Classic UI and tests

[jensens]

I am actually offering a customer this plugin for ClassicUI usage. This includes making this production ready.
I would also add tests.
If anyone has similar goals please let me now.
I saw there is already an unfinished branch with PR #3.

[instification]

hi @jensens I have been working on the classicui plugin. I am currently committing plone tune up days to work on it.

I think #3 is ready to merge. Any reviews/comments on that PR would be welcome. I updated the description with more information and I'm happy to discuss further if anything doesn't make sense.

I also created other issues that I think need resolving before it could be considered production ready.

[1letter]

@jensens @instification
i work currently on a refactoring for Plone 6. See my PR Draft. I replace the qr-code with an inline base64 image, it's not created by googlechart. i will work on tests for better test coverage. i have also refactor the package with plone/meta and use pip based installation with mx.ini.

[1letter]

@jensens @instification

• short Intermediate status: code coverage 89%
• fix a bug in rest api endpoint for login
• fix a bug in rest api endpoint for userpatch

i think we need a discussion about the workflow. i agree with the issue #6 . the user should set up all the stuff in a controlpanel. more control over the secret and qr-code generation is needed.

[1letter]

@jensens @instification @mamico
Do you have a need or interest in expanding the package? My ideas would be:

• extends the account panel with a new tab "2FA", only available/visible if 2FA is active
• recovery options for 2FA with a list of 10 digit keys like pypi/github
• the tab contain the qr-code for configuration the totp app
• the tab contain the list of recovery keys
• the recovery keys are implemented as a annotation of user object
• e-mail notification if access happen to recovery keys

unclear for me is the workflow, if 2FA enabled globally by admin. if the user didn't scan the qr-code on the first access in the "2fa add form" the he lost the possibility to authenticate on the portal

any opinions or hints?

[mamico]

@1letter +1 for me.

After the implementation in Classic UI,I will check the transition of the functionality to the volto counterpart product.

If it can be helpful, here keycloak/keycloak#8518 there is a very detailed and discussed use case for handling OTP recovery codes on keycloak.

For the last part, if I remember correctly, the user has the qrcode after login and has to use it before he can be authenticated. But I would have to do a test to be sure