From 96683a0f5af5cb06d5e920ab66a7dd2ea0cf4e61 Mon Sep 17 00:00:00 2001
From: Vincent BRIDIER <vincent.bridier@ldc.fr>
Date: Mon, 19 Sep 2022 13:21:10 +0200
Subject: [PATCH] Update OTP Code

---
 .env.example                             |  5 ++++-
 app/Http/Controllers/OTPController.php   |  7 +------
 app/Http/Requests/ValidateOtpRequest.php | 11 +++++++----
 3 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/.env.example b/.env.example
index 0a2a8ff..c95fd80 100644
--- a/.env.example
+++ b/.env.example
@@ -44,4 +44,7 @@ MAILJET_SMSENDPOINT=
 MAILJET_SMSFROM=
 
 WEBHOOKS_GITLAB_NOTIFY=
-WEBHOOKS_GITLAB_TOKEN=
\ No newline at end of file
+WEBHOOKS_GITLAB_TOKEN=
+
+MEMCACHED_HOST=
+MEMCACHED_PORT=
diff --git a/app/Http/Controllers/OTPController.php b/app/Http/Controllers/OTPController.php
index 93e438b..8f9bc07 100644
--- a/app/Http/Controllers/OTPController.php
+++ b/app/Http/Controllers/OTPController.php
@@ -35,12 +35,7 @@ class OTPController extends Controller
     public function check(ValidateOtpRequest $request)
     {
         //phpcs:enable
-        $user = session()->get('tmpUserOTP');
-        if (!$user) {
-            return \response()->redirectTo(RouteServiceProvider::HOME);
-        }
-
-        Auth::login($user);
+        Auth::login(session()->get('tmpUserOTP'));
         return \response()->redirectTo(RouteServiceProvider::HOME);
     }
 
diff --git a/app/Http/Requests/ValidateOtpRequest.php b/app/Http/Requests/ValidateOtpRequest.php
index bcd2101..07311cd 100644
--- a/app/Http/Requests/ValidateOtpRequest.php
+++ b/app/Http/Requests/ValidateOtpRequest.php
@@ -4,7 +4,6 @@ namespace App\Http\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\Auth;
 use lfkeitel\phptotp\Base32;
 use lfkeitel\phptotp\Totp;
 
@@ -17,7 +16,10 @@ class ValidateOtpRequest extends FormRequest
      */
     public function authorize()
     {
-        return Auth::check();
+        if (!session()->get('tmpUserOTP')) {
+            return false;
+        }
+        return true;
     }
 
     /**
@@ -32,11 +34,12 @@ class ValidateOtpRequest extends FormRequest
                 'string',
                 'required',
                 function ($attribute, $value, $fail) {
+                    $user     = session()->get('tmpUserOTP');
                     $lastCode = (new Totp())->GenerateToken(
-                        Base32::decode(Auth::user()->totp_secret),
+                        Base32::decode($user->totp_secret),
                         Carbon::now()->subSeconds(30)->timestamp
                     );
-                    $code     = (new Totp())->GenerateToken(Base32::decode(Auth::user()->totp_secret));
+                    $code     = (new Totp())->GenerateToken(Base32::decode($user->totp_secret));
 
                     if (!($value === $code || $value === $lastCode)) {
                         $fail("Code de vérification $attribute invalide.");