Merge pull request #2694 from overleaf/ta-jl-otp

Two Factor Authentication for Staff

GitOrigin-RevId: 7028e93cb4a4cd88c138a52b0528817056b930d9

services/web/app/src/models/User.js

@@ -143,7 +143,12 @@ const UserSchema = new Schema({
   awareOfV2: { type: Boolean, default: false },
   samlIdentifiers: { type: Array, default: [] },
   thirdPartyIdentifiers: { type: Array, default: [] },
-  migratedAt: { type: Date }
+  migratedAt: { type: Date },
+  twoFactorAuthentication: {
+    createdAt: { type: Date },
+    enrolledAt: { type: Date },
+    secret: { type: String }
+  }
 })
 
 exports.User = mongoose.model('User', UserSchema)

services/web/config/settings.defaults.coffee

@@ -224,6 +224,10 @@ module.exports = settings =
 
 	httpAuthUsers: httpAuthUsers
 
+	twoFactorAuthentication:
+		enabled: false
+		requiredForStaff: false
+
 	# Default features
 	# ----------------
 	#

services/web/package.json

@@ -91,6 +91,7 @@
     "nodemailer-ses-transport": "^1.3.0",
     "nvd3": "^1.8.6",
     "oauth2-server": "^3.0.1",
+    "otplib": "^12.0.1",
     "p-limit": "^2.2.1",
     "passport": "^0.3.2",
     "passport-google-oauth20": "^1.0.0",
@@ -103,6 +104,7 @@
     "passport-twitter": "^1.0.4",
     "pdfjs-dist": "^2.2.228",
     "pug": "^2.0.0-beta6",
+    "qrcode": "^1.4.4",
     "react": "^15.4.2",
     "react-dom": "^15.4.2",
     "redis-sharelatex": "^1.0.12",

services/web/transform-absolute-paths.sh

@@ -9,7 +9,7 @@ npx jscodeshift \
   --ignore-pattern=test/frontend/import_tests.js \
   test/frontend
 
-for MODULE in admin-panel cms dropbox git-bridge github-sync launchpad metrics open-in-overleaf overleaf-integration portals references-search support templates tpr-webmodule v2-templates
+for MODULE in admin-panel cms dropbox git-bridge github-sync launchpad metrics open-in-overleaf overleaf-integration portals references-search support templates tpr-webmodule v2-templates two-factor-authentication
 do
   npx jscodeshift \
   -t transform.js \

services/web/transform.js

@@ -11,7 +11,8 @@ function getRelativePath(importPath, filePath) {
   if (
     importPath.startsWith('crypto-js') ||
     importPath.startsWith('moment') ||
-    importPath.startsWith('algoliasearch')
+    importPath.startsWith('algoliasearch') ||
+    importPath.startsWith('qrcode')
   ) {
     return importPath
   }