feat(users): Create terminate 2fa API

[Riddhiagrawal001]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Dependency updates
• Documentation
• CI/CD

Description

Currently completion of 2fa and setting the status of the 2fa status as "SET" is handled by verify_totp API. We want to remove this from verify_totp, so this PR creates a new API to terminate the 2fa flow.

Additional Changes

• This PR modifies the API contract
• This PR modifies the database schema
• This PR modifies application configuration/environment variables

Motivation and Context

This will close the issue #4730

How did you test it?

This can only be tested locally as it requires some changes in the redis.

1. terminate 2fa without skip_two_factor_auth query param
   a. If the keys with TOTP_{user_id} or RC_{user_id} is not present in redis
   Request

curl --location 'http://localhost:8080/user/2fa/terminate' \
--header 'Authorization: Bearer SPT with purpose as TOTP'

Response

{
    "error": {
        "type": "invalid_request",
        "message": "Two factor auth required",
        "code": "UR_39"
    }
}

b. Add the keys to the redis with prefix as TOTP_{user_id} or RC_{user_id}

Request

curl --location 'http://localhost:8080/user/2fa/terminate' \
--header 'Authorization: Bearer SPT with purpose as TOTP'

Response
This will also set the totp_status for the user as "set"

{
    "token": "Bearer token",
    "token_type": "next flow token type"
}

2. terminate 2fa with skip_two_factor_auth query param
   a. skip_two_factor_auth=true
   Irrespective if the keys are present in redis or not if skip_two_factor_auth is sent as true it will not change the status and will give the token and token_type for the next flow
   Request

curl --location 'http://localhost:8080/user/2fa/terminate?skip_two_factor_auth=true' \
--header 'Authorization: Bearer SPT with purpose as TOTP'

Response

{
    "token": "Bearer token",
    "token_type": "next flow token type"
}

b. skip_two_factor_auth=false
Request

curl --location 'http://localhost:8080/user/2fa/terminate?skip_two_factor_auth=false' \
--header 'Authorization: Bearer SPT with purpose as TOTP'

Response
This will also set the totp_status for the user as "set"

{
    "token": "Bearer token",
    "token_type": "next flow token type"
}

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible

[ThisIsMani]

Add a new error 2FARequired.

[Riddhiagrawal001]

New error added

[ThisIsMani]

Should be !skip_2fa.unwrap_or(false).

[Riddhiagrawal001]

Changed

[ThisIsMani]

Suggested change

	if !(check_totp_in_redis(&state, &user_token.user_id).await?
	|| check_access_code_in_redis(&state, &user_token.user_id).await?)
	if !check_totp_in_redis(&state, &user_token.user_id).await?
	&& !check_access_code_in_redis(&state, &user_token.user_id).await?

This is more readable imo.

[Riddhiagrawal001]

Changed

[racnan]

use the parent route function to resolve the option.

[Riddhiagrawal001]

Addressed