| | | 1 | | using ArturRios.Data.Relational.Core.Entities; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Domain.Entities; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// A time-limited, single-use numeric code issued for the email two-factor method (UC-36 step 4, |
| | | 7 | | /// FR-2F-03). Not part of the System Requirements Document's data model — an implementation |
| | | 8 | | /// detail of how the email method's pending code is tracked between UC-36 (issue) and UC-37 |
| | | 9 | | /// (confirm), shaped after <see cref="PasswordResetToken" />. Never addressed by ID; a person's |
| | | 10 | | /// current code is reached through their <see cref="TwoFactorAuth" /> configuration. |
| | | 11 | | /// </summary> |
| | | 12 | | public class TwoFactorEmailCode : Entity<long> |
| | | 13 | | { |
| | | 14 | | /// <summary> |
| | | 15 | | /// Foreign key to the owning <see cref="TwoFactorAuth" /> configuration (internal Id). |
| | | 16 | | /// Required. |
| | | 17 | | /// </summary> |
| | 153 | 18 | | public long TwoFactorAuthId { get; set; } |
| | | 19 | | |
| | | 20 | | /// <summary>Hash computed from the 6-digit code and <see cref="Salt" />.</summary> |
| | 313 | 21 | | public byte[] CodeHash { get; set; } = []; |
| | | 22 | | |
| | | 23 | | /// <summary>Randomly generated per code, used to hash it.</summary> |
| | 312 | 24 | | public byte[] Salt { get; set; } = []; |
| | | 25 | | |
| | | 26 | | /// <summary>Expiration timestamp, 10 minutes after issue (FR-2F-03).</summary> |
| | 176 | 27 | | public DateTime ExpiresAt { get; set; } |
| | | 28 | | |
| | | 29 | | /// <summary>Whether the code has already been consumed or superseded by a fresher one.</summary> |
| | 242 | 30 | | public bool Used { get; set; } |
| | | 31 | | |
| | | 32 | | /// <summary> |
| | | 33 | | /// Wrong guesses made against this code. A six-digit code has a million values and lives ten |
| | | 34 | | /// minutes, which a distributed attacker can cover a real fraction of; retiring the code once |
| | | 35 | | /// this reaches its cap bounds each issued code to a handful of attempts, so guessing costs a |
| | | 36 | | /// fresh login per few tries rather than being free. |
| | | 37 | | /// </summary> |
| | 122 | 38 | | public int FailedAttempts { get; set; } |
| | | 39 | | |
| | | 40 | | /// <summary>Creation timestamp.</summary> |
| | 17 | 41 | | public DateTime CreatedAt { get; set; } |
| | | 42 | | |
| | | 43 | | // Navigation properties |
| | | 44 | | |
| | | 45 | | /// <summary>The two-factor configuration this code was issued for.</summary> |
| | 14 | 46 | | public TwoFactorAuth TwoFactorAuth { get; set; } = null!; |
| | | 47 | | } |