Merge pull request #74 from CityOfLosAngeles/mfa-sms-phone

MFA SMS Flow
CityOfLosAngeles · Jan 31, 2024 · af14c07 · af14c07
2 parents 886b816 + d00c593
commit af14c07
Show file tree

Hide file tree

Showing 271 changed files with 662 additions and 143 deletions.
diff --git a/.github/workflows/firebase-hosting-pull-request.yml b/.github/workflows/firebase-hosting-pull-request.yml
@@ -10,7 +10,8 @@ on:
       - 'web/**'
 jobs:
   build_and_preview:
-    if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
+    if: '${{ github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false }}'
     runs-on: ubuntu-latest
     environment: development
     steps:

diff --git a/firebase.json b/firebase.json
@@ -14,7 +14,7 @@
         "region": "us-central1"
       },
       {
-        "source": "**",
+        "source": "/auth0/**",
         "function": "auth0",
         "region": "us-central1"
       }

diff --git a/functions/auth0/api/auth0.js b/functions/auth0/api/auth0.js
@@ -156,19 +156,36 @@ const authMethods = onRequest(async (req, res) => {
   }
 });
 
-const enrollOTP = onRequest(async (req, res) => {
+const enrollMFA = onRequest(async (req, res) => {
   const body = req.body;
 
+  const {
+    email,
+    password,
+    mfaFactor = '',
+    number,
+    channel
+  } = body;
+
   try {
     const validateResponse = await authorizeUser(
-      body.email,
-      body.password,
+      email,
+      password,
       "/mfa/"
     );
 
     if (validateResponse.status === 200) {
       const mfaToken = validateResponse?.data?.access_token;
 
+      let additionalData = {};
+
+      if (mfaFactor == "oob") {
+        additionalData = {
+         "oob_channels": [channel],
+         "phone_number": number
+        }
+      }
+
       const otpRequest = {
         method: "POST",
         url: `https://${auth0Domain}/mfa/associate`,
@@ -177,7 +194,8 @@ const enrollOTP = onRequest(async (req, res) => {
           Authorization: `Bearer ${mfaToken}`,
         },
         data: {
-          authenticator_types: ["otp"],
+          authenticator_types: [mfaFactor],
+          ...additionalData
         },
       };
 
@@ -202,22 +220,40 @@ const enrollOTP = onRequest(async (req, res) => {
   }
 });
 
-const confirmOTP = onRequest(async (req, res) => {
+const confirmMFA = onRequest(async (req, res) => {
   const body = req.body;
 
+  const {
+    mfaToken, 
+    userOtpCode = '',
+    oobCode = '',
+  } = body;
+
   try {
-    const {mfaToken, userOtpCode} = body;
+
+    let additionalData = {};
+
+     if (oobCode.length) {
+      additionalData = {
+        oob_code: `${oobCode}`,
+        binding_code: `${userOtpCode}`
+      }
+    } else {
+      additionalData = {
+        otp: `${userOtpCode}`
+      }
+    }
 
     const options = {
       method: "POST",
       url: `https://${auth0Domain}/oauth/token`,
       headers: {"content-type": "application/x-www-form-urlencoded"},
       data: new URLSearchParams({
-        grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
+        grant_type: `http://auth0.com/oauth/grant-type/${oobCode.length ? 'mfa-oob' : 'mfa-otp'}`,
         client_id: `${auth0ClientId}`,
-        mfa_token: `${mfaToken}`,
         client_secret: `${auth0ClientSecret}`,
-        otp: `${userOtpCode}`,
+        mfa_token: `${mfaToken}`,
+        ...additionalData
       }),
     };
 
@@ -268,7 +304,7 @@ module.exports = {
   updateUser,
   updatePassword,
   authMethods,
-  enrollOTP,
-  confirmOTP,
+  enrollMFA,
+  confirmMFA,
   unenrollMFA,
 };
diff --git a/functions/auth0/index.js b/functions/auth0/index.js
@@ -3,24 +3,24 @@ const admin = require("firebase-admin");
 const express = require("express");
 
 admin.initializeApp();
-const auth0 = express();
+const app = express();
 
 const {
   updateUser,
   updatePassword,
-  enrollOTP,
-  confirmOTP,
+  enrollMFA,
+  confirmMFA,
   authMethods,
   unenrollMFA
 } = require("./api/auth0");
 
-auth0.use(express.json());
+app.use(express.json());
 
