Add webAuthn 2FA to support Yubikeys as additional 2nd factors

Classes/Controller/BackendController.php

@@ -118,9 +118,26 @@ public function indexAction()
     }
 
     /**
-     * show the form to register a new second factor
+     * Method picker shown when the user clicks "Add second factor" inside the backend module.
      */
     public function newAction(): void
+    {
+        $account = $this->securityContext->getAccount();
+        $currentUser = $this->partyService->getAssignedPartyOfAccount($account);
+
+        $this->view->assignMultiple([
+            'currentUser' => $currentUser instanceof User ? $currentUser : null,
+            'accountIdentifier' => $account->getAccountIdentifier(),
+            'flashMessages' => $this->flashMessageService
+                ->getFlashMessageContainerForRequest($this->request)
+                ->getMessagesAndFlush(),
+        ]);
+    }
+
+    /**
+     * TOTP wizard (extracted from the previous newAction).
+     */
+    public function newTotpAction(): void
     {
         $otp = TOTPService::generateNewTotp();
         $secret = $otp->getSecret();
@@ -130,8 +147,6 @@ public function newAction(): void
         $currentUser = $this->partyService->getAssignedPartyOfAccount($account);
 
         $this->view->assignMultiple([
-            'styles' => array_filter($this->getNeosSettings()['userInterface']['backendLoginForm']['stylesheets']),
-            'scripts' => array_filter($this->getNeosSettings()['userInterface']['backendLoginForm']['scripts']),
             'secret' => $secret,
             'qrCode' => $qrCode,
             'currentUser' => $currentUser instanceof User ? $currentUser : null,
@@ -143,7 +158,25 @@ public function newAction(): void
     }
 
     /**
-     * save the registered second factor
+     * WebAuthn setup wizard. The JS on the page talks to LoginController's
+     * webAuthnRegister(Options|Verify)Action XHR endpoints.
+     */
+    public function newWebAuthnAction(): void
+    {
+        $account = $this->securityContext->getAccount();
+        $currentUser = $this->partyService->getAssignedPartyOfAccount($account);
+
+        $this->view->assignMultiple([
+            'currentUser' => $currentUser instanceof User ? $currentUser : null,
+            'accountIdentifier' => $account->getAccountIdentifier(),
+            'flashMessages' => $this->flashMessageService
+                ->getFlashMessageContainerForRequest($this->request)
+                ->getMessagesAndFlush(),
+        ]);
+    }
+
+    /**
+     * save the registered second factor (TOTP)
      *
      * @throws SessionNotStartedException
      * @throws IllegalObjectTypeException
@@ -166,10 +199,15 @@ public function createAction(string $secret, string $secondFactorFromApp, string
                 '',
                 Message::SEVERITY_WARNING
             );
-            $this->redirect('new');
+            $this->redirect('newTotp');
         }
 
-        $this->secondFactorRepository->createSecondFactorForAccount($secret, $this->securityContext->getAccount(), $name);
+        $this->secondFactorRepository->createSecondFactorForAccount(
+            $secret,
+            $this->securityContext->getAccount(),
+            SecondFactor::TYPE_TOTP,
+            $name,
+        );
 
         $this->secondFactorSessionStorageService->setAuthenticationStatus(AuthenticationStatus::AUTHENTICATED);