil && refs.StringValue(user.Gender) != refs.StringValue(params.Gender) {
 		user.Gender = params.Gender
 	}
 
-	if params.PhoneNumber != nil && user.PhoneNumber != params.PhoneNumber {
+	if params.PhoneNumber != nil && refs.StringValue(user.PhoneNumber) != refs.StringValue(params.PhoneNumber) {
 		user.PhoneNumber = params.PhoneNumber
 	}
 
-	if params.Picture != nil && user.Picture != params.Picture {
+	if params.Picture != nil && refs.StringValue(user.Picture) != refs.StringValue(params.Picture) {
 		user.Picture = params.Picture
 	}
 
+	if params.IsMultiFactorAuthEnabled != nil && refs.BoolValue(user.IsMultiFactorAuthEnabled) != refs.BoolValue(params.IsMultiFactorAuthEnabled) {
+		user.IsMultiFactorAuthEnabled = params.IsMultiFactorAuthEnabled
+		if refs.BoolValue(params.IsMultiFactorAuthEnabled) {
+			isEnvServiceEnabled, err := memorystore.Provider.GetBoolStoreEnvVariable(constants.EnvKeyIsEmailServiceEnabled)
+			if err != nil || !isEnvServiceEnabled {
+				log.Debug("Email service not enabled:")
+				return nil, errors.New("email service not enabled, so cannot enable multi factor authentication")
+			}
+		}
+	}
+
 	if params.EmailVerified != nil {
 		if *params.EmailVerified {
 			now := time.Now().Unix()

server/resolvers/update_webhook.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/db/models"
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/authorizerdev/authorizer/server/validators"
@@ -45,35 +47,35 @@ func UpdateWebhookResolver(ctx context.Context, params model.UpdateWebhookReques
 	webhookDetails := models.Webhook{
 		ID:        webhook.ID,
 		Key:       webhook.ID,
-		EventName: utils.StringValue(webhook.EventName),
+		EventName: refs.StringValue(webhook.EventName),
-		EndPoint:  utils.StringValue(webhook.Endpoint),
+		EndPoint:  refs.StringValue(webhook.Endpoint),
-		Enabled:   utils.BoolValue(webhook.Enabled),
+		Enabled:   refs.BoolValue(webhook.Enabled),
 		Headers:   headersString,
-		CreatedAt: *webhook.CreatedAt,
+		CreatedAt: refs.Int64Value(webhook.CreatedAt),
 	}
 
-	if params.EventName != nil && webhookDetails.EventName != utils.StringValue(params.EventName) {
+	if params.EventName != nil && webhookDetails.EventName != refs.StringValue(params.EventName) {
-		if isValid := validators.IsValidWebhookEventName(utils.StringValue(params.EventName)); !isValid {
+		if isValid := validators.IsValidWebhookEventName(refs.StringValue(params.EventName)); !isValid {
-			log.Debug("invalid event name: ", utils.StringValue(params.EventName))
+			log.Debug("invalid event name: ", refs.StringValue(params.EventName))
-			return nil, fmt.Errorf("invalid event name %s", utils.StringValue(params.EventName))
+			return nil, fmt.Errorf("invalid event name %s", refs.StringValue(params.EventName))
 		}
-		webhookDetails.EventName = utils.StringValue(params.EventName)
+		webhookDetails.EventName = refs.StringValue(params.EventName)
 	}
 
-	if params.Endpoint != nil && webhookDetails.EndPoint != utils.StringValue(params.Endpoint) {
+	if params.Endpoint != nil && webhookDetails.EndPoint != refs.StringValue(params.Endpoint) {
-		webhookDetails.EventName = utils.StringValue(params.EventName)
+		if strings.TrimSpace(refs.StringValue(params.Endpoint)) == "" {
+			log.Debug("empty endpoint not allowed")
+			return nil, fmt.Errorf("empty endpoint not allowed")
+		}
+		webhookDetails.EndPoint = refs.StringValue(params.Endpoint)
 	}
 
