[rodriquelca]

Issue & Reproduction Steps

Issue: On the 2FA login screen, the Authenticator app link and QR setup remain available after a user has already configured Google Authenticator. Anyone with access to the login session can register a new device and pass 2FA.

Repro:

Admin → Settings → Log-In Options: enable Require Two Step Authentication and select Authenticator App
Log in with a regular user (not SSO)
On /2fa, click Authenticator app → scan QR with Google Authenticator → enter code → enter the app
Log out and log in again
Actual: Authenticator app link still appears; QR can be scanned again on another device.
Expected: Link appears only on first setup; later logins only ask for the code. Admin can reset configuration.

Solution

• Added auth_app_configured_at on users to track one-time authenticator setup
• Hide Authenticator app on /2fa when the user is already configured
• Block /2fa/auth_app_qr when already configured
• Set auth_app_configured_at after the first valid 6-digit authenticator code
• Added Reset Authenticator App button in Admin → Users → Edit (sidebar)
• Added API PUT /api/1.0/users/{user}/reset_auth_app for admin reset

app_auth.mov

How to Test

1. Configure 2FA with Authenticator App (steps above)
2. First login: confirm Authenticator app link is visible → complete setup
3. Second login: confirm link is hidden; only code field shows
4. Admin → Users → Edit → click Reset Authenticator App
5. Login again: link should appear once more for re-enrollment

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-28542

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.
  test
  ci:deploy

[cursor]

PR Summary

Medium Risk
Changes login-time 2FA enrollment and user-update paths; behavior is guarded by tests and a dedicated reset API, but mistakes could lock users out of app 2FA until an admin reset.

Overview
Fixes a 2FA gap where the Authenticator app link and QR setup stayed available after enrollment, allowing extra devices to be registered during an active login session.

The PR adds auth_app_configured_at on users to record one-time authenticator setup. After the first successful 6-digit app code at login, enrollment is marked; the OTP page only shows the setup link when the user is eligible and not yet configured, and the QR route redirects if already enrolled. Username changes clear enrollment (secrets are tied to username) so users can scan a new QR.

Enrollment cannot be set or cleared via normal user create/update: payloads strip auth_app_configured_at, and admins get a dedicated PUT users/{user}/reset_auth_app plus a Reset Authenticator App control on Admin → Users → Edit. The admin save flow also omits the timestamp from the PUT body. Feature tests cover reset, UI gating, and tamper resistance on profile updates.

^{Reviewed by Cursor Bugbot for commit 38557de. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[nolanpro]

QA server K8S was successfully deployed https://ci-0e68e8357e.engk8s.processmaker.net

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c9767f4. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[nolanpro]

QA server K8S was successfully deployed https://tenant-1.ci-0e68e8357e.engk8s.processmaker.net