-auth0.post("/updateUser", updateUser);
-auth0.post("/updatePassword", updatePassword);
-auth0.post("/enrollOTP", enrollOTP);
-auth0.post("/confirmOTP", confirmOTP);
-auth0.post("/authMethods", authMethods);
-auth0.post("/unenrollMFA", unenrollMFA);
+app.post("/auth0/updateUser", updateUser);
+app.post("/auth0/updatePassword", updatePassword);
+app.post("/auth0/enrollMFA", enrollMFA);
+app.post("/auth0/confirmMFA", confirmMFA);
+app.post("/auth0/authMethods", authMethods);
+app.post("/auth0/unenrollMFA", unenrollMFA);
 
-exports.auth0 = onRequest(auth0);
+exports.auth0 = onRequest(app);
diff --git a/functions/auth0/utils/constants.js b/functions/auth0/utils/constants.js
@@ -8,4 +8,4 @@ module.exports = {
   auth0ClientId,
   auth0ClientSecret,
   auth0Domain
-};
+};
diff --git a/functions/maps/index.js b/functions/maps/index.js
@@ -4,9 +4,9 @@ const axios = require("axios");
 const express = require("express");
 
 admin.initializeApp();
-const maps = express();
+const app = express();
 
-maps.use(express.json());
+app.use(express.json());
 
 const corsProxyAutofill = onRequest(async (req, res) => {
 
@@ -16,7 +16,7 @@ const corsProxyPlaceDetails = onRequest(async (req, res) => {
 
 });
 
-maps.get("/corsProxyPlaceDetails", corsProxyPlaceDetails);
-maps.get("/corsProxyAutofill", corsProxyAutofill);
+app.get("/maps/corsProxyPlaceDetails", corsProxyPlaceDetails);
+app.get("/maps/corsProxyAutofill", corsProxyAutofill);
 