-	if params.Enabled != nil && webhookDetails.Enabled != utils.BoolValue(params.Enabled) {
+	if params.Enabled != nil && webhookDetails.Enabled != refs.BoolValue(params.Enabled) {
-		webhookDetails.Enabled = utils.BoolValue(params.Enabled)
+		webhookDetails.Enabled = refs.BoolValue(params.Enabled)
 	}
 
 	if params.Headers != nil {
-		for key, val := range params.Headers {
+		headerBytes, err := json.Marshal(params.Headers)
-			webhook.Headers[key] = val
-		}
-
-		headerBytes, err := json.Marshal(webhook.Headers)
 		if err != nil {
 			log.Debug("failed to marshall headers: ", err)
 			return nil, err

server/resolvers/verify_otp.go

@@ -0,0 +1,104 @@
+package resolvers
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/cookie"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/token"
+	"github.com/authorizerdev/authorizer/server/utils"
+	log "github.com/sirupsen/logrus"
+)
+
+// VerifyOtpResolver resolver for verify otp mutation
+func VerifyOtpResolver(ctx context.Context, params model.VerifyOTPRequest) (*model.AuthResponse, error) {
+	var res *model.AuthResponse
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		log.Debug("Failed to get GinContext: ", err)
+		return res, err
+	}
+
+	otp, err := db.Provider.GetOTPByEmail(ctx, params.Email)
+	if err != nil {
+		log.Debug("Failed to get otp request by email: ", err)
+		return res, fmt.Errorf(`invalid email: %s`, err.Error())
+	}
+
+	if params.Otp != otp.Otp {
+		log.Debug("Failed to verify otp request: Incorrect value")
+		return res, fmt.Errorf(`invalid otp`)
+	}
+
+	expiresIn := otp.ExpiresAt - time.Now().Unix()
+
+	if expiresIn < 0 {
+		log.Debug("Failed to verify otp request: Timeout")
+		return res, fmt.Errorf("otp expired")
+	}
+
+	user, err := db.Provider.GetUserByEmail(ctx, params.Email)
+	if err != nil {
+		log.Debug("Failed to get user by email: ", err)
+		return res, err
+	}
+
+	isSignUp := user.EmailVerifiedAt == nil
+
+	// TODO - Add Login method in DB when we introduce OTP for social media login
+	loginMethod := constants.AuthRecipeMethodBasicAuth
+
+	roles := strings.Split(user.Roles, ",")
+	scope := []string{"openid", "email", "profile"}
+	authToken, err := token.CreateAuthToken(gc, user, roles, scope, loginMethod)
+	if err != nil {
+		log.Debug("Failed to create auth token: ", err)
+		return res, err
+	}
+
+	go func() {
+		db.Provider.DeleteOTP(gc, otp)
+		if isSignUp {
+			utils.RegisterEvent(ctx, constants.UserSignUpWebhookEvent, loginMethod, user)
+		} else {
+			utils.RegisterEvent(ctx, constants.UserLoginWebhookEvent, loginMethod, user)
+		}
+
+		db.Provider.AddSession(ctx, models.Session{
+			UserID:    user.ID,
+			UserAgent: utils.GetUserAgent(gc.Request),
+			IP:        utils.GetIP(gc.Request),
+		})
+	}()
+
+	authTokenExpiresIn := authToken.AccessToken.ExpiresAt - time.Now().Unix()
+	if authTokenExpiresIn <= 0 {
+		authTokenExpiresIn = 1
+	}
+
+	res = &model.AuthResponse{
+		Message:     `OTP verified successfully.`,
+		AccessToken: &authToken.AccessToken.Token,
+		IDToken:     &authToken.IDToken.Token,
+		ExpiresIn:   &authTokenExpiresIn,
+		User:        user.AsAPIUser(),
+	}
+
+	sessionKey := loginMethod + ":" + user.ID
+	cookie.SetSession(gc, authToken.FingerPrintHash)
+	memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash)
+	memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token)
+
+	if authToken.RefreshToken != nil {
+		res.RefreshToken = &authToken.RefreshToken.Token
+		memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
+	}
+	return res, nil
+}

