feat: Two Factor API

[SebastianKrupinski]

Ability to check/enable/disable configured 2FA with API endpoint

Request State

GET /twofactor/state?user=user1

Request Disable

POST /twofactor/disable

{
  "user": "user1",
  "providers": [
    "backup_codes",
    "totp"
  ]
}

Request Enable

POST /twofactor/enable

{
  "user": "user2",
  "providers": [
    "backup_codes",
    "totp"
  ]
}

[provokateurin]

All the endpoints are only intended to be used by admins?
This PR lacks context that explains for what feature this is needed.

[SebastianKrupinski]

All the endpoints are only intended to be used by admins? This PR lacks context that explains for what feature this is needed.

Apologies, didn't realize I did not link the issue ticket. I've updated the description.

[provokateurin]

Fine by me

[ChristophWurst]

Looks good otherwise

[ChristophWurst]

This should be a GET

[SebastianKrupinski]

Hey,

The reason this is a POST is because its pretty messy to send an array of user names in a GET url.

This command retrieves the states for specific users not just one user.

POST /twofactor/state

{
"users": ["admin", "user1", "user2"]
}

[provokateurin]

It is possible using this syntax: ?user[]=a&user[]=b, but indeed very ugly. Not sure what is better here 😅

[ChristophWurst]

GET is the right verb here. If the arguments make the URL ugly so be it.

As an alternative you could drop the bulk operation aspect. It's not a concept I've seen with any other Nextcloud APIs. If there is only one user, like with the occ command, the URL will become "pretty" again.

[provokateurin]

Agreed, if there is no need to query multiple users at once then it is much better to only implement it for a single user.

[SebastianKrupinski]

Well the idea behind the bulk operation was that an external system can check the state of 2fa on a 100+ accounts at the same time instead of doing 100 requests.

But if you insist on this being a GET then having this as an array makes it ugly. I'll change it.

[ChristophWurst]

POST is still used here.

[SebastianKrupinski]

Yes, its because I didn't see you comments before asking for a review.