-exports.maps = onRequest(maps);
+exports.maps = onRequest(app);
diff --git a/images/flags/ad.png b/images/flags/ad.png
diff --git a/images/flags/ae.png b/images/flags/ae.png
diff --git a/images/flags/af.png b/images/flags/af.png
diff --git a/images/flags/ag.png b/images/flags/ag.png
diff --git a/images/flags/ai.png b/images/flags/ai.png
diff --git a/images/flags/al.png b/images/flags/al.png
diff --git a/images/flags/am.png b/images/flags/am.png
diff --git a/images/flags/an.png b/images/flags/an.png
diff --git a/images/flags/ao.png b/images/flags/ao.png
diff --git a/images/flags/aq.png b/images/flags/aq.png
diff --git a/images/flags/ar.png b/images/flags/ar.png
diff --git a/images/flags/as.png b/images/flags/as.png
diff --git a/images/flags/at.png b/images/flags/at.png
diff --git a/images/flags/au.png b/images/flags/au.png
diff --git a/images/flags/aw.png b/images/flags/aw.png
diff --git a/images/flags/ax.png b/images/flags/ax.png
diff --git a/images/flags/az.png b/images/flags/az.png
diff --git a/images/flags/ba.png b/images/flags/ba.png
diff --git a/images/flags/bb.png b/images/flags/bb.png
diff --git a/images/flags/bd.png b/images/flags/bd.png
diff --git a/images/flags/be.png b/images/flags/be.png
diff --git a/images/flags/bf.png b/images/flags/bf.png
diff --git a/images/flags/bg.png b/images/flags/bg.png
diff --git a/images/flags/bh.png b/images/flags/bh.png
diff --git a/images/flags/bi.png b/images/flags/bi.png
diff --git a/images/flags/bj.png b/images/flags/bj.png
diff --git a/images/flags/bl.png b/images/flags/bl.png
diff --git a/images/flags/bm.png b/images/flags/bm.png
diff --git a/images/flags/bn.png b/images/flags/bn.png
diff --git a/images/flags/bo.png b/images/flags/bo.png
diff --git a/images/flags/bq.png b/images/flags/bq.png
diff --git a/images/flags/br.png b/images/flags/br.png
diff --git a/images/flags/bs.png b/images/flags/bs.png
diff --git a/images/flags/bt.png b/images/flags/bt.png
diff --git a/images/flags/bv.png b/images/flags/bv.png
diff --git a/images/flags/bw.png b/images/flags/bw.png
diff --git a/images/flags/by.png b/images/flags/by.png
diff --git a/images/flags/bz.png b/images/flags/bz.png
diff --git a/images/flags/ca.png b/images/flags/ca.png
diff --git a/images/flags/cc.png b/images/flags/cc.png
diff --git a/images/flags/cd.png b/images/flags/cd.png
diff --git a/images/flags/cf.png b/images/flags/cf.png
diff --git a/images/flags/cg.png b/images/flags/cg.png
diff --git a/images/flags/ch.png b/images/flags/ch.png
diff --git a/images/flags/ci.png b/images/flags/ci.png
diff --git a/images/flags/ck.png b/images/flags/ck.png
diff --git a/images/flags/cl.png b/images/flags/cl.png
diff --git a/images/flags/cm.png b/images/flags/cm.png
diff --git a/images/flags/cn.png b/images/flags/cn.png
diff --git a/images/flags/co.png b/images/flags/co.png
diff --git a/images/flags/cr.png b/images/flags/cr.png
diff --git a/images/flags/cu.png b/images/flags/cu.png
diff --git a/images/flags/cv.png b/images/flags/cv.png
diff --git a/images/flags/cw.png b/images/flags/cw.png
diff --git a/images/flags/cx.png b/images/flags/cx.png
diff --git a/images/flags/cy.png b/images/flags/cy.png
diff --git a/images/flags/cz.png b/images/flags/cz.png
diff --git a/images/flags/de.png b/images/flags/de.png
diff --git a/images/flags/dj.png b/images/flags/dj.png
diff --git a/images/flags/dk.png b/images/flags/dk.png
diff --git a/images/flags/dm.png b/images/flags/dm.png
diff --git a/images/flags/do.png b/images/flags/do.png
diff --git a/images/flags/dz.png b/images/flags/dz.png
diff --git a/images/flags/ec.png b/images/flags/ec.png
diff --git a/images/flags/ee.png b/images/flags/ee.png
diff --git a/images/flags/eg.png b/images/flags/eg.png
diff --git a/images/flags/eh.png b/images/flags/eh.png
diff --git a/images/flags/er.png b/images/flags/er.png
diff --git a/images/flags/es.png b/images/flags/es.png
diff --git a/images/flags/et.png b/images/flags/et.png
diff --git a/images/flags/eu.png b/images/flags/eu.png
diff --git a/images/flags/fi.png b/images/flags/fi.png
diff --git a/images/flags/fj.png b/images/flags/fj.png
diff --git a/images/flags/fk.png b/images/flags/fk.png
diff --git a/images/flags/fm.png b/images/flags/fm.png
diff --git a/images/flags/fo.png b/images/flags/fo.png
diff --git a/images/flags/fr.png b/images/flags/fr.png
diff --git a/images/flags/ga.png b/images/flags/ga.png
diff --git a/images/flags/gb-eng.png b/images/flags/gb-eng.png
diff --git a/images/flags/gb-nir.png b/images/flags/gb-nir.png
diff --git a/images/flags/gb-sct.png b/images/flags/gb-sct.png
diff --git a/images/flags/gb-wls.png b/images/flags/gb-wls.png
diff --git a/images/flags/gb.png b/images/flags/gb.png
diff --git a/images/flags/gd.png b/images/flags/gd.png
diff --git a/images/flags/ge.png b/images/flags/ge.png
