feat: add event for skipping two-factor authentication verification

arodu · arodu · commit b91ab0513320 · 2026-01-27T16:12:06.000-04:00
diff --git a/src/Controller/Traits/OneTimePasswordVerifyTrait.php b/src/Controller/Traits/OneTimePasswordVerifyTrait.php
@@ -16,6 +16,7 @@
 use Cake\Core\Configure;
 use CakeDC\Auth\Authentication\AuthenticationService;
 use CakeDC\Auth\Authenticator\TwoFactorAuthenticator;
+use CakeDC\Users\UsersPlugin;
 
 trait OneTimePasswordVerifyTrait
 {
@@ -43,6 +44,15 @@ public function verify()
         $temporarySession = $this->getRequest()->getSession()->read(
             AuthenticationService::TWO_FACTOR_VERIFY_SESSION_KEY,
         );
+
+        $event = $this->dispatchEvent(UsersPlugin::EVENT_2FA_SKIP_VERIFY, ['user' => $temporarySession]);
+        if ($event->getResult() === true) {
+            $this->getRequest()->getSession()->delete(AuthenticationService::TWO_FACTOR_VERIFY_SESSION_KEY);
+            $this->getRequest()->getSession()->write(TwoFactorAuthenticator::USER_SESSION_KEY, $temporarySession);
+
+            return $this->redirect($loginAction);
+        }
+
         $secretVerified = $temporarySession['secret_verified'] ?? null;
         // showing QR-code until shared secret is verified
         if (!$secretVerified) {
@@ -55,7 +65,10 @@ public function verify()
                 $temporarySession['email'],
                 $secret,
             );
-            $this->set(['secretDataUri' => $secretDataUri]);
+            $this->set([
+                'secretDataUri' => $secretDataUri, 
+                'secret' => $secret,    
+            ]);
         }
 
         if ($this->getRequest()->is('post')) {
diff --git a/src/UsersPlugin.php b/src/UsersPlugin.php
@@ -48,6 +48,8 @@ class UsersPlugin extends BasePlugin
     public const EVENT_AFTER_RESEND_TOKEN_VALIDATION = 'Users.Global.afterResendTokenValidation';
     public const EVENT_AFTER_EMAIL_TOKEN_VALIDATION = 'Users.Global.afterEmailTokenValidation';
 
+    public const EVENT_2FA_SKIP_VERIFY = 'Users.TwoFactor.skipVerify';
+
     public const DEPRECATED_MESSAGE_U2F =
         'U2F is no longer supported by chrome, we suggest using Webauthn as a replacement';
 