server/resolvers/webhook_logs.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/token"
 	"github.com/authorizerdev/authorizer/server/utils"
 	log "github.com/sirupsen/logrus"
@@ -31,7 +32,7 @@ func WebhookLogsResolver(ctx context.Context, params *model.ListWebhookLogReques
 		pagination = utils.GetPagination(&model.PaginatedInput{
 			Pagination: params.Pagination,
 		})
-		webhookID = utils.StringValue(params.WebhookID)
+		webhookID = refs.StringValue(params.WebhookID)
 	} else {
 		pagination = utils.GetPagination(nil)
 		webhookID = ""

server/resolvers/webhooks.go

@@ -28,7 +28,7 @@ func WebhooksResolver(ctx context.Context, params *model.PaginatedInput) (*model
 
 	webhooks, err := db.Provider.ListWebhook(ctx, pagination)
 	if err != nil {
-		log.Debug("failed to get webhook logs: ", err)
+		log.Debug("failed to get webhooks: ", err)
 		return nil, err
 	}
 	return webhooks, nil

server/test/add_email_template_test.go

@@ -0,0 +1,58 @@
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/crypto"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func addEmailTemplateTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run("should add email templates", func(t *testing.T) {
+		req, ctx := createContext(s)
+		adminSecret, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyAdminSecret)
+		assert.NoError(t, err)
+		h, err := crypto.EncryptPassword(adminSecret)
+		assert.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+
+		t.Run("should not add email template for invalid event type", func(t *testing.T) {
+			emailTemplate, err := resolvers.AddEmailTemplateResolver(ctx, model.AddEmailTemplateRequest{
+				EventName: "test",
+			})
+			assert.Error(t, err)
+			assert.Nil(t, emailTemplate)
+		})
+
+		t.Run("should not add email template for empty template", func(t *testing.T) {
+			emailTemplate, err := resolvers.AddEmailTemplateResolver(ctx, model.AddEmailTemplateRequest{
+				EventName: s.TestInfo.TestEmailTemplateEventTypes[0],
+				Template:  "     ",
+			})
+			assert.Error(t, err)
+			assert.Nil(t, emailTemplate)
+		})
+		for _, eventType := range s.TestInfo.TestEmailTemplateEventTypes {
+			t.Run("should add email template for "+eventType, func(t *testing.T) {
+				emailTemplate, err := resolvers.AddEmailTemplateResolver(ctx, model.AddEmailTemplateRequest{
+					EventName: eventType,
+					Template:  `Test email`,
+				})
+				assert.NoError(t, err)
+				assert.NotNil(t, emailTemplate)
+				assert.NotEmpty(t, emailTemplate.Message)
+
+				et, err := db.Provider.GetEmailTemplateByEventName(ctx, eventType)
+				assert.NoError(t, err)
+				assert.Equal(t, et.EventName, eventType)
+			})
+		}
+	})
+}

server/test/add_webhook_test.go

@@ -22,7 +22,7 @@ func addWebhookTest(t *testing.T, s TestSetup) {
 		assert.NoError(t, err)
 		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
 
-		for _, eventType := range s.TestInfo.TestEventTypes {
+		for _, eventType := range s.TestInfo.TestWebhookEventTypes {
 			webhook, err := resolvers.AddWebhookResolver(ctx, model.AddWebhookRequest{
 				EventName: eventType,
 				Endpoint:  s.TestInfo.WebhookEndpoint,

server/test/delete_email_template_test.go

@@ -0,0 +1,52 @@
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/crypto"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func deleteEmailTemplateTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run("should delete email templates", func(t *testing.T) {
+		req, ctx := createContext(s)
+		adminSecret, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyAdminSecret)
+		assert.NoError(t, err)
+		h, err := crypto.EncryptPassword(adminSecret)
+		assert.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+
+		// get all email templates
+		emailTemplates, err := db.Provider.ListEmailTemplate(ctx, model.Pagination{
+			Limit:  10,
+			Page:   1,
+			Offset: 0,
+		})
+		assert.NoError(t, err)
+
+		for _, e := range emailTemplates.EmailTemplates {
+			res, err := resolvers.DeleteEmailTemplateResolver(ctx, model.DeleteEmailTemplateRequest{
+				ID: e.ID,
+			})
+
+			assert.NoError(t, err)
+			assert.NotNil(t, res)
+			assert.NotEmpty(t, res.Message)
+		}
+
+		emailTemplates, err = db.Provider.ListEmailTemplate(ctx, model.Pagination{
+			Limit:  10,
+			Page:   1,
+			Offset: 0,
+		})
+		assert.NoError(t, err)
+		assert.Len(t, emailTemplates.EmailTemplates, 0)
+	})
+}

