diff --git a/src-ui/src/app/components/app-frame/app-frame.component.spec.ts b/src-ui/src/app/components/app-frame/app-frame.component.spec.ts index 1354a187e..f440946da 100644 --- a/src-ui/src/app/components/app-frame/app-frame.component.spec.ts +++ b/src-ui/src/app/components/app-frame/app-frame.component.spec.ts @@ -343,6 +343,7 @@ describe('AppFrameComponent', () => { component.editProfile() expect(modalSpy).toHaveBeenCalledWith(ProfileEditDialogComponent, { backdrop: 'static', + size: 'xl', }) }) diff --git a/src-ui/src/app/components/app-frame/app-frame.component.ts b/src-ui/src/app/components/app-frame/app-frame.component.ts index df6ac65a2..83d927562 100644 --- a/src-ui/src/app/components/app-frame/app-frame.component.ts +++ b/src-ui/src/app/components/app-frame/app-frame.component.ts @@ -136,6 +136,7 @@ export class AppFrameComponent editProfile() { this.modalService.open(ProfileEditDialogComponent, { backdrop: 'static', + size: 'xl', }) this.closeMenu() } diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html index 713d68864..f9d57baf3 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html @@ -5,94 +5,179 @@
- -
-
-
-
- +
+
+ +
+
+
+
+ +
+
-
-
- -
-
-
-
- + +
+
+
+
+ +
+
-
-
- - -
- -
-
- - - - -
- Copied! -
-
Warning: changing the token cannot be undone
-
- @if (socialAccounts?.length > 0) { + +
-

Connected social accounts

-
    - @for (account of socialAccounts; track account.id) { -
  • - {{account.name}} ({{account.provider}}) + +
    +
    + + + (confirm)="generateAuthToken()"> -
    • - } -
-
Warning: disconnecting social accounts cannot be undone
-
- } - @if (socialAccountProviders?.length > 0) { -
-

Connect new social account

-
- @for (provider of socialAccountProviders; track provider.name) { - - {{provider.name}}  - - } +
+ Copied! +
+
Warning: changing the token cannot be undone
-
- } +
+
+ @if (socialAccounts?.length > 0) { +
+

Connected social accounts

+
    + @for (account of socialAccounts; track account.id) { +
  • + {{account.name}} ({{account.provider}}) + + +
    • + } +
+
Warning: disconnecting social accounts cannot be undone
+
+ } + @if (socialAccountProviders?.length > 0) { +
+

Connect new social account

+
+ @for (provider of socialAccountProviders; track provider.name) { + + {{provider.name}}  + + } +
+
+ } + @if (!isTotpEnabled) { +
+
+

+ +

+
+
+ + @if (totpSettingsLoading) { + + + } @else if (totpSettings) { +
+
+
Scan the QR code with your authenticator app and then enter the code below
+
+

+ Authenticator secret: {{totpSettings.secret}}. + You can store this secret and use it to reinstall your authenticator app at a later time. +

