[Xzzz]

Summary

Ports the MFA endpoints (enroll, verify_totp_code) from Bugzilla::WebService::User into a native Bugzilla::API::V1::UserMFA Mojo controller, and removes the legacy User module, which has no methods left.

Last sub-bug of 2071909.

As agreed, login, logout and valid_login are not ported: API keys replace them.

Changes

• Add Bugzilla/API/V1/UserMFA.pm, with the same responses as the legacy endpoints:
  • GET /rest/user/mfa/<provider>/enroll (MFA preferences page, js/account.js)
  • POST /rest/user/mfa/verify_totp_code (TOTP verification form, js/mfa_totp.js)
  • OPTIONS on both
• verify_totp_code identifies the user by the mfa_token from the form, not by a login: the user is still logging in.
• Remove Bugzilla/WebService/User.pm, Resources/User.pm, the User dispatch entry, and the login token Bugzilla/Auth.pm kept on the user object for User.login.
• Bugzilla/WebService.pm POD: drop User.login, and use Bug.get in the include_fields/exclude_fields examples.
• Breaking: GET /rest/login, /rest/logout and /rest/valid_login are gone, with qa/t/rest_user_login_logout.t and their sections in user.rst.
• general.rst: the resources still on the legacy auth path are now only Bug and Bugzilla.
• Tests:
  • New t/app-user-mfa.t
  • t/app-user-whoami.t checks mfa_status true (first commit)
  • New qa/t/rest_legacy_credentials.t keeps the Bugzilla_login/Bugzilla_password cases of the removed rest_user_login_logout.t, for the resources still on the legacy server

Test plan

• Enable TOTP from the preferences page: the QR code and secret show up
• Log in with TOTP: a wrong code shows "Invalid verification code.", the right code and a recovery code log in
• GET /rest/user/mfa/totp/enroll logged out, expecting login_required
• GET /rest/user/mfa/unknown/enroll, expecting a 400
• POST /rest/user/mfa/verify_totp_code with a bogus mfa_token, expecting {"error": 1, "message": "invalid verification token"}
• GET /rest/login, expecting rest_invalid_resource (32614)
• GET /rest/whoami with an API key and with X-Phabricator-Token is unchanged

References

• Bugzilla link: 2078770
• Part of 2071909 / 2057358