| | | 1 | | using System.Text.Json.Serialization; |
| | | 2 | | using ArturRios.Heimdall.Shared.Security; |
| | | 3 | | using ArturRios.Mediator.Command; |
| | | 4 | | |
| | | 5 | | namespace ArturRios.Heimdall.Command.Input; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Intent to turn off the caller's own two-factor authentication (UC-39, FR-2F-11), requiring |
| | | 9 | | /// both the caller's current password and a valid second factor — an app/email code or a |
| | | 10 | | /// recovery code — exactly as hard to satisfy as a login. <see cref="ActingPersonId" />/ |
| | | 11 | | /// <see cref="ActingRole" /> are set by the controller from the authenticated caller and are |
| | | 12 | | /// never bound from the body — like <see cref="EnableTwoFactorAuthCommand" />, a caller can only |
| | | 13 | | /// ever disable their own configuration. They are <c>[JsonIgnore]</c>, so they are not |
| | | 14 | | /// deserialized from the body and do not appear in the request schema. |
| | | 15 | | /// </summary> |
| | | 16 | | public class DisableTwoFactorAuthCommand : BaseCommand, IActorScoped |
| | | 17 | | { |
| | | 18 | | /// <summary>The caller's current password (UC-11 step 3's check, reused here).</summary> |
| | 193 | 19 | | public string Password { get; set; } = string.Empty; |
| | | 20 | | |
| | | 21 | | /// <summary>The caller's current app or email code, when proving a code rather than a recovery code.</summary> |
| | 126 | 22 | | public string? Code { get; set; } |
| | | 23 | | |
| | | 24 | | /// <summary>One of the caller's unused recovery codes, when no code is available.</summary> |
| | 126 | 25 | | public string? RecoveryCode { get; set; } |
| | | 26 | | |
| | | 27 | | [JsonIgnore] |
| | 92 | 28 | | public Guid ActingPersonId { get; set; } |
| | | 29 | | |
| | | 30 | | [JsonIgnore] |
| | 46 | 31 | | public int ActingRole { get; set; } |
| | | 32 | | } |