Skip to content

Commit d1a45cc

Browse files
reeshika-hreeshika-h
committed
refactor: Enhance login functionality with TOTP/MFA support
- Simplified login method to handle TOTP and MFA secret. - Added input validation for email, password, and TOTP token. - Updated User class to implement generic BaseImplementation. - Introduced unit tests for login scenarios including TOTP and MFA handling.
1 parent ec886d2 commit d1a45cc

5 files changed

Lines changed: 198 additions & 77 deletions

File tree

‎src/main/java/com/contentstack/cms/Contentstack.java‎

Lines changed: 32 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -156,61 +156,19 @@ public Response<LoginDetails> login(String emailId, String password) throws IOEx
156156
}
157157

158158
/**
159-
* <b>[Note]:</b> Before executing any calls, retrieve the authtoken by
160-
* authenticating yourself via the Log in call of User Session. The
161-
* authtoken is returned to the 'Response' body of the Log in call and is
162-
* mandatory in all the calls.
163-
* <p>
164-
* <b>Example:</b>
165-
* <p>
166-
* All accounts registered with Contentstack are known as Users. A stack can
167-
* have many users with varying permissions and roles
168-
* <p>
169-
* To perform User operations first get User instance like below.
170-
* <p>
171-
* <b>Example:</b>
159+
* Login with TOTP token.
172160
*
173-
* <pre>
174-
* Contentstack contentstack = new Contentstack.Builder().setAuthtoken("authtoken").build();
175-
* Response login = contentstack.login();
176-
*
177-
* Access more other user functions from the userInstance
178-
* </pre>
179-
*
180-
* <br>
181-
* <b>OR: </b>
182-
*
183-
* <pre>
184-
* Contentstack contentstack = new Contentstack.Builder().build();
185-
* Response login = contentstack.login("emailId", "password");
186-
* </pre>
187-
*
188-
* <br>
189-
*
190-
* @param emailId the email id
191-
* @param password the password
192-
* @param tfaToken the tfa token
193-
* @return LoginDetails
194-
* @throws IOException the io exception
195-
* @throws IOException the IOException
196-
* @author ***REMOVED
197-
***
198-
* @see <a
199-
* href=
200-
* "https://www.contentstack.com/docs/developers/apis/content-management-api/#log-in-to-your-account">Login
201-
* your account
202-
* </a>
161+
* @param emailId The email ID of the user
162+
* @param password The user's password
163+
* @param tfaToken The TOTP token
164+
* @return Response containing login details
165+
* @throws IOException if there's a network error
166+
* @throws IllegalStateException if user is already logged in
203167
*/
204168
public Response<LoginDetails> login(String emailId, String password, String tfaToken) throws IOException {
205-
if (this.authtoken != null) {
206-
throw new IllegalStateException(Util.USER_ALREADY_LOGGED_IN);
207-
}
208-
user = new User(this.instance);
209-
Response<LoginDetails> response = user.login(emailId, password, tfaToken).execute();
210-
setupLoginCredentials(response);
211-
user = new User(this.instance);
212-
return response;
169+
return login(emailId, password, tfaToken, null);
213170
}
171+
214172
/**
215173
* Login with TOTP/MFA support.
216174
*
@@ -224,30 +182,40 @@ public Response<LoginDetails> login(String emailId, String password, String tfaT
224182
* @throws IllegalStateException if user is already logged in
225183
*/
226184
public Response<LoginDetails> login(String emailId, String password, String tfaToken, String mfaSecret) throws IOException {
227-
String finalTfaToken = tfaToken;
228-
if (mfaSecret != null && !mfaSecret.isEmpty()) {
229-
finalTfaToken = generateTOTP(mfaSecret);
230-
}
185+
// Check if already logged in
231186
if (this.authtoken != null) {
232187
throw new IllegalStateException(Util.USER_ALREADY_LOGGED_IN);
233188
}
234-
if (finalTfaToken == null) {
189+
190+
// Validate inputs
191+
if (emailId == null || emailId.trim().isEmpty()) {
192+
throw new IllegalArgumentException("Email is required");
193+
}
194+
if (password == null || password.trim().isEmpty()) {
195+
throw new IllegalArgumentException("Password is required");
196+
}
197+
if ((tfaToken == null || tfaToken.trim().isEmpty()) && (mfaSecret == null || mfaSecret.trim().isEmpty())) {
235198
throw new IllegalArgumentException("Either tfaToken or mfaSecret must be provided");
236199
}
200+
201+
// Generate TOTP if needed
202+
String finalTfaToken = tfaToken;
203+
if ((tfaToken == null || tfaToken.trim().isEmpty()) && mfaSecret != null && !mfaSecret.trim().isEmpty()) {
204+
try {
205+
GoogleAuthenticator gAuth = new GoogleAuthenticator();
206+
finalTfaToken = String.format("%06d", gAuth.getTotpPassword(mfaSecret));
207+
} catch (Exception e) {
208+
throw new IllegalArgumentException("Failed to generate TOTP token: " + e.getMessage(), e);
209+
}
210+
}
211+
212+
// Perform login
237213
user = new User(this.instance);
238214
Response<LoginDetails> response = user.login(emailId, password, finalTfaToken).execute();
239215
setupLoginCredentials(response);
240216
return response;
241217
}
242218