diff --git a/images/flags/gf.png b/images/flags/gf.png
diff --git a/images/flags/gg.png b/images/flags/gg.png
diff --git a/images/flags/gh.png b/images/flags/gh.png
diff --git a/images/flags/gi.png b/images/flags/gi.png
diff --git a/images/flags/gl.png b/images/flags/gl.png
diff --git a/images/flags/gm.png b/images/flags/gm.png
diff --git a/images/flags/gn.png b/images/flags/gn.png
diff --git a/images/flags/gp.png b/images/flags/gp.png
diff --git a/images/flags/gq.png b/images/flags/gq.png
diff --git a/images/flags/gr.png b/images/flags/gr.png
diff --git a/images/flags/gs.png b/images/flags/gs.png
diff --git a/images/flags/gt.png b/images/flags/gt.png
diff --git a/images/flags/gu.png b/images/flags/gu.png
diff --git a/images/flags/gw.png b/images/flags/gw.png
diff --git a/images/flags/gy.png b/images/flags/gy.png
diff --git a/images/flags/hk.png b/images/flags/hk.png
diff --git a/images/flags/hm.png b/images/flags/hm.png
diff --git a/images/flags/hn.png b/images/flags/hn.png
diff --git a/images/flags/hr.png b/images/flags/hr.png
diff --git a/images/flags/ht.png b/images/flags/ht.png
diff --git a/images/flags/hu.png b/images/flags/hu.png
diff --git a/images/flags/id.png b/images/flags/id.png
diff --git a/images/flags/ie.png b/images/flags/ie.png
diff --git a/images/flags/il.png b/images/flags/il.png
diff --git a/images/flags/im.png b/images/flags/im.png
diff --git a/images/flags/in.png b/images/flags/in.png
diff --git a/images/flags/io.png b/images/flags/io.png
diff --git a/images/flags/iq.png b/images/flags/iq.png
diff --git a/images/flags/ir.png b/images/flags/ir.png
diff --git a/images/flags/is.png b/images/flags/is.png
diff --git a/images/flags/it.png b/images/flags/it.png
diff --git a/images/flags/je.png b/images/flags/je.png
diff --git a/images/flags/jm.png b/images/flags/jm.png
diff --git a/images/flags/jo.png b/images/flags/jo.png
diff --git a/images/flags/jp.png b/images/flags/jp.png
diff --git a/images/flags/ke.png b/images/flags/ke.png
diff --git a/images/flags/kg.png b/images/flags/kg.png
diff --git a/images/flags/kh.png b/images/flags/kh.png
diff --git a/images/flags/ki.png b/images/flags/ki.png
diff --git a/images/flags/km.png b/images/flags/km.png
diff --git a/images/flags/kn.png b/images/flags/kn.png
diff --git a/images/flags/kp.png b/images/flags/kp.png
diff --git a/images/flags/kr.png b/images/flags/kr.png
diff --git a/images/flags/kw.png b/images/flags/kw.png
diff --git a/images/flags/ky.png b/images/flags/ky.png
diff --git a/images/flags/kz.png b/images/flags/kz.png
diff --git a/images/flags/la.png b/images/flags/la.png
diff --git a/images/flags/lb.png b/images/flags/lb.png
diff --git a/images/flags/lc.png b/images/flags/lc.png
diff --git a/images/flags/li.png b/images/flags/li.png
diff --git a/images/flags/lk.png b/images/flags/lk.png
diff --git a/images/flags/lr.png b/images/flags/lr.png
diff --git a/images/flags/ls.png b/images/flags/ls.png
diff --git a/images/flags/lt.png b/images/flags/lt.png
diff --git a/images/flags/lu.png b/images/flags/lu.png
diff --git a/images/flags/lv.png b/images/flags/lv.png
diff --git a/images/flags/ly.png b/images/flags/ly.png
diff --git a/images/flags/ma.png b/images/flags/ma.png
diff --git a/images/flags/mc.png b/images/flags/mc.png
diff --git a/images/flags/md.png b/images/flags/md.png
diff --git a/images/flags/me.png b/images/flags/me.png
diff --git a/images/flags/mf.png b/images/flags/mf.png
diff --git a/images/flags/mg.png b/images/flags/mg.png
diff --git a/images/flags/mh.png b/images/flags/mh.png
diff --git a/images/flags/mk.png b/images/flags/mk.png
diff --git a/images/flags/ml.png b/images/flags/ml.png
diff --git a/images/flags/mm.png b/images/flags/mm.png
diff --git a/images/flags/mn.png b/images/flags/mn.png
diff --git a/images/flags/mo.png b/images/flags/mo.png
diff --git a/images/flags/mp.png b/images/flags/mp.png
diff --git a/images/flags/mq.png b/images/flags/mq.png
diff --git a/images/flags/mr.png b/images/flags/mr.png
diff --git a/images/flags/ms.png b/images/flags/ms.png
diff --git a/images/flags/mt.png b/images/flags/mt.png
diff --git a/images/flags/mu.png b/images/flags/mu.png
diff --git a/images/flags/mv.png b/images/flags/mv.png
diff --git a/images/flags/mw.png b/images/flags/mw.png
diff --git a/images/flags/mx.png b/images/flags/mx.png
diff --git a/images/flags/my.png b/images/flags/my.png
diff --git a/images/flags/mz.png b/images/flags/mz.png
diff --git a/images/flags/na.png b/images/flags/na.png
diff --git a/images/flags/nc.png b/images/flags/nc.png
diff --git a/images/flags/ne.png b/images/flags/ne.png
diff --git a/images/flags/nf.png b/images/flags/nf.png
diff --git a/images/flags/ng.png b/images/flags/ng.png
diff --git a/images/flags/ni.png b/images/flags/ni.png
