Merge pull request #22 from alphagov/implement_two_factor

Implement two factor

app/main/__init__.py

@@ -3,4 +3,4 @@ from flask import Blueprint
 main = Blueprint('main', __name__)
 
 
-from app.main.views import index, sign_in, register, verify
+from app.main.views import index, sign_in, register, two_factor, verify

app/main/forms.py

@@ -1,6 +1,6 @@
 from flask import session
 from flask_wtf import Form
-from wtforms import StringField, PasswordField, IntegerField
+from wtforms import StringField, PasswordField
 from wtforms.validators import DataRequired, Email, Length, Regexp
 
 from app.main.encryption import checkpw
@@ -41,6 +41,14 @@ class RegisterUserForm(Form):
                                          Blacklist(message='That password is blacklisted, too common')])
 
 
+class TwoFactorForm(Form):
+    sms_code = StringField('sms code', validators=[DataRequired(message='Please enter your code'),
+                                                   Regexp(regex=verify_code, message='Code must be 5 digits')])
+
+    def validate_sms_code(self, a):
+        validate_code(self.sms_code, session['sms_code'])
+
+
 class VerifyForm(Form):
     sms_code = StringField("Text message confirmation code",
                            validators=[DataRequired(message='SMS code can not be empty'),
@@ -50,17 +58,18 @@ class VerifyForm(Form):
                                          Regexp(regex=verify_code, message='Code must be 5 digits')])
 
     def validate_email_code(self, a):
-        if self.email_code.data is not None:
-            if checkpw(str(self.email_code.data), session['email_code']) is False:
-                self.email_code.errors.append('Code does not match')
-                return False
-        else:
-            return True
+        validate_code(self.email_code, session['email_code'])
 
     def validate_sms_code(self, a):
-        if self.sms_code.data is not None:
-            if checkpw(str(self.sms_code.data), session['sms_code']) is False:
-                self.sms_code.errors.append('Code does not match')
-                return False
+        validate_code(self.sms_code, session['sms_code'])
+
+
+def validate_code(field, code):
+    if field.data is not None:
+        if checkpw(str(field.data), code) is False:
+            field.errors.append('Code does not match')
+            return False
         else:
             return True
+    else:
+        return True

app/main/views/__init__.py

@@ -0,0 +1,30 @@
+from random import randint
+from app import admin_api_client
+from app.main.exceptions import AdminApiClientException
+
+
+def create_verify_code():
+    return ''.join(["%s" % randint(0, 9) for _ in range(0, 5)])
+
+
+def send_sms_code(mobile_number):
+    sms_code = create_verify_code()
+    try:
+        admin_api_client.send_sms(mobile_number, message=sms_code, token=admin_api_client.auth_token)
+    except:
+        raise AdminApiClientException('Exception when sending sms.')
+    return sms_code
+
+
+def send_email_code(email):
+    email_code = create_verify_code()
+    try:
+        admin_api_client.send_email(email_address=email,
+                                    from_str='notify@digital.cabinet-office.gov.uk',
+                                    message=email_code,
+                                    subject='Verification code',
+                                    token=admin_api_client.auth_token)
+    except:
+        raise AdminApiClientException('Exception when sending email.')
+
+    return email_code

app/main/views/index.py

@@ -41,11 +41,6 @@ def addservice():
     return render_template('add-service.html')
 
 
-@main.route("/two-factor")
-def twofactor():
-    return render_template('two-factor.html')
-
-
 @main.route("/send-sms")
 def sendsms():
     return render_template('send-sms.html')

app/main/views/register.py

@@ -1,15 +1,14 @@
 from datetime import datetime, timedelta
-from random import randint
 
 from flask import render_template, redirect, jsonify, session
 from sqlalchemy.exc import SQLAlchemyError
 
-from app import admin_api_client
 from app.main import main
 from app.main.dao import users_dao
 from app.main.encryption import hashpw
 from app.main.exceptions import AdminApiClientException
 from app.main.forms import RegisterUserForm
+from app.main.views import send_sms_code, send_email_code
 from app.models import User
 
 
@@ -44,30 +43,3 @@ def process_register():
     else:
         return jsonify(form.errors), 400
     return redirect('/verify')
-
-
-def send_sms_code(mobile_number):
-    sms_code = _create_code()
-    try:
-        admin_api_client.send_sms(mobile_number, message=sms_code, token=admin_api_client.auth_token)
-    except:
-        raise AdminApiClientException('Exception when sending sms.')
-    return sms_code
-
-
-def send_email_code(email):
-    email_code = _create_code()
-    try:
-        admin_api_client.send_email(email_address=email,
-                                    from_str='notify@digital.cabinet-office.gov.uk',
-                                    message=email_code,
-                                    subject='Verification code',
-                                    token=admin_api_client.auth_token)
-    except:
-        raise AdminApiClientException('Exception when sending email.')
-
-    return email_code
-
-
-def _create_code():
-    return ''.join(["%s" % randint(0, 9) for _ in range(0, 5)])

app/main/views/sign_in.py

@@ -1,10 +1,12 @@
 from flask import render_template, redirect, jsonify
-from flask_login import login_user
+from flask import session
 
 from app.main import main
 from app.main.dao import users_dao
 from app.main.encryption import checkpw
+from app.main.encryption import hashpw
 from app.main.forms import LoginForm
+from app.main.views import send_sms_code
 
 
 @main.route("/sign-in", methods=(['GET']))
@@ -24,7 +26,9 @@ def process_sign_in():
         if not user.is_active():
             return jsonify(active_user=False), 401
         if checkpw(form.password.data, user.password):
-            login_user(user)
+            sms_code = send_sms_code(user.mobile_number)
+            session['user_id'] = user.id
+            session['sms_code'] = hashpw(sms_code)
         else:
             users_dao.increment_failed_login_count(user.id)
             return jsonify(authorization=False), 401

app/main/views/two_factor.py

@@ -0,0 +1,23 @@
+from flask import render_template, redirect, jsonify, session
+from flask_login import login_user
+
+from app.main import main
+from app.main.dao import users_dao
+from app.main.forms import TwoFactorForm
+
+
+@main.route("/two-factor", methods=['GET'])
+def render_two_factor():
+    return render_template('two-factor.html', form=TwoFactorForm())
+
+
+@main.route('/two-factor', methods=['POST'])
+def process_two_factor():
+    form = TwoFactorForm()
+
+    if form.validate_on_submit():
+        user = users_dao.get_user_by_id(session['user_id'])
+        login_user(user)
+        return redirect('/dashboard')
+    else:
+        return jsonify(form.errors), 400

app/templates/two-factor.html

@@ -12,15 +12,18 @@ GOV.UK Notify | Text verification
 
 		<p>We've sent you a text message with a verification code.</p>
 
-  		<p>
-  		<label class="form-label" for="email">Enter verification code<br>
-  		<input class="form-control-1-4" id="email" type="text"><br>
-  		<span class="font-xsmall"><a href="verification-not-received">I haven't received a text</a></span>
-  		</p>
 
-  		<p>
-  		<a class="button" href="dashboard" role="button">Continue</a>
-  		</p>
+		<form autocomplete="off" action="" method="post">
+			{{ form.hidden_tag() }}
+  			<p>
+				<label class="form-label">Enter verification code</label><br>
+				{{ form.sms_code(class="form-control-1-4", autocomplete="off") }} <br>
+				<span class="font-xsmall"><a href="verification-not-received">I haven't received a text</a></span>
+  			</p>
+  			<p>
+  			<button class="button" href="dashboard" role="button">Continue</button>
+  			</p>
+		</form>
 	</div>
 </div>