From a0208dd5b3ce54ccfa96b3497cb36e16ccb4cf89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karol=20S=C3=B3jko?= <karolsojko@protonmail.com>
Date: Mon, 9 Jan 2023 12:56:43 +0100
Subject: [PATCH] fix(auth): remove mfa settings after recovery sign in

---
 packages/auth/src/Bootstrap/Container.ts      | 29 ++++++++++---------
 .../SignInWithRecoveryCodes.spec.ts           |  7 +++++
 .../SignInWithRecoveryCodes.ts                |  7 +++++
 3 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/packages/auth/src/Bootstrap/Container.ts b/packages/auth/src/Bootstrap/Container.ts
index 7316ddc3b..73e6ad003 100644
--- a/packages/auth/src/Bootstrap/Container.ts
+++ b/packages/auth/src/Bootstrap/Container.ts
@@ -619,20 +619,6 @@ export class ContainerConfigLoader {
     container.bind<VerifyMFA>(TYPES.VerifyMFA).to(VerifyMFA)
     container.bind<ClearLoginAttempts>(TYPES.ClearLoginAttempts).to(ClearLoginAttempts)
     container.bind<IncreaseLoginAttempts>(TYPES.IncreaseLoginAttempts).to(IncreaseLoginAttempts)
-    container
-      .bind<SignInWithRecoveryCodes>(TYPES.SignInWithRecoveryCodes)
-      .toConstantValue(
-        new SignInWithRecoveryCodes(
-          container.get(TYPES.UserRepository),
-          container.get(TYPES.AuthResponseFactory20200115),
-          container.get(TYPES.PKCERepository),
-          container.get(TYPES.Crypter),
-          container.get(TYPES.SettingService),
-          container.get(TYPES.GenerateRecoveryCodes),
-          container.get(TYPES.IncreaseLoginAttempts),
-          container.get(TYPES.ClearLoginAttempts),
-        ),
-      )
     container
       .bind<GetUserKeyParamsRecovery>(TYPES.GetUserKeyParamsRecovery)
       .toConstantValue(
@@ -655,6 +641,21 @@ export class ContainerConfigLoader {
     container.bind<GetUserFeatures>(TYPES.GetUserFeatures).to(GetUserFeatures)
     container.bind<UpdateSetting>(TYPES.UpdateSetting).to(UpdateSetting)
     container.bind<DeleteSetting>(TYPES.DeleteSetting).to(DeleteSetting)
+    container
+      .bind<SignInWithRecoveryCodes>(TYPES.SignInWithRecoveryCodes)
+      .toConstantValue(
+        new SignInWithRecoveryCodes(
+          container.get(TYPES.UserRepository),
+          container.get(TYPES.AuthResponseFactory20200115),
+          container.get(TYPES.PKCERepository),
+          container.get(TYPES.Crypter),
+          container.get(TYPES.SettingService),
+          container.get(TYPES.GenerateRecoveryCodes),
+          container.get(TYPES.IncreaseLoginAttempts),
+          container.get(TYPES.ClearLoginAttempts),
+          container.get(TYPES.DeleteSetting),
+        ),
+      )
     container.bind<DeleteAccount>(TYPES.DeleteAccount).to(DeleteAccount)
     container.bind<GetUserSubscription>(TYPES.GetUserSubscription).to(GetUserSubscription)
     container.bind<GetUserOfflineSubscription>(TYPES.GetUserOfflineSubscription).to(GetUserOfflineSubscription)
diff --git a/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.spec.ts b/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.spec.ts
index 45306c631..1ddeb664c 100644
--- a/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.spec.ts
+++ b/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.spec.ts
@@ -9,6 +9,7 @@ import { PKCERepositoryInterface } from '../../User/PKCERepositoryInterface'
 import { User } from '../../User/User'
 import { UserRepositoryInterface } from '../../User/UserRepositoryInterface'
 import { ClearLoginAttempts } from '../ClearLoginAttempts'
+import { DeleteSetting } from '../DeleteSetting/DeleteSetting'
 import { GenerateRecoveryCodes } from '../GenerateRecoveryCodes/GenerateRecoveryCodes'
 import { IncreaseLoginAttempts } from '../IncreaseLoginAttempts'
 import { SignInWithRecoveryCodes } from './SignInWithRecoveryCodes'
@@ -22,6 +23,7 @@ describe('SignInWithRecoveryCodes', () => {
   let generateRecoveryCodes: GenerateRecoveryCodes
   let increaseLoginAttempts: IncreaseLoginAttempts
   let clearLoginAttempts: ClearLoginAttempts
+  let deleteSetting: DeleteSetting
 
   const createUseCase = () =>
     new SignInWithRecoveryCodes(
@@ -33,6 +35,7 @@ describe('SignInWithRecoveryCodes', () => {
       generateRecoveryCodes,
       increaseLoginAttempts,
       clearLoginAttempts,
+      deleteSetting,
     )
 
   beforeEach(() => {
@@ -63,6 +66,9 @@ describe('SignInWithRecoveryCodes', () => {
 
     clearLoginAttempts = {} as jest.Mocked<ClearLoginAttempts>
     clearLoginAttempts.execute = jest.fn()
+
+    deleteSetting = {} as jest.Mocked<DeleteSetting>
+    deleteSetting.execute = jest.fn()
   })
 
   it('should return error if password is not provided', async () => {
@@ -213,6 +219,7 @@ describe('SignInWithRecoveryCodes', () => {
     })
 
     expect(clearLoginAttempts.execute).toHaveBeenCalled()
+    expect(deleteSetting.execute).toHaveBeenCalled()
     expect(result.isFailed()).toBe(false)
   })
 })
diff --git a/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.ts b/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.ts
index c651fb7a8..3a33bc86c 100644
--- a/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.ts
+++ b/packages/auth/src/Domain/UseCase/SignInWithRecoveryCodes/SignInWithRecoveryCodes.ts
@@ -14,6 +14,7 @@ import { SignInWithRecoveryCodesDTO } from './SignInWithRecoveryCodesDTO'
 import { AuthResponseFactory20200115 } from '../../Auth/AuthResponseFactory20200115'
 import { IncreaseLoginAttempts } from '../IncreaseLoginAttempts'
 import { ClearLoginAttempts } from '../ClearLoginAttempts'
+import { DeleteSetting } from '../DeleteSetting/DeleteSetting'
 
 export class SignInWithRecoveryCodes implements UseCaseInterface<AuthResponse20200115> {
   constructor(
@@ -25,6 +26,7 @@ export class SignInWithRecoveryCodes implements UseCaseInterface<AuthResponse202
     private generateRecoveryCodes: GenerateRecoveryCodes,
     private increaseLoginAttempts: IncreaseLoginAttempts,
     private clearLoginAttempts: ClearLoginAttempts,
+    private deleteSetting: DeleteSetting,
   ) {}
 
   async execute(dto: SignInWithRecoveryCodesDTO): Promise<Result<AuthResponse20200115>> {
@@ -103,6 +105,11 @@ export class SignInWithRecoveryCodes implements UseCaseInterface<AuthResponse202
       return Result.fail(`Could not sign in with recovery codes: ${generateNewRecoveryCodesResult.getError()}`)
     }
 
+    await this.deleteSetting.execute({
+      settingName: SettingName.MfaSecret,
+      userUuid: user.uuid,
+    })
+
     await this.clearLoginAttempts.execute({ email: username.value })
 
     return Result.ok(authResponse as AuthResponse20200115)