diff --git a/images/flags/nl.png b/images/flags/nl.png
diff --git a/images/flags/no.png b/images/flags/no.png
diff --git a/images/flags/np.png b/images/flags/np.png
diff --git a/images/flags/nr.png b/images/flags/nr.png
diff --git a/images/flags/nu.png b/images/flags/nu.png
diff --git a/images/flags/nz.png b/images/flags/nz.png
diff --git a/images/flags/om.png b/images/flags/om.png
diff --git a/images/flags/pa.png b/images/flags/pa.png
diff --git a/images/flags/pe.png b/images/flags/pe.png
diff --git a/images/flags/pf.png b/images/flags/pf.png
diff --git a/images/flags/pg.png b/images/flags/pg.png
diff --git a/images/flags/ph.png b/images/flags/ph.png
diff --git a/images/flags/pk.png b/images/flags/pk.png
diff --git a/images/flags/pl.png b/images/flags/pl.png
diff --git a/images/flags/pm.png b/images/flags/pm.png
diff --git a/images/flags/pn.png b/images/flags/pn.png
diff --git a/images/flags/pr.png b/images/flags/pr.png
diff --git a/images/flags/ps.png b/images/flags/ps.png
diff --git a/images/flags/pt.png b/images/flags/pt.png
diff --git a/images/flags/pw.png b/images/flags/pw.png
diff --git a/images/flags/py.png b/images/flags/py.png
diff --git a/images/flags/qa.png b/images/flags/qa.png
diff --git a/images/flags/re.png b/images/flags/re.png
diff --git a/images/flags/ro.png b/images/flags/ro.png
diff --git a/images/flags/rs.png b/images/flags/rs.png
diff --git a/images/flags/ru.png b/images/flags/ru.png
diff --git a/images/flags/rw.png b/images/flags/rw.png
diff --git a/images/flags/sa.png b/images/flags/sa.png
diff --git a/images/flags/sb.png b/images/flags/sb.png
diff --git a/images/flags/sc.png b/images/flags/sc.png
diff --git a/images/flags/sd.png b/images/flags/sd.png
diff --git a/images/flags/se.png b/images/flags/se.png
diff --git a/images/flags/sg.png b/images/flags/sg.png
diff --git a/images/flags/sh.png b/images/flags/sh.png
diff --git a/images/flags/si.png b/images/flags/si.png
diff --git a/images/flags/sj.png b/images/flags/sj.png
diff --git a/images/flags/sk.png b/images/flags/sk.png
diff --git a/images/flags/sl.png b/images/flags/sl.png
diff --git a/images/flags/sm.png b/images/flags/sm.png
diff --git a/images/flags/sn.png b/images/flags/sn.png
diff --git a/images/flags/so.png b/images/flags/so.png
diff --git a/images/flags/sr.png b/images/flags/sr.png
diff --git a/images/flags/ss.png b/images/flags/ss.png
diff --git a/images/flags/st.png b/images/flags/st.png
diff --git a/images/flags/sv.png b/images/flags/sv.png
diff --git a/images/flags/sx.png b/images/flags/sx.png
diff --git a/images/flags/sy.png b/images/flags/sy.png
diff --git a/images/flags/sz.png b/images/flags/sz.png
diff --git a/images/flags/tc.png b/images/flags/tc.png
diff --git a/images/flags/td.png b/images/flags/td.png
diff --git a/images/flags/tf.png b/images/flags/tf.png
diff --git a/images/flags/tg.png b/images/flags/tg.png
diff --git a/images/flags/th.png b/images/flags/th.png
diff --git a/images/flags/tj.png b/images/flags/tj.png
diff --git a/images/flags/tk.png b/images/flags/tk.png
diff --git a/images/flags/tl.png b/images/flags/tl.png
diff --git a/images/flags/tm.png b/images/flags/tm.png
diff --git a/images/flags/tn.png b/images/flags/tn.png
diff --git a/images/flags/to.png b/images/flags/to.png
diff --git a/images/flags/tr.png b/images/flags/tr.png
diff --git a/images/flags/tt.png b/images/flags/tt.png
diff --git a/images/flags/tv.png b/images/flags/tv.png
diff --git a/images/flags/tw.png b/images/flags/tw.png
diff --git a/images/flags/tz.png b/images/flags/tz.png
diff --git a/images/flags/ua.png b/images/flags/ua.png
diff --git a/images/flags/ug.png b/images/flags/ug.png
diff --git a/images/flags/um.png b/images/flags/um.png
diff --git a/images/flags/us.png b/images/flags/us.png
diff --git a/images/flags/uy.png b/images/flags/uy.png
diff --git a/images/flags/uz.png b/images/flags/uz.png
diff --git a/images/flags/va.png b/images/flags/va.png
diff --git a/images/flags/vc.png b/images/flags/vc.png
diff --git a/images/flags/ve.png b/images/flags/ve.png
diff --git a/images/flags/vg.png b/images/flags/vg.png
diff --git a/images/flags/vi.png b/images/flags/vi.png
diff --git a/images/flags/vn.png b/images/flags/vn.png
diff --git a/images/flags/vu.png b/images/flags/vu.png
diff --git a/images/flags/wf.png b/images/flags/wf.png
diff --git a/images/flags/ws.png b/images/flags/ws.png
diff --git a/images/flags/xk.png b/images/flags/xk.png
diff --git a/images/flags/ye.png b/images/flags/ye.png
diff --git a/images/flags/yt.png b/images/flags/yt.png
diff --git a/images/flags/za.png b/images/flags/za.png
diff --git a/images/flags/zm.png b/images/flags/zm.png
diff --git a/images/flags/zw.png b/images/flags/zw.png
diff --git a/lib/controllers/api.dart b/lib/controllers/api.dart
@@ -12,9 +12,9 @@ abstract class Api {
 
