Merge branch 'backlog/google-tfa' into release/v11

# Conflicts:
#	backend/src/main/resources/config/liquibase/changelog/20250814001_adding_suricata.xml
#	backend/src/main/resources/config/liquibase/master.xml
#	frontend/src/environments/environment.ts

Author: mjabascal10

backend/pom.xml

@@ -351,6 +351,31 @@
             <artifactId>tika-core</artifactId>
             <version>2.9.1</version>
         </dependency>
+
+        <dependency>
+            <groupId>com.warrenstrange</groupId>
+            <artifactId>googleauth</artifactId>
+            <version>1.4.0</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.google.zxing</groupId>
+            <artifactId>core</artifactId>
+            <version>3.4.1</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.google.zxing</groupId>
+            <artifactId>javase</artifactId>
+            <version>3.4.1</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>3.0.5</version>
+        </dependency>
+
     </dependencies>
 
     <build>

backend/src/main/java/com/park/utmstack/config/Constants.java

@@ -35,6 +35,10 @@ public final class Constants {
     public static final String PROP_DATE_SETTINGS_TIMEZONE = "utmstack.time.zone";
     public static final String PROP_NETWORK_SCAN_API_URL = "utmstack.networkScan.apiUrl";
     public static final String PROP_TFA_ENABLE = "utmstack.tfa.enable";
+    public static final String PROP_TFA_METHOD = "utmstack.tfa.method";
+    public static final int EXPIRES_IN_SECONDS = 30;
+    public static final int INIT_EXPIRES_IN_SECONDS = 300;
+    public static final String TFA_ISSUER = "UTMStack";
 
     // ----------------------------------------------------------------------------------
     // - Modules checks

backend/src/main/java/com/park/utmstack/config/TfaCacheConfig.java

@@ -0,0 +1,21 @@
+package com.park.utmstack.config;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import com.park.utmstack.domain.tfa.TfaSetupState;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.time.Duration;
+
+@Configuration
+public class TfaCacheConfig {
+
+    @Bean
+    public Cache<String, TfaSetupState> tfaSetupCache() {
+        return Caffeine.newBuilder()
+                .expireAfterWrite(Duration.ofMinutes(10))
+                .maximumSize(1000)
+                .build();
+    }
+}

backend/src/main/java/com/park/utmstack/domain/tfa/TfaMethod.java

@@ -0,0 +1,16 @@
+package com.park.utmstack.domain.tfa;
+
+import java.util.Arrays;
+
+public enum TfaMethod {
+    EMAIL,
+    TOTP;
+
+    public static TfaMethod fromString(String value) {
+        return Arrays.stream(values())
+                .filter(m -> m.name().equalsIgnoreCase(value))
+                .findFirst()
+                .orElseThrow(() -> new IllegalArgumentException("Unsupported TFA method: " + value));
+    }
+}
+

backend/src/main/java/com/park/utmstack/domain/tfa/TfaSetupState.java

@@ -0,0 +1,29 @@
+package com.park.utmstack.domain.tfa;
+
+import lombok.Getter;
+import lombok.ToString;
+
+@Getter
+@ToString
+public class TfaSetupState {
+    private final String secret;
+    private final long expiresAt;
+    private final long setupStartedAt;
+
+    public TfaSetupState(String secret, long expiresAt) {
+        this.secret = secret;
+        this.expiresAt = expiresAt;
+        this.setupStartedAt = System.currentTimeMillis();
+    }
+
+    public boolean isExpired() {
+        return System.currentTimeMillis() > expiresAt;
+    }
+
+    public long getRemainingSeconds() {
+        long remaining = expiresAt - System.currentTimeMillis();
+        return Math.max(remaining / 1000, 0);
+    }
+}
+
+

backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterService.java

@@ -3,8 +3,10 @@
 import com.park.utmstack.config.Constants;
 import com.park.utmstack.domain.UtmConfigurationParameter;
 import com.park.utmstack.domain.application_events.enums.ApplicationEventType;
+import com.park.utmstack.domain.tfa.TfaMethod;
 import com.park.utmstack.repository.UtmConfigurationParameterRepository;
 import com.park.utmstack.service.application_events.ApplicationEventService;
+import com.park.utmstack.service.tfa.TfaService;
 import com.park.utmstack.util.CipherUtil;
 import com.park.utmstack.util.exceptions.UtmMailException;
 import org.slf4j.Logger;
@@ -24,7 +26,7 @@
 import java.util.Optional;
 import java.util.stream.Collectors;
 
-import static com.park.utmstack.config.Constants.DATE_FORMAT_SETTING_ID;
+import static com.park.utmstack.config.Constants.*;
 
