AdityaandClaude Opus 4.7
45a041b023
Backend:
- New dependency dev.samstevens.totp:totp:1.7.1 (bundles ZXing for QR PNG).
- TotpService: secret/QR/otpauth-URL/verify primitives. SHA1, 6 digits, 30s —
the standard combo every consumer authenticator app accepts unconfigured.
Issuer label is configurable via FINERACT_MFA_TOTP_ISSUER, defaults to
"CBSnexora".
- Two-step device mapping driven by TotpEnrollmentService:
* POST /v1/mfa/totp/setup — generate secret, upsert m_user_mfa_factor row
as factor_type=TOTP/verified=false, return {secret, qrDataUri, otpAuthUrl,
issuer, factorId}. Refuses to overwrite an already-verified-and-active
factor so an accidental click can't unbind the user's working device.
* POST /v1/mfa/totp/verify — body {code}; verify against the stored secret
and flip verified=true on success.
- Login wiring in MfaFactorBackedTwoFactorServiceImpl:
* getDeliveryMethodsForUser surfaces verified TOTP factors as
{name:"totp", target:"Google Authenticator"} so the picker offers it
alongside SMS/EMAIL.
* createNewOTPToken("totp") creates a no-op OTPRequest (no LincPay/SMTP
round-trip) carrying the factor id in the token field so validate can
look up the secret.
* createAccessTokenFromOTP branches on channel — TOTP path verifies code
vs factor.secret with totp library (sliding 1-step window) and mints
a TFAccessToken with the same lifetime + extended-token logic as OTP.
* Defence-in-depth: re-checks at validate time that the factor still
belongs to the user, is verified, and not disabled.
- TwoFactorConstants.TOTP_DELIVERY_METHOD_NAME = "totp".
- SecurityConfig: /api/*/mfa/totp/** is fullyAuthenticated() (exempt from
the TFA gate so users can enrol before they can satisfy 2FA).
UI changes pending (see chat): add a "Google Authenticator" tile on the
MFA Factors settings page that calls /setup → shows QR + secret → calls
/verify; extend two-factor-authentication.component.ts iconFor() and copy
for the new "totp" delivery method. Existing requestOTP / validateOTP
pipeline handles the login flow transparently.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
77 lines
6.7 KiB
JSON
77 lines
6.7 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(taskkill //PID 24168 //F)",
|
|
"Bash(PGPASSWORD=postgres psql -h localhost -U postgres -d fineract_default -c \"SELECT id, display_name, date_of_birth FROM m_client ORDER BY id DESC LIMIT 5;\")",
|
|
"Bash(taskkill //PID 10112 //F)",
|
|
"Bash(taskkill //PID 39420 //F)",
|
|
"Bash(curl -sk -u \"mifos:password\" -H \"fineract-platform-tenantid: default\" \"https://localhost:8443/fineract-provider/api/v1/rbi-feeds\")",
|
|
"Bash(sort -t: -k2 -n)",
|
|
"Bash(curl -sk -u \"mifos:password\" -H \"fineract-platform-tenantid: default\" \"https://localhost:8443/fineract-provider/api/v1/rbi-feeds/144\")",
|
|
"Bash(curl -sk -u \"mifos:password\" -H \"fineract-platform-tenantid: default\" \"https://localhost:8443/fineract-provider/api/v1/openproject/work-packages?pageSize=10&offset=1\")",
|
|
"Bash(curl -sk -u \"mifos:password\" -H \"fineract-platform-tenantid: default\" -H \"Content-Type: application/json\" -X POST \"https://localhost:8443/fineract-provider/api/v1/rbi-feeds/sync-openproject\" -d '{}')",
|
|
"Bash(taskkill //PID 36832 //F)",
|
|
"Bash(mvn clean:*)",
|
|
"Bash(where mvn.cmd)",
|
|
"Bash(where mvn:*)",
|
|
"Read(//c/Program Files/**)",
|
|
"Read(//c/Users/adity/**)",
|
|
"Bash(echo \"$MAVEN_HOME\")",
|
|
"Bash(xargs basename:*)",
|
|
"Bash(./gradlew :fineract-tax:compileJava)",
|
|
"Bash(grep -n \"INSERT INTO \\\\`m_role\\\\`\\\\|INSERT INTO m_role\\\\|INSERT INTO \\\\`m_permission\\\\`\\\\|INSERT INTO m_permission\" /c/Users/adity/Music/CBS/fineract/fineract-provider/src/main/resources/sql/migrations/sample_data/load_sample_data.sql)",
|
|
"Bash(npm start:*)",
|
|
"Bash(grep -oP \"^\\\\\\\\\\(''''\\([^'''']+\\)''''\" \"c:\\\\Users\\\\adity\\\\Music\\\\CBS\\\\fineract\\\\fineract-db\\\\old-schema-files\\\\0003-mifosx-permissions-and-authorisation-utf8.sql\")",
|
|
"Bash(tasklist)",
|
|
"Bash(wmic process:*)",
|
|
"Bash(powershell -Command \"Get-CimInstance Win32_Process -Filter \"\"Name=''java.exe''\"\" | Select-Object ProcessId, @{N=''Cmd'';E={$_.CommandLine.Substring\\(0, [Math]::Min\\(200, $_.CommandLine.Length\\)\\)}} | Format-Table -AutoSize\")",
|
|
