task(auth): Update /totp/destroy to take an sms code #18154
Conversation
| .string() | ||
| .max(32) | ||
| .regex(validators.DIGITS) | ||
| .optional() |
There was a problem hiding this comment.
To keep this backwards compatible, I made the code optional. However that means that for now there's no enforcement of providing a code in order to remove TOTP. Perhaps there should also be check to see if the account has a back up phone, and if it does an SMS must be provided. This was not in the ACs for the ticket though...
| payload: isA.object({ | ||
| code: isA | ||
| .string() | ||
| .max(32) |
There was a problem hiding this comment.
sorry I have not been following the SMS work that closely but is this a code sent to the user?
There was a problem hiding this comment.
Yes it would be a code sent to the users phone. There's some things about this ticket that are a little fuzzy to me as well. I'm thinking when we do the front end implementation the usage will be more clear.
There was a problem hiding this comment.
32 characters is a looooong code. 😅
Because
This pull request
Issue that this pull request solves
Closes: # (issue number)
Checklist
Put an
xin the boxes that applyScreenshots (Optional)
Please attach the screenshots of the changes made in case of change in user interface.
Other information (Optional)