server/test/email_templates_test.go

@@ -0,0 +1,29 @@
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/crypto"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func emailTemplatesTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run("should get email templates", func(t *testing.T) {
+		req, ctx := createContext(s)
+		adminSecret, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyAdminSecret)
+		assert.NoError(t, err)
+		h, err := crypto.EncryptPassword(adminSecret)
+		assert.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+
+		emailTemplates, err := resolvers.EmailTemplatesResolver(ctx, nil)
+		assert.NoError(t, err)
+		assert.NotEmpty(t, emailTemplates)
+		assert.Len(t, emailTemplates.EmailTemplates, len(s.TestInfo.TestEmailTemplateEventTypes))
+	})
+}

server/test/resend_otp_test.go

@@ -0,0 +1,99 @@
+package test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func resendOTPTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run(`should resend otp`, func(t *testing.T) {
+		req, ctx := createContext(s)
+		email := "resend_otp." + s.TestInfo.Email
+		res, err := resolvers.SignupResolver(ctx, model.SignUpInput{
+			Email:           email,
+			Password:        s.TestInfo.Password,
+			ConfirmPassword: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+
+		// Login should fail as email is not verified
+		loginRes, err := resolvers.LoginResolver(ctx, model.LoginInput{
+			Email:    email,
+			Password: s.TestInfo.Password,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, loginRes)
+		verificationRequest, err := db.Provider.GetVerificationRequestByEmail(ctx, email, constants.VerificationTypeBasicAuthSignup)
+		assert.Nil(t, err)
+		assert.Equal(t, email, verificationRequest.Email)
+		verifyRes, err := resolvers.VerifyEmailResolver(ctx, model.VerifyEmailInput{
+			Token: verificationRequest.Token,
+		})
+		assert.Nil(t, err)
+		assert.NotEqual(t, verifyRes.AccessToken, "", "access token should not be empty")
+
+		// Using access token update profile
+		s.GinContext.Request.Header.Set("Authorization", "Bearer "+refs.StringValue(verifyRes.AccessToken))
+		ctx = context.WithValue(req.Context(), "GinContextKey", s.GinContext)
+		_, err = resolvers.UpdateProfileResolver(ctx, model.UpdateProfileInput{
+			IsMultiFactorAuthEnabled: refs.NewBoolRef(true),
+		})
+
+		// Resend otp should return error as no initial opt is being sent
+		resendOtpRes, err := resolvers.ResendOTPResolver(ctx, model.ResendOTPRequest{
+			Email: email,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, resendOtpRes)
+
+		// Login should not return error but access token should be empty as otp should have been sent
+		loginRes, err = resolvers.LoginResolver(ctx, model.LoginInput{
+			Email:    email,
+			Password: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, loginRes)
+		assert.Nil(t, loginRes.AccessToken)
+
+		// Get otp from db
+		otp, err := db.Provider.GetOTPByEmail(ctx, email)
+		assert.NoError(t, err)
+		assert.NotEmpty(t, otp.Otp)
+
+		// resend otp
+		resendOtpRes, err = resolvers.ResendOTPResolver(ctx, model.ResendOTPRequest{
+			Email: email,
+		})
+		assert.NoError(t, err)
+		assert.NotEmpty(t, resendOtpRes.Message)
+
+		newOtp, err := db.Provider.GetOTPByEmail(ctx, email)
+		assert.NoError(t, err)
+		assert.NotEmpty(t, newOtp.Otp)
+		assert.NotEqual(t, otp.Otp, newOtp)
+
+		// Should return error for older otp
+		verifyOtpRes, err := resolvers.VerifyOtpResolver(ctx, model.VerifyOTPRequest{
+			Email: email,
+			Otp:   otp.Otp,
+		})
+		assert.Error(t, err)
+
+		verifyOtpRes, err = resolvers.VerifyOtpResolver(ctx, model.VerifyOTPRequest{
+			Email: email,
+			Otp:   newOtp.Otp,
+		})
+		assert.NoError(t, err)
+		assert.NotEqual(t, verifyOtpRes.AccessToken, "", "access token should not be empty")
+		cleanData(email)
+	})
+}