"Bash(psql -U postgres -d fineract_default -c \"UPDATE databasechangelog SET md5sum = NULL WHERE id = ''0231-1'' AND filename = ''db/changelog/tenant/parts/0231_add_menu_permissions.xml'';\" -c \"UPDATE m_permission SET grouping = ''menu'' WHERE code LIKE ''MENU_%'' AND entity_name = ''MENU'';\")",
|
|
"Bash(PGPASSWORD=root psql -U postgres -d fineract_default -c \"UPDATE databasechangelog SET md5sum = NULL WHERE id = ''0231-1'' AND filename = ''db/changelog/tenant/parts/0231_add_menu_permissions.xml'';\" -c \"UPDATE m_permission SET grouping = ''menu'' WHERE code LIKE ''MENU_%'' AND entity_name = ''MENU'';\")",
|
|
"Bash(PGPASSWORD=root psql -U postgres -d fineract_default -c \"UPDATE databasechangelog SET md5sum = NULL WHERE id = ''0231-1'' AND filename = ''db/changelog/tenant/parts/0231_add_menu_permissions.xml'';\" -c \"UPDATE m_permission SET grouping = ''heading_menu'' WHERE code LIKE ''MENU_%'' AND entity_name = ''MENU'';\")",
|
|
"Bash(grep -l \"pan_full_name\\\\|pan_category\\\\|pan_status\\\\|pan_aadhaar\" \"c:\\\\Users\\\\adity\\\\Music\\\\CBS\\\\fineract\\\\fineract-provider\\\\src\\\\main\\\\resources\\\\db\\\\changelog\\\\tenant\\\\parts\"/*.xml)",
|
|
"Bash(grep -l \"m_client_kyc\" \"c:\\\\Users\\\\adity\\\\Music\\\\CBS\\\\fineract\\\\fineract-provider\\\\src\\\\main\\\\resources\\\\db\\\\changelog\\\\tenant\\\\parts\"/*.xml)",
|
|
"Bash(./gradlew devRun -x test -x spotlessCheck)",
|
|
"Bash(taskkill //F //FI \"IMAGENAME eq java.exe\")",
|
|
"Bash(./gradlew bootRun)",
|
|
"Bash(curl -sk -X POST \"https://localhost:8443/fineract-provider/api/v1/authentication?username=mifos&password=password\" -H 'Fineract-Platform-TenantId: default' -H 'Content-Type: application/json')",
|
|
"Bash(curl -sk \"https://localhost:8443/fineract-provider/api/v1/clients?limit=5\" -H \"Fineract-Platform-TenantId: default\" -u \"mifos:password\")",
|
|
"Bash(curl -sk -X POST \"https://localhost:8443/fineract-provider/api/v1/authentication\" -H \"Fineract-Platform-TenantId: default\" -H \"Content-Type: application/json\" -d '{\"\"username\"\":\"\"mifos\"\",\"\"password\"\":\"\"password\"\"}')",
|
|
"Bash(curl -sk \"https://localhost:8443/fineract-provider/api/v1/clients?limit=5\" -H \"Fineract-Platform-TenantId: default\" -H \"Authorization: Basic bWlmb3M6cGFzc3dvcmQ=\")",
|
|
"Bash(./gradlew :fineract-provider:devRun --console=plain)",
|
|
"Bash(curl -k -o /tmp/test-helper.jar -w \"HTTP %{http_code} size=%{size_download} bytes\\\\n\" https://localhost:8443/fineract-provider/api/v1/dsc/helper.jar)",
|
|
"Bash(powershell -Command \"Get-Process java -ErrorAction SilentlyContinue | Select-Object Id, StartTime | Format-List\")",
|
|
"Bash(./gradlew :fineract-provider:compileJava --console=plain)",
|
|
"Bash(./gradlew :fineract-provider:compileJava :fineract-security:compileJava -q)",
|
|
"Bash(./gradlew :fineract-provider:compileJava -q)",
|
|
"PowerShell(Get-NetTCPConnection -LocalPort 8443 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalPort, OwningProcess, @{Name='ProcessName';Expression={\\(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue\\).ProcessName}}, @{Name='StartTime';Expression={\\(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue\\).StartTime}})",
|
|
"PowerShell(Get-NetTCPConnection -LocalPort 8443 -ErrorAction SilentlyContinue | Format-Table LocalPort, State, OwningProcess, @{Name='ProcessName';Expression={\\(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue\\).ProcessName}} -AutoSize; netstat -ano | Select-String \":8443\")",
|
|
"PowerShell(Get-Process -Id 9340 -ErrorAction SilentlyContinue | Select-Object Id, ProcessName, StartTime, @{Name='MemMB';Expression={[math]::Round\\($_.WorkingSet64/1MB,0\\)}}, Path | Format-List)",
|
|
"Bash(git -c core.editor=true rebase --continue)",
|
|
"Bash(git rebase *)",
|
|
"Bash(rm -rf .git/rebase-merge; git status -sb | head -3)",
|
|
"Bash(git -c commit.gpgsign=false commit -m ' *)",
|
|
"Bash(git pull *)",
|
|
"Bash(./gradlew :fineract-security:compileJava :fineract-provider:compileJava -q)",
|
|
"Bash(git ls-remote *)"
|
|
],
|
|
"additionalDirectories": [
|
|
"c:\\Users\\adity\\Music\\CBS\\cfcfrms-bank-api",
|
|
"C:\\Users\\adity\\Music\\CBS\\UI\\web-app\\src\\assets\\translations",
|
|
"C:\\Users\\adity\\Music\\CBS\\fineract\\.git\\rebase-merge"
|
|
]
|
|
},
|
|
"hooks": {
|
|
"PostToolUse": [
|
|
{
|
|
"matcher": "Write|Edit|MultiEdit|NotebookEdit",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/post-tool-call.py\""
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|