Bug 40545 - Add a CLI script to manually reset 2FA settings
Summary: Add a CLI script to manually reset 2FA settings
Status: Patch doesn't apply
Alias: None
Product: Koha
Classification: Unclassified
Component: Command-line Utilities (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 30724
  Show dependency treegraph
 
Reported: 2025-07-29 20:32 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-08-16 02:58 UTC (History)
4 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron (4.16 KB, patch)
2025-07-29 21:28 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add utility script for resetting 2FA settings (5.61 KB, patch)
2025-07-29 21:28 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add to action logs (3.29 KB, patch)
2025-07-29 21:29 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron (4.19 KB, patch)
2025-07-29 21:34 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add utility script for resetting 2FA settings (5.63 KB, patch)
2025-07-29 21:34 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add to action logs (3.29 KB, patch)
2025-07-29 21:34 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron (4.23 KB, patch)
2025-07-30 03:09 UTC, David Nind
Details | Diff | Splinter Review
Bug 40545: Add utility script for resetting 2FA settings (5.68 KB, patch)
2025-07-30 03:09 UTC, David Nind
Details | Diff | Splinter Review
Bug 40545: Add to action logs (3.34 KB, patch)
2025-07-30 03:09 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2025-07-29 20:32:00 UTC
I propose we have an utility script for the task.
Comment 1 Tomás Cohen Arazi (tcohen) 2025-07-29 21:28:55 UTC Comment hidden (obsolete)
Comment 2 Tomás Cohen Arazi (tcohen) 2025-07-29 21:28:58 UTC Comment hidden (obsolete)
Comment 3 Tomás Cohen Arazi (tcohen) 2025-07-29 21:29:01 UTC Comment hidden (obsolete)
Comment 4 Tomás Cohen Arazi (tcohen) 2025-07-29 21:34:53 UTC
Created attachment 184842 [details] [review]
Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron

This adds two new methods to Koha::Patron for managing two-factor authentication:

* has_2fa_enabled() - Returns 1 if patron has 2FA enabled, 0 otherwise
* reset_2fa() - Clears secret and sets auth_method to 'password'

The reset_2fa method includes audit logging when BorrowersLog is enabled
and returns the patron object for method chaining.

To test:
1. Apply patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Patron.t
=> SUCCESS: Tests pass!
3. Sign off :-D
Comment 5 Tomás Cohen Arazi (tcohen) 2025-07-29 21:34:56 UTC
Created attachment 184843 [details] [review]
Bug 40545: Add utility script for resetting 2FA settings

This adds a command-line utility script that allows administrators to reset
a patron's two-factor authentication settings when they lose access to their
authenticator device.

The script uses the new Koha::Patron methods and provides:
* Parameter validation (mutually exclusive userid/cardnumber/patron_id)
* User-friendly error messages and feedback
* Verification that patron has 2FA enabled before attempting reset

To test:
1. Enable TwoFactorAuthentication system preference
2. Set up 2FA for a test patron
3. Run:
   $ ktd --shell
  k$ perl misc/admin/reset_2fa.pl --userid <userid>
=> SUCCESS: Script resets 2FA and shows confirmation message
4. Verify patron can log in with password only
5. Test error cases:
   - No parameters: shows usage message
   - Multiple parameters: shows mutual exclusivity error
   - Non-existent user: shows user not found error
   - User without 2FA: shows informational message
=> SUCCESS: All scenarios work as expected
6. Sign off :-D
Comment 6 Tomás Cohen Arazi (tcohen) 2025-07-29 21:34:59 UTC
Created attachment 184844 [details] [review]
Bug 40545: Add to action logs
Comment 7 David Nind 2025-07-30 03:09:39 UTC
Created attachment 184850 [details] [review]
Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron

This adds two new methods to Koha::Patron for managing two-factor authentication:

* has_2fa_enabled() - Returns 1 if patron has 2FA enabled, 0 otherwise
* reset_2fa() - Clears secret and sets auth_method to 'password'

The reset_2fa method includes audit logging when BorrowersLog is enabled
and returns the patron object for method chaining.

To test:
1. Apply patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Patron.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Comment 8 David Nind 2025-07-30 03:09:43 UTC
Created attachment 184851 [details] [review]
Bug 40545: Add utility script for resetting 2FA settings

This adds a command-line utility script that allows administrators to reset
a patron's two-factor authentication settings when they lose access to their
authenticator device.

The script uses the new Koha::Patron methods and provides:
* Parameter validation (mutually exclusive userid/cardnumber/patron_id)
* User-friendly error messages and feedback
* Verification that patron has 2FA enabled before attempting reset

To test:
1. Enable TwoFactorAuthentication system preference
2. Set up 2FA for a test patron
3. Run:
   $ ktd --shell
  k$ perl misc/admin/reset_2fa.pl --userid <userid>
=> SUCCESS: Script resets 2FA and shows confirmation message
4. Verify patron can log in with password only
5. Test error cases:
   - No parameters: shows usage message
   - Multiple parameters: shows mutual exclusivity error
   - Non-existent user: shows user not found error
   - User without 2FA: shows informational message
=> SUCCESS: All scenarios work as expected
6. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Comment 9 David Nind 2025-07-30 03:09:46 UTC
Created attachment 184852 [details] [review]
Bug 40545: Add to action logs

Signed-off-by: David Nind <david@davidnind.com>
Comment 10 David Nind 2025-07-30 03:10:04 UTC
Nice!
Comment 11 David Nind 2025-08-16 02:58:59 UTC
The patches currently don't apply:

git bz apply 40545

Bug 40545 - Add a CLI script to manually reset 2FA settings

184850 - Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron
184851 - Bug 40545: Add utility script for resetting 2FA settings
184852 - Bug 40545: Add to action logs

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 40545: Add has_2fa_enabled and reset_2fa methods to Koha::Patron
Applying: Bug 40545: Add utility script for resetting 2FA settings
Applying: Bug 40545: Add to action logs
Using index info to reconstruct a base tree...
M	koha-tmpl/intranet-tmpl/prog/en/includes/action-logs.inc
M	koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
Falling back to patching base and 3-way merge...
Auto-merging koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
CONFLICT (content): Merge conflict in koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
Auto-merging koha-tmpl/intranet-tmpl/prog/en/includes/action-logs.inc
error: Failed to merge in the changes.
Patch failed at 0001 Bug 40545: Add to action logs