| | | 1 | | using ArturRios.Util.Http; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Shared.Messages; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Maps each <see cref="TwoFactorMessages" /> value to its HTTP status code, following UC-36's |
| | | 7 | | /// and UC-37's flows. Passed to the response resolver. |
| | | 8 | | /// </summary> |
| | | 9 | | public static class TwoFactorMessageMap |
| | | 10 | | { |
| | 4 | 11 | | public static readonly IReadOnlyDictionary<string, int> StatusCodes = |
| | 4 | 12 | | DataAccessMessageMap.CombinedWith(new Dictionary<string, int> |
| | 4 | 13 | | { |
| | 4 | 14 | | // UC-36 main flow and AF-36d — setup initiated or a pending setup overwritten. |
| | 4 | 15 | | [TwoFactorMessages.SetupInitiated] = HttpStatusCodes.Ok, |
| | 4 | 16 | | // AF-36a and AF-37d — already active. |
| | 4 | 17 | | [TwoFactorMessages.AlreadyActive] = HttpStatusCodes.Conflict, |
| | 4 | 18 | | // AF-36b — caller is not eligible (Google User, or no live person named by the token). |
| | 4 | 19 | | [TwoFactorMessages.NotEligible] = HttpStatusCodes.Forbidden, |
| | 4 | 20 | | // AF-36c — neither method selected. |
| | 4 | 21 | | [TwoFactorMessages.NoMethodSelected] = HttpStatusCodes.BadRequest, |
| | 4 | 22 | | // AF-36f, AF-36g — the person's account-email budget refused the setup code (FR-2F-19), as |
| | 4 | 23 | | // AF-15b and AF-15c. |
| | 4 | 24 | | [AuthMessages.EmailSentRecently] = HttpStatusCodes.TooManyRequests, |
| | 4 | 25 | | [AuthMessages.AccountEmailLimitReached] = HttpStatusCodes.TooManyRequests, |
| | 4 | 26 | | // UC-37 main flow — setup confirmed, recovery codes issued. |
| | 4 | 27 | | [TwoFactorMessages.SetupConfirmed] = HttpStatusCodes.Ok, |
| | 4 | 28 | | // AF-37a — no pending setup exists for the caller. |
| | 4 | 29 | | [TwoFactorMessages.NoPendingSetup] = HttpStatusCodes.NotFound, |
| | 4 | 30 | | // AF-36e, AF-37b, AF-37c, AF-39b, AF-39c and AF-40b (FR-AU-13) — a password or code checked |
| | 4 | 31 | | // under a bearer token was wrong, missing or already used, or the account's |
| | 4 | 32 | | // re-authentication budget is paused: one message, and the status the password refusal |
| | 4 | 33 | | // has always had. |
| | 4 | 34 | | [AuthMessages.PasswordOrCodeIncorrect] = HttpStatusCodes.Unauthorized, |
| | 4 | 35 | | // UC-38 main flow — challenge redeemed, full token issued. |
| | 4 | 36 | | [TwoFactorMessages.VerificationSuccessful] = HttpStatusCodes.Ok, |
| | 4 | 37 | | // UC-38 for a restricted person (NFR-24) — a subject-rights-only token. |
| | 4 | 38 | | [AuthMessages.SubjectRightsOnlySignIn] = HttpStatusCodes.Ok, |
| | 4 | 39 | | // AF-38a — challenge token missing, invalid, or expired. |
| | 4 | 40 | | [TwoFactorMessages.ChallengeTokenInvalid] = HttpStatusCodes.Unauthorized, |
| | 4 | 41 | | // UC-46 — the one answer every flow gives, main and alternative alike (FR-2F-16). |
| | 4 | 42 | | [TwoFactorMessages.ChallengeCodeResent] = HttpStatusCodes.Ok, |
| | 4 | 43 | | // UC-38 step 5 — the second factor checked out but scope eligibility no longer holds. |
| | 4 | 44 | | [TwoFactorMessages.ScopeNoLongerEligible] = HttpStatusCodes.Unauthorized, |
| | 4 | 45 | | // AF-38b and AF-38c — collapsed to the same 401 so a wrong code, a reused recovery code and |
| | 4 | 46 | | // a locked second factor (FR-AU-12) cannot be told apart. |
| | 4 | 47 | | [TwoFactorMessages.FactorInvalid] = HttpStatusCodes.Unauthorized, |
| | 4 | 48 | | // UC-39 main flow — the configuration and its recovery codes were removed. |
| | 4 | 49 | | [TwoFactorMessages.Disabled] = HttpStatusCodes.Ok, |
| | 4 | 50 | | // AF-39a — two-factor authentication is not active for the caller. Also UC-40's AF-40a: the |
| | 4 | 51 | | // same "not active" refusal, reused rather than duplicated. |
| | 4 | 52 | | [TwoFactorMessages.NotActive] = HttpStatusCodes.NotFound, |
| | 4 | 53 | | // UC-40 main flow — every existing recovery code was replaced with ten new ones. |
| | 4 | 54 | | [TwoFactorMessages.RecoveryCodesRegenerated] = HttpStatusCodes.Ok, |
| | 4 | 55 | | // FR-2F-15 main flow — status read, including the all-false "never enabled" state. |
| | 4 | 56 | | [TwoFactorMessages.StatusRetrieved] = HttpStatusCodes.Ok |
| | 4 | 57 | | }); |
| | | 58 | | } |