server/test/resolvers_test.go

@@ -3,20 +3,39 @@ package test
 import (
 	"context"
 	"os"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/env"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/utils"
 )
 
 func TestResolvers(t *testing.T) {
 	databases := map[string]string{
-		constants.DbTypeSqlite: "../../data.db",
+		constants.DbTypeSqlite:   "../../test.db",
-		// constants.DbTypeArangodb: "http://localhost:8529",
+		constants.DbTypeArangodb: "http://localhost:8529",
-		// constants.DbTypeMongodb:  "mongodb://localhost:27017",
+		constants.DbTypeMongodb:  "mongodb://localhost:27017",
-		// constants.DbTypeScyllaDB: "127.0.0.1:9042",
+		constants.DbTypeScyllaDB: "127.0.0.1:9042",
+	}
+
+	testDBs := strings.Split(os.Getenv("TEST_DBS"), ",")
+	t.Log("Running tests for following dbs: ", testDBs)
+	for dbType := range databases {
+		if !utils.StringSliceContains(testDBs, dbType) {
+			delete(databases, dbType)
+		}
+	}
+
+	if utils.StringSliceContains(testDBs, constants.DbTypeSqlite) && len(testDBs) == 1 {
+		// do nothing
+	} else {
+		t.Log("waiting for docker containers to start...")
+		// wait for docker containers to spun up
+		time.Sleep(30 * time.Second)
 	}
 
 	testDb := "authorizer_test"
@@ -75,6 +94,10 @@ func TestResolvers(t *testing.T) {
 			revokeAccessTest(t, s)
 			enableAccessTest(t, s)
 			generateJWTkeyTest(t, s)
+			addEmailTemplateTest(t, s)
+			updateEmailTemplateTest(t, s)
+			emailTemplatesTest(t, s)
+			deleteEmailTemplateTest(t, s)
 
 			// user resolvers tests
 			loginTests(t, s)
@@ -91,7 +114,10 @@ func TestResolvers(t *testing.T) {
 			metaTests(t, s)
 			inviteUserTest(t, s)
 			validateJwtTokenTest(t, s)
+			verifyOTPTest(t, s)
+			resendOTPTest(t, s)
 
+			updateAllUsersTest(t, s)
 			webhookLogsTest(t, s)   // get logs after above resolver tests are done
 			deleteWebhookTest(t, s) // delete webhooks (admin resolver)
 		})

server/test/test.go

@@ -24,7 +24,8 @@ type TestData struct {
 	Email                       string
 	Password                    string
 	WebhookEndpoint             string
-	TestEventTypes  []string
+	TestWebhookEventTypes       []string
+	TestEmailTemplateEventTypes []string
 }
 
 type TestSetup struct {
@@ -56,6 +57,11 @@ func cleanData(email string) {
 		err = db.Provider.DeleteVerificationRequest(ctx, verificationRequest)
 	}
 
