gws.plugin.auth_mfa.email

Multi-factor authentication with a one-time code sent by email.

When a transaction starts, the adapter generates a random secret, creates a TOTP code from it and sends the code to the email address of the user. A restart sends a new code with a new secret. Users without an email address cannot start a transaction. The client sends the code back as {"code": ...}.

The email subject is rendered from the template email.subject, the body from the template email.body, once as text/plain and once as text/html; the HTML part is only added if it is not empty. Templates get the arguments user and otp. The mail is sent with the email helper (gws.plugin.email_helper), which must be configured.

Example:

auth.mfa+ {
    type "email"
    uid "AUTH_MFA_EMAIL"

    templates+ {
        type "text"
        subject "email.subject"
        text "Your login code"
    }

    templates+ {
        type "text"
        subject "email.body"
        text "Hello {{user.displayName}}, your code is {{otp}}."
    }
}

Source code: gws.plugin.auth_mfa.email

Package Contents

class gws.plugin.auth_mfa.email.Config

Bases: gws.base.auth.mfa.Config

Multi-factor authentication with a one-time code sent by email.

templates: list[gws.ext.config.template] | None

Templates for the email subject and body.

class gws.plugin.auth_mfa.email.Object

Bases: gws.base.auth.mfa.Object

Email multi-factor adapter.

templates: list[gws.Template]

Templates for the email subject and body.

configure()

generate_and_send(mfa: gws.AuthMultiFactorTransaction)

Generate a new code and send it to the user by email.

A new random secret is stored in the transaction before the code is generated.

Parameters:

mfa – The transaction.

Raises:

gws.plugin.email_helper.Error – If the email cannot be sent.

render_template(subject, args, mime_type=None)

Render a template of the adapter.

Parameters:

• subject – Template subject, for example email.body.

• args – Template arguments.

• mime_type – Output mime type of the template to find.

Returns:

The rendered content, or an empty string if no template is found.

start(user)

verify(mfa, payload)