feat(FOUR-28542): Authenticator app option still available even the user has already configured it.

[rodriquelca]

Issue & Reproduction Steps

Issue: On the 2FA login screen, the Authenticator app link and QR setup remain available after a user has already configured Google Authenticator. Anyone with access to the login session can register a new device and pass 2FA.

Repro:

Admin → Settings → Log-In Options: enable Require Two Step Authentication and select Authenticator App
Log in with a regular user (not SSO)
On /2fa, click Authenticator app → scan QR with Google Authenticator → enter code → enter the app
Log out and log in again
Actual: Authenticator app link still appears; QR can be scanned again on another device.
Expected: Link appears only on first setup; later logins only ask for the code. Admin can reset configuration.

Solution

• Added auth_app_configured_at on users to track one-time authenticator setup
• Hide Authenticator app on /2fa when the user is already configured
• Block /2fa/auth_app_qr when already configured
• Set auth_app_configured_at after the first valid 6-digit authenticator code
• Added Reset Authenticator App button in Admin → Users → Edit (sidebar)
• Added API PUT /api/1.0/users/{user}/reset_auth_app for admin reset

app_auth.mov

How to Test

1. Configure 2FA with Authenticator App (steps above)
2. First login: confirm Authenticator app link is visible → complete setup
3. Second login: confirm link is hidden; only code field shows
4. Admin → Users → Edit → click Reset Authenticator App
5. Login again: link should appear once more for re-enrollment

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-28542

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cursor]

PR Summary

Medium Risk
Changes login 2FA enrollment and adds an admin reset path on user records; scope is limited but touches authentication flows and requires running the migration.

Overview
Fixes a 2FA authenticator re-enrollment gap by tracking one-time setup on users via new auth_app_configured_at (migration + model cast/helper).

On login, the Authenticator app link and QR route are only offered when the user has auth app in their valid 2FA methods and is not yet configured; a successful 6-digit code sets the timestamp. Admins can clear setup with PUT users/{user}/reset_auth_app (policy-checked, UserUpdated logged) and a Reset Authenticator App control on Admin → Users → Edit.

Adds feature tests for the reset API and OTP/QR/setup behavior.

^{Reviewed by Cursor Bugbot for commit 72809c4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 72809c4. Configure here.}

[cursor]

Username change locks authenticator users

High Severity

userCanSetUpAuthApp hides QR setup once auth_app_configured_at is set, but the TOTP secret is derived from username. A username change invalidates existing codes and leaves auth_app_configured_at set, so users with only Authenticator App cannot re-enroll. Self-service profile updates allow username changes, and reset is admin-only, so those users cannot recover on their own.

Additional Locations (2)

• ProcessMaker/Http/Controllers/Auth/TwoFactorAuthController.php#L93-L96
• ProcessMaker/Models/User.php#L554-L558

 

^{Reviewed by Cursor Bugbot for commit 72809c4. Configure here.}