Package io.meeds.social.security.plugin

Class EmailOtpPlugin

java.lang.Object
io.meeds.social.security.plugin.EmailOtpPlugin
All Implemented Interfaces:
io.meeds.web.security.plugin.OtpPlugin
Direct Known Subclasses:
AccountDeactivationEmailOtpPlugin, UserAccountEmailOtpPlugin
@Service public class EmailOtpPlugin extends Object implements io.meeds.web.security.plugin.OtpPlugin
Generates, caches and validates email OTP codes: the code is stored under a purpose-bound cache key (getCacheKey(String)) and the email is sent through the common BrandedEmailSender with a per-plugin content fragment and subject key.

  • Constructor Details

    • EmailOtpPlugin

      public EmailOtpPlugin()

  • Method Details

    • getName

      public String getName()
      Specified by:
      getName in interface io.meeds.web.security.plugin.OtpPlugin

    • canUse

      public boolean canUse(String userName)
      Specified by:
      canUse in interface io.meeds.web.security.plugin.OtpPlugin

    • validateOtp

      public boolean validateOtp(String userName, String otpCode)
      A wrong code keeps the send lock, unless the method releases it (releasesSendLockOnWrongCode()): the user then may ask for a new code at once instead of waiting out the send interval, bounded by the attempts the validating service counts per code
      Specified by:
      validateOtp in interface io.meeds.web.security.plugin.OtpPlugin

    • releasesSendLockOnWrongCode

      protected boolean releasesSendLockOnWrongCode()
      Whether a wrong code lifts the send lock of this method. False here: the email change, API key and account deactivation flows keep waiting out the send interval after a wrong code

    • consumeOtp

      public boolean consumeOtp(String userName, String otpCode)
      Removes the code from the cache, so that it never validates again. Only the request that removes it wins: a concurrent one finds it gone.
      Specified by:
      consumeOtp in interface io.meeds.web.security.plugin.OtpPlugin

    • getCodeTtlMinutes

      public long getCodeTtlMinutes()
      Specified by:
      getCodeTtlMinutes in interface io.meeds.web.security.plugin.OtpPlugin

    • getSendIntervalSeconds

      public long getSendIntervalSeconds()
      Specified by:
      getSendIntervalSeconds in interface io.meeds.web.security.plugin.OtpPlugin

    • generateOtpCode

      public void generateOtpCode(String userName)
      Specified by:
      generateOtpCode in interface io.meeds.web.security.plugin.OtpPlugin

    • getCacheKey

      protected String getCacheKey(String userName)
      Key under which the OTP code of a user is stored, distinct by plugin so that a code generated for one purpose can never validate another one

    • getEmailSubjectKey

      protected String getEmailSubjectKey()