feat(users): auto-enroll admin-chosen OTP channel as MFA factor at creation

Admin now picks a mandatory OTP delivery method (Email/Mobile) when creating a user. The channel is enrolled immediately as a verified m_user_mfa_factor row, so the existing 2FA system (MfaFactorBackedTwoFactorServiceImpl + /twofactor) challenges the user for OTP on their very first login - reusing the already-built login-OTP infrastructure instead of a parallel flow. Also adds a versioned, admin-manageable user-agreement (disclaimer) API (/v1/useragreements) with per-user acceptance tracking, checked right after every login, plus a Liquibase cleanup migration and a shared OTP-destination masking utility extracted from the two existing login-OTP services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-24 16:16:40 +05:30
parent cf60515bf6
commit 5dc175c5e1
26 changed files with 1140 additions and 29 deletions
@@ -0,0 +1,53 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.otp.util;
+
+/**
+ * Shared masking logic for OTP delivery destinations (mobile number / email address), so the destination can be
+ * shown to a user for confirmation ("OTP sent to ******1234") without exposing the full value.
+ *
+ * <p>
+ * Extracted, verbatim, from the private {@code mask()} methods that previously lived independently in
+ * {@code LoginOtpServiceImpl} (SMS) and {@code EmailLoginOtpServiceImpl} (Email) — this is a pure refactor with no
+ * behaviour change; both services now delegate here instead of maintaining their own copy.
+ */
+public final class OtpDestinationMasker {
+
+    private OtpDestinationMasker() {}
+
+    public static String maskMobile(final String mobile) {
+        if (mobile == null || mobile.length() < 4) {
+            return "****";
+        }
+        return "******" + mobile.substring(mobile.length() - 4);
+    }
+
+    public static String maskEmail(final String email) {
+        if (email == null || !email.contains("@")) {
+            return "****";
+        }
+        final int at = email.indexOf('@');
+        final String local = email.substring(0, at);
+        final String domain = email.substring(at);
+        if (local.length() <= 2) {
+            return "*" + local.substring(local.length() - 1) + domain;
+        }
+        return local.charAt(0) + "***" + local.charAt(local.length() - 1) + domain;
+    }
+}