+	otp, err := db.Provider.GetOTPByEmail(ctx, email)
+	if err == nil {
+		err = db.Provider.DeleteOTP(ctx, otp)
+	}
+
 	dbUser, err := db.Provider.GetUserByEmail(ctx, email)
 	if err == nil {
 		db.Provider.DeleteUser(ctx, dbUser)
@@ -79,7 +85,8 @@ func testSetup() TestSetup {
 		Email:                       fmt.Sprintf("%d_authorizer_tester@yopmail.com", time.Now().Unix()),
 		Password:                    "Test@123",
 		WebhookEndpoint:             "https://62cbc6738042b16aa7c22df2.mockapi.io/api/v1/webhook",
-		TestEventTypes:  []string{constants.UserAccessEnabledWebhookEvent, constants.UserAccessRevokedWebhookEvent, constants.UserCreatedWebhookEvent, constants.UserDeletedWebhookEvent, constants.UserLoginWebhookEvent, constants.UserSignUpWebhookEvent},
+		TestWebhookEventTypes:       []string{constants.UserAccessEnabledWebhookEvent, constants.UserAccessRevokedWebhookEvent, constants.UserCreatedWebhookEvent, constants.UserDeletedWebhookEvent, constants.UserLoginWebhookEvent, constants.UserSignUpWebhookEvent},
+		TestEmailTemplateEventTypes: []string{constants.VerificationTypeBasicAuthSignup, constants.VerificationTypeForgotPassword, constants.VerificationTypeMagicLinkLogin, constants.VerificationTypeUpdateEmail},
 	}
 
 	err := os.Setenv(constants.EnvKeyEnvPath, "../../.env.test")

server/test/update_all_users_tests.go

@@ -0,0 +1,67 @@
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/db/models"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/utils"
+	"github.com/stretchr/testify/assert"
+)
+
+func updateAllUsersTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run("Should update all users", func(t *testing.T) {
+		_, ctx := createContext(s)
+
+		users := []models.User{}
+		for i := 0; i < 10; i++ {
+			user := models.User{
+				Email:         fmt.Sprintf("update_all_user_%d_%s", i, s.TestInfo.Email),
+				SignupMethods: constants.AuthRecipeMethodBasicAuth,
+				Roles:         "user",
+			}
+			users = append(users, user)
+			u, err := db.Provider.AddUser(ctx, user)
+			assert.NoError(t, err)
+			assert.NotNil(t, u)
+		}
+
+		err := db.Provider.UpdateUsers(ctx, map[string]interface{}{
+			"is_multi_factor_auth_enabled": true,
+		}, nil)
+		assert.NoError(t, err)
+
+		listUsers, err := db.Provider.ListUsers(ctx, model.Pagination{
+			Limit:  20,
+			Offset: 0,
+		})
+		assert.NoError(t, err)
+		for _, u := range listUsers.Users {
+			assert.True(t, refs.BoolValue(u.IsMultiFactorAuthEnabled))
+		}
+
+		// // update few users
+		updateIds := []string{listUsers.Users[0].ID, listUsers.Users[1].ID}
+		err = db.Provider.UpdateUsers(ctx, map[string]interface{}{
+			"is_multi_factor_auth_enabled": false,
+		}, updateIds)
+		assert.NoError(t, err)
+
+		listUsers, err = db.Provider.ListUsers(ctx, model.Pagination{
+			Limit:  20,
+			Offset: 0,
+		})
+		for _, u := range listUsers.Users {
+			if utils.StringSliceContains(updateIds, u.ID) {
+				assert.False(t, refs.BoolValue(u.IsMultiFactorAuthEnabled))
+			} else {
+				assert.True(t, refs.BoolValue(u.IsMultiFactorAuthEnabled))
+			}
+		}
+	})
+}

server/test/update_email_template_test.go

@@ -0,0 +1,46 @@
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/crypto"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func updateEmailTemplateTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run("should update email template", func(t *testing.T) {
+		req, ctx := createContext(s)
+		adminSecret, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyAdminSecret)
+		assert.NoError(t, err)
+		h, err := crypto.EncryptPassword(adminSecret)
+		assert.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+		// get email template
+		emailTemplate, err := db.Provider.GetEmailTemplateByEventName(ctx, constants.VerificationTypeBasicAuthSignup)
+		assert.NoError(t, err)
+		assert.NotNil(t, emailTemplate)
+
+		res, err := resolvers.UpdateEmailTemplateResolver(ctx, model.UpdateEmailTemplateRequest{
+			ID:       emailTemplate.ID,
+			Template: refs.NewStringRef("Updated test template"),
+		})
+
+		assert.NoError(t, err)
+		assert.NotEmpty(t, res)
+		assert.NotEmpty(t, res.Message)
+
+		updatedEmailTemplate, err := db.Provider.GetEmailTemplateByEventName(ctx, constants.VerificationTypeBasicAuthSignup)
+		assert.NoError(t, err)
+		assert.NotNil(t, updatedEmailTemplate)
+		assert.Equal(t, emailTemplate.ID, updatedEmailTemplate.ID)
+		assert.Equal(t, updatedEmailTemplate.Template, "Updated test template")
+	})
+}