243-
private String generateTOTP(String secret) {
244-
try {
245-
GoogleAuthenticator gAuth = new GoogleAuthenticator();
246-
return String.format("%06d", gAuth.getTotpPassword(secret));
247-
} catch (Exception e) {
248-
throw new IllegalArgumentException("Invalid MFA secret key", e);
249-
}
250-
}
251219

252220
private void setupLoginCredentials(Response<LoginDetails> loginResponse) throws IOException {
253221
if (loginResponse.isSuccessful()) {

‎src/main/java/com/contentstack/cms/user/User.java‎

Lines changed: 53 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
* @version v0.1.0
2525
* @since 2022-10-22
2626
*/
27-
public class User implements BaseImplementation {
27+
public class User implements BaseImplementation<User> {
2828

2929
protected final UserService userService;
3030
protected HashMap<String, String> headers;
@@ -80,44 +80,85 @@ private HashMap<String, String> loginHeader() {
8080
}
8181

8282
/**
83-
* Login call.
83+
* Login with TOTP token for two-factor authentication.
8484
*
8585
* @param email email for user to login
8686
* @param password password for user to login
87-
* @param tfaToken the tfa token
88-
* @return Call
87+
* @param tfaToken the TOTP token for two-factor authentication
88+
* @return Call containing login details
89+
* @throws IllegalArgumentException if email, password, or tfaToken is null or empty
8990
*/
90-
public Call<LoginDetails> login(@NotNull String email, @NotNull String password, @NotNull String tfaToken) {
91+
public Call<LoginDetails> login(@NotNull String email, @NotNull String password, String tfaToken) {
92+
if (tfaToken == null || tfaToken.trim().isEmpty()) {
93+
throw new IllegalArgumentException("TOTP token cannot be null or empty");
94+
}
9195
HashMap<String, HashMap<String, String>> userSession = new HashMap<>();
9296
userSession.put("user", setCredentials(email, password, tfaToken));
9397
JSONObject userDetail = new JSONObject(userSession);
9498
return this.userService.login(loginHeader(), userDetail);
9599
}
96100

97101
private HashMap<String, String> setCredentials(@NotNull String... arguments) {
102+
if (arguments == null || arguments.length < 2) {
103+
throw new IllegalArgumentException("Email and password are required");
104+
}
105+
if (arguments[0] == null || arguments[0].trim().isEmpty()) {
106+
throw new IllegalArgumentException("Email cannot be null or empty");
107+
}
108+
if (arguments[1] == null || arguments[1].trim().isEmpty()) {
109+
throw new IllegalArgumentException("Password cannot be null or empty");
110+
}
111+
98112
HashMap<String, String> credentials = new HashMap<>();
99113
credentials.put("email", arguments[0]);
100114
credentials.put("password", arguments[1]);
101-
if (arguments.length > 2) {
115+
116+
if (arguments.length > 2 && arguments[2] != null && !arguments[2].trim().isEmpty()) {
102117
credentials.put("tfa_token", arguments[2]);
103118
}
104119
return credentials;
105120
}
106121

