.vscode/launch.json

@@ -53,7 +53,7 @@
         "AYANOVA_FOLDER_USER_FILES": "c:\\temp\\RavenTestData\\userfiles",
         "AYANOVA_FOLDER_BACKUP_FILES": "c:\\temp\\RavenTestData\\backupfiles",
         "AYANOVA_FOLDER_TEMPORARY_SERVER_FILES": "c:\\temp\\RavenTestData\\tempfiles",
-        "AYANOVA_SERVER_TEST_MODE": "false",
+        "AYANOVA_SERVER_TEST_MODE": "true",
         "AYANOVA_SERVER_TEST_MODE_SEEDLEVEL": "small",
         "AYANOVA_SERVER_TEST_MODE_TZ_OFFSET": "-7",
         "AYANOVA_BACKUP_PG_DUMP_PATH": "C:\\data\\code\\postgres_13\\bin\\"

server/AyaNova/Controllers/AuthController.cs

@@ -450,20 +450,20 @@ namespace AyaNova.Api.Controllers
             if (u == null)//should never happen but ?
                 return StatusCode(403, new ApiNotAuthorizedResponse());
 
+            //if user already has a secret set then this is not valid, must be re-requested first
+            //this is to stop someone from messing up someone's login accidentally or maliciously by simply hitting the route logged in as them
+            if(!string.IsNullOrWhiteSpace(u.TotpSecret) || u.TwoFactorEnabled)
+                 return BadRequest(new ApiErrorResponse(ApiErrorCode.INVALID_OPERATION, "generalerror", "2fa already enabled"));
+            
+
             var tfa = new TwoFactorAuth("AyaNova");
             u.TotpSecret = tfa.CreateSecret(160);
             await ct.SaveChangesAsync();
 
             //https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-
-            QRCoder.PayloadGenerator.OneTimePassword generator = new QRCoder.PayloadGenerator.OneTimePassword()
-            {
-                Secret = u.TotpSecret,
-                Issuer = "AyaNova",
-                Label = $"AyaNova.acct.{u.Name}",
-                Type = QRCoder.PayloadGenerator.OneTimePassword.OneTimePasswordAuthType.TOTP
-            };
-            string payload = generator.ToString();
+            //otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30
+            //this format tested and works with Google, Microsoft Authy, Duo authenticators
+            string payload = $"otpauth://totp/AyaNova:{u.Name}?secret={u.TotpSecret}&issuer=AyaNova&algorithm=SHA1&digits=6&period=30";
 
             QRCodeGenerator qrGenerator = new QRCodeGenerator();
             QRCodeData qrCodeData = qrGenerator.CreateQrCode(payload, QRCodeGenerator.ECCLevel.Q);
@@ -509,11 +509,11 @@ namespace AyaNova.Api.Controllers
 
             //ok, something to validate, let's validate it
             var tfa = new TwoFactorAuth("AyaNova");
-            tfa.VerifyCode(u.TotpSecret, pin.Pin);
+            var ret = tfa.VerifyCode(u.TotpSecret, pin.Pin, 8);
 
             return Ok(ApiOkResponse.Response(new
             {
-                ok = tfa.VerifyCode(u.TotpSecret, pin.Pin)
+                ok = ret
             }));
         }
 

server/AyaNova/resource/de.json

@@ -2169,5 +2169,7 @@
   "AuthConnectAppTitle": "Verbinden Sie Ihre App",
   "AuthConnectAppSubTitle": "Scannen Sie den QR-Code mit einer Authentifizierungs-App wie Google Authenticator, Duo, Microsoft Authenticator oder Authy. Es wird ein 6-stelliger Passcode angezeigt, den Sie unten eingeben müssen.",
   "AuthConnectAppManualEntry":"Haben Sie Probleme beim Scannen des Codes? Geben Sie Folgendes manuell in Ihre Authentifizierungs-App ein:",
-  "AuthEnterPin":"Geben Sie den 6-stelligen Passcode ein"
+  "AuthEnterPin":"Geben Sie den 6-stelligen Passcode ein",
+  "AuthPinInvalid":"Passcode ungültig",
+  "AuthConnectCompleted":"Die Zwei-Faktor-Authentifizierung ist jetzt aktiviert"
 }

server/AyaNova/resource/en.json

@@ -2169,5 +2169,7 @@
   "AuthConnectAppTitle": "Connect your app",
   "AuthConnectAppSubTitle": "Using an authenticator app such as Google Authenticator, Duo, Microsoft Authenticator, Authy etc, scan the QR code. It will display a 6 digit pass code which you need to enter below.",
   "AuthConnectAppManualEntry":"Having trouble scanning the code? Enter the following manually into your authenticator app:",
-  "AuthEnterPin":"Enter 6 digit pass code"
+  "AuthEnterPin":"Enter 6 digit pass code",
+  "AuthPinInvalid":"Pass code not valid",
+  "AuthConnectCompleted":"Two factor authentication is now enabled"
 }

server/AyaNova/resource/es.json

@@ -2169,5 +2169,7 @@
   "AuthConnectAppTitle": "Conecta tu aplicación",
   "AuthConnectAppSubTitle": "Con una aplicación de autenticación como Google Authenticator, Duo, Microsoft Authenticator o Authy, escanee el código QR. Aparecerá un código de acceso de 6 dígitos que debe ingresar a continuación.",
   "AuthConnectAppManualEntry":"¿Tiene problemas para escanear el código? Ingrese lo siguiente manualmente en su aplicación de autenticación:",
-  "AuthEnterPin":"Ingrese un código de acceso de 6 dígitos"
+  "AuthEnterPin":"Ingrese un código de acceso de 6 dígitos",
+  "AuthPinInvalid":"Código de acceso no válido",
+  "AuthConnectCompleted":"La autenticación de dos factores ahora está habilitada"
 }

server/AyaNova/resource/fr.json

@@ -2169,5 +2169,7 @@
   "AuthConnectAppTitle": "Connectez votre application",
   "AuthConnectAppSubTitle": "À l'aide d'une application d'authentification telle que Google Authenticator, Duo, Microsoft Authenticator ou Authy, scannez le code QR. Il affichera un code d'accès à 6 chiffres que vous devez saisir ci-dessous.",
   "AuthConnectAppManualEntry":"Vous rencontrez des difficultés pour scanner le code? Saisissez les informations suivantes manuellement dans votre application d'authentification:",
-  "AuthEnterPin":"Entrez le code d'accès à 6 chiffres"
+  "AuthEnterPin":"Entrez le code d'accès à 6 chiffres",
+  "AuthPinInvalid":"Code d'accès non valide",
+  "AuthConnectCompleted":"L'authentification à deux facteurs est maintenant activée"
 }