server/test/update_webhook_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/resolvers"
-	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -27,12 +27,16 @@ func updateWebhookTest(t *testing.T, s TestSetup) {
 		webhook, err := db.Provider.GetWebhookByEventName(ctx, constants.UserDeletedWebhookEvent)
 		assert.NoError(t, err)
 		assert.NotNil(t, webhook)
-		webhook.Headers["x-new-test"] = "new-test"
+		// it should completely replace headers
+		webhook.Headers = map[string]interface{}{
+			"x-new-test": "test",
+		}
 
 		res, err := resolvers.UpdateWebhookResolver(ctx, model.UpdateWebhookRequest{
 			ID:       webhook.ID,
 			Headers:  webhook.Headers,
-			Enabled: utils.NewBoolRef(false),
+			Enabled:  refs.NewBoolRef(false),
+			Endpoint: refs.NewStringRef("https://sometest.com"),
 		})
 
 		assert.NoError(t, err)
@@ -43,15 +47,19 @@ func updateWebhookTest(t *testing.T, s TestSetup) {
 		assert.NoError(t, err)
 		assert.NotNil(t, updatedWebhook)
 		assert.Equal(t, webhook.ID, updatedWebhook.ID)
-		assert.Equal(t, utils.StringValue(webhook.EventName), utils.StringValue(updatedWebhook.EventName))
+		assert.Equal(t, refs.StringValue(webhook.EventName), refs.StringValue(updatedWebhook.EventName))
-		assert.Equal(t, utils.StringValue(webhook.Endpoint), utils.StringValue(updatedWebhook.Endpoint))
+		assert.Len(t, updatedWebhook.Headers, 1)
-		assert.Len(t, updatedWebhook.Headers, 2)
+		assert.False(t, refs.BoolValue(updatedWebhook.Enabled))
-		assert.False(t, utils.BoolValue(updatedWebhook.Enabled))
+		for key, val := range updatedWebhook.Headers {
+			assert.Equal(t, val, webhook.Headers[key])
+		}
+		assert.Equal(t, refs.StringValue(updatedWebhook.Endpoint), "https://sometest.com")
 
 		res, err = resolvers.UpdateWebhookResolver(ctx, model.UpdateWebhookRequest{
 			ID:       webhook.ID,
 			Headers:  webhook.Headers,
-			Enabled: utils.NewBoolRef(true),
+			Enabled:  refs.NewBoolRef(true),
+			Endpoint: refs.NewStringRef(s.TestInfo.WebhookEndpoint),
 		})
 		assert.NoError(t, err)
 		assert.NotEmpty(t, res)

