Merge branch 'release/v11' of https://github.com/utmstack/UTMStack into release/v11

Author: Kbayero

backend/src/main/java/com/park/utmstack/domain/tfa/TfaSetupState.java

@@ -1,14 +1,13 @@
 package com.park.utmstack.domain.tfa;
 
-import lombok.Getter;
-import lombok.ToString;
+import lombok.Data;
 
-@Getter
-@ToString
+@Data
 public class TfaSetupState {
-    private final String secret;
-    private final long expiresAt;
-    private final long setupStartedAt;
+    private  String secret;
+    private String lastUsedCode;
+    private  long expiresAt;
+    private  long setupStartedAt;
 
     public TfaSetupState(String secret, long expiresAt) {
         this.secret = secret;

backend/src/main/java/com/park/utmstack/service/tfa/TfaService.java

@@ -23,7 +23,7 @@ private TfaMethodService getMethodService(TfaMethod method) {
         return methodServices.stream()
                 .filter(service -> service.getMethod().equals(method))
                 .findFirst()
-                .orElseThrow(() -> new IllegalArgumentException("Método TFA no soportado: " + method));
+                .orElseThrow(() -> new IllegalArgumentException("TFA method not supported: " + method));
     }
 
     public TfaInitResponse initiateSetup(User user, TfaMethod method) {

backend/src/main/java/com/park/utmstack/service/tfa/TotpTfaService.java

@@ -63,7 +63,13 @@ public TfaVerifyResponse verifyCode(User user, String code) {
                 .orElseThrow(() -> new IllegalStateException("No TFA setup found for user: " + user.getLogin()));
 
         boolean expired = tfaSetupState.isExpired();
-        boolean valid = !expired && authenticator.authorize(tfaSetupState.getSecret(), Integer.parseInt(code));
+        boolean valid = !expired && authenticator.authorize(tfaSetupState.getSecret(), Integer.parseInt(code)) && !code.equals(tfaSetupState.getLastUsedCode());
+
+        if(expired){
+            tfaSetupState.setLastUsedCode(code);
+            tfaSetupState.setExpiresAt(System.currentTimeMillis() + Constants.EXPIRES_IN_SECONDS * 1000);
+            cache.storeState(user.getLogin(), TfaMethod.TOTP, tfaSetupState);
+        }
 
         return new TfaVerifyResponse(
                 valid,

filters/filebeat/system_linux_module.yml

@@ -31,6 +31,14 @@ pipeline:
           from:
             - log.host.hostname
           to: origin.host
+      - rename:
+          from:
+            - log.host.name
+          to: origin.user
+      - rename:
+          from:
+            - log.host.id
+          to: log.hostId
       - rename:
           from:
             - log.event.dataset

filters/sophos/sophos_xg_firewall.yml

@@ -738,4 +738,4 @@ pipeline:
             - log.logcomponent
             - log.logsubtype
             - log.name
-            - log.logtype
+            - log.logtype

filters/windows/windows-events.yml

@@ -2968,4 +2968,4 @@ pipeline:
             - log.metadata
             - log.event
             - log.ecs
-            - log.log
+            - log.log

plugins/alerts/main.go

@@ -3,15 +3,16 @@ package main
 import (
 	"context"
 	"fmt"
+	"net"
+	"os"
+	"strings"
+	"time"
+
 	"github.com/threatwinds/go-sdk/catcher"
 	"github.com/threatwinds/go-sdk/opensearch"
 	"github.com/threatwinds/go-sdk/plugins"
 	"github.com/threatwinds/go-sdk/utils"
 	"github.com/tidwall/gjson"
-	"net"
-	"os"
-	"strings"
-	"time"
 
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"