107-
public Call<LoginDetails> login(@NotNull String email, @NotNull String password, @NotNull String tfaToken, String mfaSecret) {
122+
public Call<LoginDetails> login(@NotNull String email, @NotNull String password, String tfaToken, String mfaSecret) {
123+
if (email.trim().isEmpty()) {
124+
throw new IllegalArgumentException("Email cannot be empty");
125+
}
126+
if (password.trim().isEmpty()) {
127+
throw new IllegalArgumentException("Password cannot be empty");
128+
}
129+
if ((tfaToken == null || tfaToken.trim().isEmpty()) && (mfaSecret == null || mfaSecret.trim().isEmpty())) {
130+
throw new IllegalArgumentException("Either tfaToken or mfaSecret must be provided");
131+
}
132+
108133
String finalTfaToken = tfaToken;
109-
if (mfaSecret != null && !mfaSecret.isEmpty()) {
110-
finalTfaToken = generateTOTP(mfaSecret);
134+
if ((tfaToken == null || tfaToken.trim().isEmpty()) && mfaSecret != null && !mfaSecret.trim().isEmpty()) {
135+
try {
136+
finalTfaToken = generateTOTP(mfaSecret);
137+
} catch (IllegalArgumentException e) {
138+
throw new IllegalArgumentException("Failed to generate TOTP token: " + e.getMessage(), e);
139+
}
140+
}
141+
if (finalTfaToken == null || finalTfaToken.trim().isEmpty()) {
142+
throw new IllegalArgumentException("Failed to generate valid TOTP token");
111143
}
112144
return login(email, password, finalTfaToken);
113145
}
114146

115147
private String generateTOTP(String secret) {
148+
if (secret == null || secret.trim().isEmpty()) {
149+
throw new IllegalArgumentException("MFA secret cannot be null or empty");
150+
}
116151
try {
117152
GoogleAuthenticator gAuth = new GoogleAuthenticator();
118-
return String.format("%06d", gAuth.getTotpPassword(secret));
153+
String totp = String.format("%06d", gAuth.getTotpPassword(secret));
154+
if (!totp.matches("\\d{6}")) {
155+
throw new IllegalArgumentException("Generated TOTP token is invalid");
156+
}
157+
return totp;
158+
} catch (IllegalArgumentException e) {
159+
throw e;
119160
} catch (Exception e) {
120-
throw new IllegalArgumentException("Invalid MFA secret key", e);
161+
throw new IllegalArgumentException("Invalid MFA secret key: " + e.getMessage(), e);
121162
}
122163
}
123164

@@ -146,8 +187,7 @@ public Call<ResponseBody> getUser() {
146187
* @return Call
147188
*/
148189
public Call<ResponseBody> update(JSONObject body) {
149-
HashMap<String, String> headers = new HashMap<>();
150-
return userService.update(headers, body);
190+
return userService.update(new HashMap<>(), body);
151191
}
152192

153193
/**

‎src/test/java/com/contentstack/cms/TestClient.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ public class TestClient {
1717
public final static String USER_ID = (env.get("userId") != null) ? env.get("userId") : "c11e668e0295477f";
1818
public final static String OWNERSHIP = (env.get("ownershipToken") != null) ? env.get("ownershipToken")
1919
: "ownershipTokenId";
20+
// file deepcode ignore NonCryptoHardcodedSecret/test: <please specify a reason of ignoring this>
2021
public final static String API_KEY = (env.get("apiKey") != null) ? env.get("apiKey") : "apiKey99999999";
2122
public final static String MANAGEMENT_TOKEN = (env.get("managementToken") != null) ? env.get("managementToken")
2223
: "managementToken99999999";

‎src/test/java/com/contentstack/cms/models/LoginDetailTest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ void getterSetterUserModelLastName() {
102102
@Test
103103
void getterSetterUserModelUsername() {
104104
UserModel userModel = new UserModel();
105+
// deepcode ignore NoHardcodedCredentials/test: <please specify a reason of ignoring this>
105106
userModel.setUsername("***REMOVED***");
106107
Assertions.assertEquals("***REMOVED***",
107108
userModel.getUsername());