server/test/verify_otp_test.go

@@ -0,0 +1,75 @@
+package test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/authorizerdev/authorizer/server/constants"
+	"github.com/authorizerdev/authorizer/server/db"
+	"github.com/authorizerdev/authorizer/server/graph/model"
+	"github.com/authorizerdev/authorizer/server/refs"
+	"github.com/authorizerdev/authorizer/server/resolvers"
+	"github.com/stretchr/testify/assert"
+)
+
+func verifyOTPTest(t *testing.T, s TestSetup) {
+	t.Helper()
+	t.Run(`should verify otp`, func(t *testing.T) {
+		req, ctx := createContext(s)
+		email := "verify_otp." + s.TestInfo.Email
+		res, err := resolvers.SignupResolver(ctx, model.SignUpInput{
+			Email:           email,
+			Password:        s.TestInfo.Password,
+			ConfirmPassword: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+
+		// Login should fail as email is not verified
+		loginRes, err := resolvers.LoginResolver(ctx, model.LoginInput{
+			Email:    email,
+			Password: s.TestInfo.Password,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, loginRes)
+		verificationRequest, err := db.Provider.GetVerificationRequestByEmail(ctx, email, constants.VerificationTypeBasicAuthSignup)
+		assert.Nil(t, err)
+		assert.Equal(t, email, verificationRequest.Email)
+		verifyRes, err := resolvers.VerifyEmailResolver(ctx, model.VerifyEmailInput{
+			Token: verificationRequest.Token,
+		})
+		assert.Nil(t, err)
+		assert.NotEqual(t, verifyRes.AccessToken, "", "access token should not be empty")
+
+		// Using access token update profile
+		s.GinContext.Request.Header.Set("Authorization", "Bearer "+refs.StringValue(verifyRes.AccessToken))
+		ctx = context.WithValue(req.Context(), "GinContextKey", s.GinContext)
+		updateProfileRes, err := resolvers.UpdateProfileResolver(ctx, model.UpdateProfileInput{
+			IsMultiFactorAuthEnabled: refs.NewBoolRef(true),
+		})
+		assert.NoError(t, err)
+		assert.NotEmpty(t, updateProfileRes.Message)
+
+		// Login should not return error but access token should be empty as otp should have been sent
+		loginRes, err = resolvers.LoginResolver(ctx, model.LoginInput{
+			Email:    email,
+			Password: s.TestInfo.Password,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, loginRes)
+		assert.Nil(t, loginRes.AccessToken)
+
+		// Get otp from db
+		otp, err := db.Provider.GetOTPByEmail(ctx, email)
+		assert.NoError(t, err)
+		assert.NotEmpty(t, otp.Otp)
+
+		verifyOtpRes, err := resolvers.VerifyOtpResolver(ctx, model.VerifyOTPRequest{
+			Email: email,
+			Otp:   otp.Otp,
+		})
+		assert.Nil(t, err)
+		assert.NotEqual(t, verifyOtpRes.AccessToken, "", "access token should not be empty")
+		cleanData(email)
+	})
+}

server/test/webhook_logs_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/authorizerdev/authorizer/server/crypto"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/resolvers"
-	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -41,7 +41,7 @@ func webhookLogsTest(t *testing.T, s TestSetup) {
 				assert.NoError(t, err)
 				assert.GreaterOrEqual(t, len(webhookLogs.WebhookLogs), 1)
 				for _, wl := range webhookLogs.WebhookLogs {
-					assert.Equal(t, utils.StringValue(wl.WebhookID), w.ID)
+					assert.Equal(t, refs.StringValue(wl.WebhookID), w.ID)
 				}
 			})
 		}

server/test/webhook_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/graph/model"
 	"github.com/authorizerdev/authorizer/server/memorystore"
+	"github.com/authorizerdev/authorizer/server/refs"
 	"github.com/authorizerdev/authorizer/server/resolvers"
-	"github.com/authorizerdev/authorizer/server/utils"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -34,9 +34,9 @@ func webhookTest(t *testing.T, s TestSetup) {
 		})
 		assert.NoError(t, err)
 		assert.Equal(t, res.ID, webhook.ID)
-		assert.Equal(t, utils.StringValue(res.Endpoint), utils.StringValue(webhook.Endpoint))
+		assert.Equal(t, refs.StringValue(res.Endpoint), refs.StringValue(webhook.Endpoint))
-		assert.Equal(t, utils.StringValue(res.EventName), utils.StringValue(webhook.EventName))
+		assert.Equal(t, refs.StringValue(res.EventName), refs.StringValue(webhook.EventName))
-		assert.Equal(t, utils.BoolValue(res.Enabled), utils.BoolValue(webhook.Enabled))
+		assert.Equal(t, refs.BoolValue(res.Enabled), refs.BoolValue(webhook.Enabled))
 		assert.Len(t, res.Headers, len(webhook.Headers))
 	})
 }