Method postRequestOneTimePasscode

coderd/userauth.go:230–308

Requests a one-time passcode for a user. @Summary Request one-time passcode @ID request-one-time-passcode @Accept json @Tags Authorization @Param request body codersdk.RequestOneTimePasscodeRequest true "One-time passcode request" @Success 204 @Router /api/v2/users/otp/request [post]

(rw http.ResponseWriter, r *http.Request)

// @Success 204
// @Router /api/v2/users/otp/request [post]
func (api *API) postRequestOneTimePasscode(rw http.ResponseWriter, r *http.Request) {
	var (
		ctx               = r.Context()
		auditor           = api.Auditor.Load()
		logger            = api.Logger.Named(userAuthLoggerName)
		aReq, commitAudit = audit.InitRequest[database.User](rw, &audit.RequestParams{
			Audit:   *auditor,
			Log:     api.Logger,
			Request: r,
			Action:  database.AuditActionRequestPasswordReset,
		})
	)
	defer commitAudit()

	if api.DeploymentValues.DisablePasswordAuth {
		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
			Message: "Password authentication is disabled.",
		})
		return
	}

	var req codersdk.RequestOneTimePasscodeRequest
	if !httpapi.Read(ctx, rw, r, &req) {
		return
	}

	defer func() {
		// We always send the same response. If we give a more detailed response
		// it would open us up to an enumeration attack.
		rw.WriteHeader(http.StatusNoContent)
	}()

	//nolint:gocritic // In order to request a one-time passcode, we need to get the user first - and can only do that in the system auth context.
	user, err := api.Database.GetUserByEmailOrUsername(dbauthz.AsSystemRestricted(ctx), database.GetUserByEmailOrUsernameParams{
		Email: req.Email,
	})
	if err != nil && !errors.Is(err, sql.ErrNoRows) {
		logger.Error(ctx, "unable to get user by email", slog.Error(err))
		return
	}
	// We continue if err == sql.ErrNoRows to help prevent a timing-based attack.
	aReq.Old = user
	aReq.UserID = user.ID

	passcode := uuid.New()
	passcodeExpiresAt := dbtime.Now().Add(api.OneTimePasscodeValidityPeriod)

	hashedPasscode, err := userpassword.Hash(passcode.String())
	if err != nil {
		logger.Error(ctx, "unable to hash passcode", slog.Error(err))
		return
	}

	//nolint:gocritic // We need the system auth context to be able to save the one-time passcode.
	err = api.Database.UpdateUserHashedOneTimePasscode(dbauthz.AsSystemRestricted(ctx), database.UpdateUserHashedOneTimePasscodeParams{
		ID:                       user.ID,
		HashedOneTimePasscode:    []byte(hashedPasscode),
		OneTimePasscodeExpiresAt: sql.NullTime{Time: passcodeExpiresAt, Valid: true},