‎src/test/java/com/contentstack/cms/user/UserUnitTests.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -596,4 +596,115 @@ void testUserBaseParameters() {
596596
Assertions.assertEquals(0,
597597
requestInfo.url().queryParameterNames().size());
598598
}
599+
600+
@Test
601+
@Order(42)
602+
@DisplayName("Test login with TOTP token")
603+
void testLoginWithTOTPToken() {
604+
// Test basic login with TOTP token
605+
Request requestInfo = userInstance.login("test@example.com", "password", "123456").request();
606+
607+
// Verify request format
608+
Assertions.assertEquals("POST", requestInfo.method());
609+
Assertions.assertEquals("/v3/user-session", requestInfo.url().encodedPath());
610+
611+
// Verify request body
612+
String requestBody = requestInfo.body().toString();
613+
Assertions.assertTrue(requestBody.contains("\"tfa_token\":\"123456\""));
614+
}
615+
616+
@Test
617+
@Order(43)
618+
@DisplayName("Test login with MFA parameters")
619+
void testLoginWithMFAParameters() {
620+
// Test login with both token and secret (token should be used)
621+
Request requestInfo = userInstance.login("test@example.com", "password", "123456", "test-secret").request();
622+
623+
// Verify request format
624+
Assertions.assertEquals("POST", requestInfo.method());
625+
Assertions.assertEquals("/v3/user-session", requestInfo.url().encodedPath());
626+
627+
// Verify request body uses token
628+
String requestBody = requestInfo.body().toString();
629+
Assertions.assertTrue(requestBody.contains("\"tfa_token\":\"123456\""));
630+
}
631+
632+
@Test
633+
@Order(44)
634+
@DisplayName("Test login validation")
635+
void testLoginValidation() {
636+
// Test with missing required parameters
637+
Assertions.assertThrows(IllegalArgumentException.class,
638+
() -> userInstance.login(null, "password", "123456").request());
639+
640+
Assertions.assertThrows(IllegalArgumentException.class,
641+
() -> userInstance.login("test@example.com", null, "123456").request());
642+
643+
Assertions.assertThrows(IllegalArgumentException.class,
644+
() -> userInstance.login("test@example.com", "password", null).request());
645+
}
646+
647+
@Test
648+
@Order(45)
649+
@DisplayName("Test TOTP generation from MFA secret")
650+
void testTOTPGenerationFromSecret() {
651+
// Test login with MFA secret only
652+
Request requestInfo = userInstance.login("test@example.com", "password", null, "test-secret").request();
653+
654+
// Verify request format
655+
Assertions.assertEquals("POST", requestInfo.method());
656+
Assertions.assertEquals("/v3/user-session", requestInfo.url().encodedPath());
657+
658+
// Verify generated TOTP format
659+
String requestBody = requestInfo.body().toString();
660+
Assertions.assertTrue(requestBody.contains("\"tfa_token\":\""));
661+
662+
// Extract TOTP token and verify it's 6 digits
663+
String token = requestBody.split("\"tfa_token\":\"")[1].split("\"")[0];
664+
Assertions.assertTrue(token.matches("\\d{6}"), "TOTP should be 6 digits");
665+
}
666+
667+
@Test
668+
@Order(46)
669+
@DisplayName("Test invalid MFA secret handling")
670+
void testInvalidMFASecret() {
671+
// Test with invalid MFA secret
672+
IllegalArgumentException exception = Assertions.assertThrows(
673+
IllegalArgumentException.class,
674+
() -> userInstance.login("test@example.com", "password", null, "invalid-secret").request()
675+
);
676+
677+
Assertions.assertTrue(exception.getMessage().contains("Invalid MFA secret key"));
678+
}
679+
680+
@Test
681+
@Order(47)
682+
@DisplayName("Test TOTP token priority over MFA secret")
683+
void testTOTPPriority() {
684+
// When both token and secret are provided, token should be used
685+
Request requestInfo = userInstance.login("test@example.com", "password", "123456", "test-secret").request();
686+
String requestBody = requestInfo.body().toString();
687+
688+
// Should use provided token, not generate from secret
689+
Assertions.assertTrue(requestBody.contains("\"tfa_token\":\"123456\""));
690+
}
691+
692+
@Test
693+
@Order(48)
694+
@DisplayName("Test null/empty MFA parameters")
695+
void testNullEmptyMFAParams() {
696+
// Test with both null
697+
IllegalArgumentException exception1 = Assertions.assertThrows(
698+
IllegalArgumentException.class,
699+
() -> userInstance.login("test@example.com", "password", null, null).request()
700+
);
701+
Assertions.assertTrue(exception1.getMessage().contains("Either tfaToken or mfaSecret must be provided"));
702+
703+
// Test with empty secret
704+
IllegalArgumentException exception2 = Assertions.assertThrows(
705+
IllegalArgumentException.class,
706+
() -> userInstance.login("test@example.com", "password", null, "").request()
707+
);
708+
Assertions.assertTrue(exception2.getMessage().contains("Either tfaToken or mfaSecret must be provided"));
709+
}
599710
}

0 commit comments

Comments
 (0)