 /**
  * Service Implementation for managing UtmConfigurationParameter.
@@ -40,15 +42,17 @@ public class UtmConfigurationParameterService {
     private final UserService userService;
     private final MailService mailService;
     private final ApplicationEventService applicationEventService;
+    private final TfaService tfaService;
 
     public UtmConfigurationParameterService(UtmConfigurationParameterRepository configParamRepository,
                                             UserService userService,
                                             MailService mailService,
-                                            ApplicationEventService applicationEventService) {
+                                            ApplicationEventService applicationEventService, TfaService tfaService) {
         this.configParamRepository = configParamRepository;
         this.userService = userService;
         this.mailService = mailService;
         this.applicationEventService = applicationEventService;
+        this.tfaService = tfaService;
     }
 
     @EventListener(ApplicationReadyEvent.class)
@@ -80,11 +84,24 @@ public void init() {
     public void saveAll(List<UtmConfigurationParameter> params) throws UtmMailException {
         final String ctx = CLASSNAME + ".saveAll";
         try {
-            // If the configuration to save is: Enable Two-Factor Authentication then we need to check
-            // if the email configuration is OK
-            params.stream().filter(p -> p.getConfParamShort().equals(Constants.PROP_TFA_ENABLE)
-                            && Boolean.parseBoolean(p.getConfParamValue()))
-                    .findFirst().ifPresent(tfa -> validateMailConfOnMFAActivation());
+
+            Boolean tfaEnabledParam = params.stream()
+                    .filter(p -> p.getConfParamShort().equals(Constants.PROP_TFA_ENABLE))
+                    .findFirst()
+                    .map(p -> Boolean.parseBoolean(p.getConfParamValue()))
+                    .orElse(Boolean.valueOf(CFG.get(PROP_TFA_ENABLE)));
+
+            TfaMethod tfaMethodParam = params.stream()
+                    .filter(p -> p.getConfParamShort().equals(Constants.PROP_TFA_METHOD))
+                    .findFirst()
+                    .map(p -> TfaMethod.valueOf(p.getConfParamValue()))
+                    .orElse(null);
+
+            if (tfaEnabledParam && tfaMethodParam != null) {
+                tfaService.persistConfiguration(tfaMethodParam);
+                log.info("TFA enabled with method: {}", tfaMethodParam);
+            }
+
 
             Map<String, String> cfg = new HashMap<>();
             for (UtmConfigurationParameter p : params) {
@@ -148,7 +165,7 @@ public Map<String, String> getValueMapForDateSetting() throws Exception {
         }
     }
 
-    private void validateMailConfOnMFAActivation() throws UtmMailException {
+    public void validateMailConfOnMFAActivation() throws UtmMailException {
         final String ctx = CLASSNAME + ".validateMailConfOnMFAActivation";
         try {
             mailService.sendCheckEmail(List.of(userService.getCurrentUserLogin().getEmail()));

backend/src/main/java/com/park/utmstack/service/dto/jwt/JWTToken.java

@@ -0,0 +1,35 @@
+package com.park.utmstack.service.dto.jwt;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.park.utmstack.domain.tfa.TfaMethod;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+@Data
+public class JWTToken {
+    private String idToken;
+    private boolean authenticated;
+    private String tfaMethod;
+
+    public JWTToken(String idToken, boolean authenticated, String tfaMethod) {
+        this.idToken = idToken;
+        this.authenticated = authenticated;
+        this.tfaMethod = tfaMethod;
+    }
+
+    public JWTToken(String idToken, boolean authenticated) {
+        this.idToken = idToken;
+        this.authenticated = authenticated;
+        this.tfaMethod = null;
+    }
+
+    @JsonProperty("id_token")
+    String getIdToken() {
+        return idToken;
+    }
+
+    void setIdToken(String idToken) {
+        this.idToken = idToken;
+    }
+
+}

backend/src/main/java/com/park/utmstack/service/dto/tfa/init/Delivery.java

@@ -0,0 +1,14 @@
+package com.park.utmstack.service.dto.tfa.init;
+
+import com.park.utmstack.domain.tfa.TfaMethod;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class Delivery {
+    private TfaMethod method;
+    private String target;
+}

backend/src/main/java/com/park/utmstack/service/dto/tfa/init/TfaInitRequest.java

@@ -0,0 +1,13 @@
+package com.park.utmstack.service.dto.tfa.init;
+
+import com.park.utmstack.domain.tfa.TfaMethod;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class TfaInitRequest {
+    private TfaMethod method;
+}

backend/src/main/java/com/park/utmstack/service/dto/tfa/init/TfaInitResponse.java

@@ -0,0 +1,14 @@
+package com.park.utmstack.service.dto.tfa.init;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@AllArgsConstructor
+@NoArgsConstructor
+public class TfaInitResponse {
+    private String status;
+    private Delivery delivery;
+    private long expiresInSeconds;
+}