+
+ + +
+ } + +
+
+
+
+ } @else { + + @if (recoveryCodes) { + +
+
    + @for (code of recoveryCodes; track code; let i = $index) { + @if (i % 2 === 0) { +
  • + {{code}} + @if (recoveryCodes[i + 1]) { + {{recoveryCodes[i + 1]}} + } +
    • + } + } +
+ +
+ } + + + } +
+
diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts index 77cba4505..637a82701 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts @@ -2,7 +2,11 @@ import { Component, OnDestroy, OnInit } from '@angular/core' import { FormControl, FormGroup } from '@angular/forms' import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' import { ProfileService } from 'src/app/services/profile.service' -import { SocialAccount, SocialAccountProvider } from 'src/app/data/user-profile' +import { + TotpSettings, + SocialAccount, + SocialAccountProvider, +} from 'src/app/data/user-profile' import { ToastService } from 'src/app/services/toast.service' import { Subject, takeUntil } from 'rxjs' import { Clipboard } from '@angular/cdk/clipboard' @@ -25,6 +29,7 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { first_name: new FormControl(''), last_name: new FormControl(''), auth_token: new FormControl(''), + totp_code: new FormControl(''), }) private currentPassword: string @@ -38,7 +43,14 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { private emailConfirm: string public showEmailConfirm: boolean = false + public isTotpEnabled: boolean = false + public totpSettings: TotpSettings + public totpSettingsLoading: boolean = false + public totpLoading: boolean = false + public recoveryCodes: string[] + public copied: boolean = false + public codesCopied: boolean = false public socialAccounts: SocialAccount[] = [] public socialAccountProviders: SocialAccountProvider[] = [] @@ -70,6 +82,7 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { this.onPasswordChange() }) this.socialAccounts = profile.social_accounts + this.isTotpEnabled = profile.is_mfa_enabled }) this.profileService @@ -147,6 +160,7 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { const passwordChanged = this.newPassword && this.currentPassword !== this.newPassword const profile = Object.assign({}, this.form.value) + delete profile.totp_code this.networkActive = true this.profileService .update(profile) @@ -213,4 +227,82 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { }, }) } + + public gettotpSettings(): void { + this.totpSettingsLoading = true + this.profileService + .getTotpSettings() + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe({ + next: (totpSettings) => { + this.totpSettingsLoading = false + this.totpSettings = totpSettings + }, + error: (error) => { + this.toastService.showError( + $localize`Error fetching TOTP settings`, + error + ) + this.totpSettingsLoading = false + }, + }) + } + + public activateTotp(): void { + this.totpLoading = true + this.form.get('totp_code').disable() + this.profileService + .activateTotp(this.totpSettings.secret, this.form.get('totp_code').value) + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe({ + next: (activationResponse) => { + console.log(activationResponse) + + this.totpLoading = false + this.isTotpEnabled = activationResponse.success + this.recoveryCodes = activationResponse.recovery_codes + if (activationResponse.success) { + this.toastService.showInfo($localize`TOTP activated successfully`) + } else { + this.toastService.showError($localize`Error activating TOTP`) + } + }, + error: (error) => { + this.totpLoading = false + this.form.get('totp_code').enable() + this.toastService.showError($localize`Error activating TOTP`, error) + }, + }) + } + + public deactivateTotp(): void { + this.totpLoading = true + this.profileService + .deactivateTotp() + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe({ + next: (success) => { + this.totpLoading = false + this.isTotpEnabled = !success + this.recoveryCodes = null + if (success) { + this.toastService.showInfo($localize`TOTP deactivated successfully`) + } else { + this.toastService.showError($localize`Error deactivating TOTP`) + } + }, + error: (error) => { + this.totpLoading = false + this.toastService.showError($localize`Error deactivating TOTP`, error) + }, + }) + } + + public copyRecoveryCodes(): void { + this.clipboard.copy(this.recoveryCodes.join('\n')) + this.codesCopied = true + setTimeout(() => { + this.codesCopied = false + }, 3000) + } } diff --git a/src-ui/src/app/data/user-profile.ts b/src-ui/src/app/data/user-profile.ts index 554f6f0e1..a07163233 100644 --- a/src-ui/src/app/data/user-profile.ts +++ b/src-ui/src/app/data/user-profile.ts @@ -17,4 +17,11 @@ export interface PaperlessUserProfile { auth_token?: string social_accounts?: SocialAccount[] has_usable_password?: boolean + is_mfa_enabled?: boolean +} + +export interface TotpSettings { + url: string + qr_svg: string + secret: string } diff --git a/src-ui/src/app/services/profile.service.ts b/src-ui/src/app/services/profile.service.ts index 32e06cce0..1a799e617 100644 --- a/src-ui/src/app/services/profile.service.ts +++ b/src-ui/src/app/services/profile.service.ts @@ -2,6 +2,7 @@ import { HttpClient } from '@angular/common/http' import { Injectable } from '@angular/core' import { Observable } from 'rxjs' import { + TotpSettings, PaperlessUserProfile, SocialAccountProvider, } from '../data/user-profile' @@ -47,4 +48,30 @@ export class ProfileService { `${environment.apiBaseUrl}${this.endpoint}/social_account_providers/` ) } + + getTotpSettings(): Observable { + return this.http.get( + `${environment.apiBaseUrl}${this.endpoint}/totp_activate/` + ) + } + + activateTotp( + totpSecret: string, + totpCode: string + ): Observable<{ success: boolean; recovery_codes: string[] }> { + return this.http.post<{ success: boolean; recovery_codes: string[] }>( + `${environment.apiBaseUrl}${this.endpoint}/totp_activate/`, + { + secret: totpSecret, + code: totpCode, + } + ) + } + + deactivateTotp(): Observable { + return this.http.delete( + `${environment.apiBaseUrl}${this.endpoint}/totp_activate/`, + {} + ) + } } diff --git a/src/paperless/serialisers.py b/src/paperless/serialisers.py index 52f9e2b33..5106bcf08 100644 --- a/src/paperless/serialisers.py +++ b/src/paperless/serialisers.py @@ -1,5 +1,6 @@ import logging +from allauth.mfa.adapter import get_adapter as get_mfa_adapter from allauth.socialaccount.models import SocialAccount from django.contrib.auth.models import Group from django.contrib.auth.models import Permission @@ -130,6 +131,11 @@ class ProfileSerializer(serializers.ModelSerializer): read_only=True, source="socialaccount_set", ) + is_mfa_enabled = serializers.SerializerMethodField() + + def get_is_mfa_enabled(self, user: User): + mfa_adapter = get_mfa_adapter() + return mfa_adapter.is_mfa_enabled(user) class Meta: model = User @@ -141,6 +147,7 @@ class ProfileSerializer(serializers.ModelSerializer): "auth_token", "social_accounts", "has_usable_password", + "is_mfa_enabled", ) diff --git a/src/paperless/settings.py b/src/paperless/settings.py index 5f54ad915..e5f31800f 100644 --- a/src/paperless/settings.py +++ b/src/paperless/settings.py @@ -459,6 +459,8 @@ SOCIALACCOUNT_PROVIDERS = json.loads( os.getenv("PAPERLESS_SOCIALACCOUNT_PROVIDERS", "{}"), ) +MFA_TOTP_ISSUER = "Paperless-ngx" + ACCOUNT_EMAIL_SUBJECT_PREFIX = "[Paperless-ngx] " DISABLE_REGULAR_LOGIN = __get_boolean("PAPERLESS_DISABLE_REGULAR_LOGIN") diff --git a/src/paperless/urls.py b/src/paperless/urls.py index a024c925a..23f91b5cd 100644 --- a/src/paperless/urls.py +++ b/src/paperless/urls.py @@ -54,6 +54,7 @@ from paperless.views import GenerateAuthTokenView from paperless.views import GroupViewSet from paperless.views import ProfileView from paperless.views import SocialAccountProvidersView +from paperless.views import TOTPActivateView from paperless.views import UserViewSet from paperless_mail.views import MailAccountTestView from paperless_mail.views import MailAccountViewSet @@ -157,8 +158,21 @@ urlpatterns = [ ), re_path( "^profile/", - ProfileView.as_view(), - name="profile_view", + include( + [ + re_path( + "^$", + ProfileView.as_view(), + name="profile_view", + ), + path( + "totp_activate/", + TOTPActivateView.as_view(), + name="activate", + ), + # TODO: remove allauth urls? + ], + ), ), re_path( "^status/", diff --git a/src/paperless/views.py b/src/paperless/views.py index 974830d83..6cf3ec979 100644 --- a/src/paperless/views.py +++ b/src/paperless/views.py @@ -1,6 +1,12 @@ import os from collections import OrderedDict +from allauth.mfa import signals +from allauth.mfa.adapter import get_adapter as get_mfa_adapter +from allauth.mfa.base.internal.flows import delete_and_cleanup +from allauth.mfa.models import Authenticator +from allauth.mfa.recovery_codes.internal.flows import auto_generate_recovery_codes +from allauth.mfa.totp.internal import auth as totp_auth from allauth.socialaccount.adapter import get_adapter from allauth.socialaccount.models import SocialAccount from django.contrib.auth.models import Group @@ -145,6 +151,75 @@ class ProfileView(GenericAPIView): return Response(serializer.to_representation(user)) +class TOTPActivateView(GenericAPIView): + """ + TOTP views + """ + + permission_classes = [IsAuthenticated] + + def get(self, request, *args, **kwargs): + user = self.request.user + mfa_adapter = get_mfa_adapter() + secret = totp_auth.get_totp_secret(regenerate=True) + url = mfa_adapter.build_totp_url(user, secret) + svg = mfa_adapter.build_totp_svg(url) + return Response( + { + "url": url, + "qr_svg": svg, + "secret": secret, + }, + ) + + def post(self, request, *args, **kwargs): + valid = totp_auth.validate_totp_code( + request.data["secret"], + request.data["code"], + ) + recovery_codes = None + if valid: + # from allauth.mfa.totp.internal.flows activate_totp + auth = totp_auth.TOTP.activate( + request.user, + request.data["secret"], + ).instance + signals.authenticator_added.send( + sender=Authenticator, + request=request, + user=request.user, + authenticator=auth, + ) + # adapter = get_adapter() + # adapter.add_message(request, messages.SUCCESS, "mfa/messages/totp_activated.txt") + # adapter.send_notification_mail("mfa/email/totp_activated", request.user) + rc_auth: Authenticator = auto_generate_recovery_codes(request) + if rc_auth: + recovery_codes = rc_auth.wrap().get_unused_codes() + return Response( + { + "success": valid, + "recovery_codes": recovery_codes, + }, + ) + + def delete(self, request, *args, **kwargs): + user = self.request.user + try: + # from allauth.mfa.totp.internal.flows deactivate_totp + authenticator = Authenticator.objects.filter( + user=user, + type=Authenticator.Type.TOTP, + ).first() + delete_and_cleanup(request, authenticator) + # adapter = get_account_adapter(request) + # adapter.add_message(request, messages.SUCCESS, "mfa/messages/totp_deactivated.txt") + # adapter.send_notification_mail("mfa/email/totp_deactivated", request.user) + return Response(True) + except Authenticator.DoesNotExist: + return HttpResponseBadRequest("TOTP not found") + + class GenerateAuthTokenView(GenericAPIView): """ Generates (or re-generates) an auth token, requires a logged in user