   void getAuthenticationMethods(final String userId);
 
-  void enrollAuthenticator(final Map<String, String> body);
+  void enrollMFA(final Map<String, String> body);
 
-  void confirmTOTP(final Map<String, String> body);
+  void confirmMFA(final Map<String, String> body);
 
-  void unenrollAuthenticator(final Map<String, String> body);
+  void unenrollMFA(final Map<String, String> body);
 }
diff --git a/lib/controllers/api_implementation.dart b/lib/controllers/api_implementation.dart
@@ -86,7 +86,7 @@ class UserApi extends Api {
       final body = json.encode(user);
 
       final response = await http.post(
-          Uri.parse('/updateUser'),
+          Uri.parse('/auth0/updateUser'),
           headers: headers,
           body: body
       ).timeout(const Duration(seconds: 15));
@@ -119,7 +119,7 @@ class UserApi extends Api {
 
     try {
       final request = await http.post(
-          Uri.parse('/updatePassword'),
+          Uri.parse('/auth0/updatePassword'),
           headers: headers,
           body: reqBody
       );
@@ -151,7 +151,7 @@ class UserApi extends Api {
 
     try {
       final request = await http.post(
-          Uri.parse('/authMethods'),
+          Uri.parse('/auth0/authMethods'),
           headers: headers,
           body: reqBody
       );
@@ -171,7 +171,7 @@ class UserApi extends Api {
 
   @override
   Future<Map<String, dynamic>>
-    enrollAuthenticator(final Map<String, String> body) async {
+    enrollMFA(final Map<String, String> body) async {
     late Map<String, dynamic> response;
 
     final headers = {
@@ -182,23 +182,25 @@ class UserApi extends Api {
 
     try {
       final request = await http.post(
-          Uri.parse('/enrollOTP'),
+          Uri.parse('/auth0/enrollMFA'),
           headers: headers,
           body: reqBody
       );
 
       final jsonBody = jsonDecode(request.body);
-      final barcode = jsonBody['barcode_uri'];
-      final token = jsonBody['token'];
-      final tokenSecret = jsonBody['secret'];
+      final barcode = jsonBody['barcode_uri'] ?? '';
+      final token = jsonBody['token'] ?? '';
+      final tokenSecret = jsonBody['secret'] ?? '';
+      final oobCode = jsonBody['oob_code'] ?? '';
 
       if (request.statusCode == HttpStatus.ok) {
         response = {
           'status': request.statusCode,
           'body': request.body,
           'barcode': barcode,
           'token': token,
-          'barcode_string': tokenSecret
+          'barcode_string': tokenSecret,
+          'oobCode': oobCode
         };
       } else {
         throw ApiException(request.statusCode, request.body);
@@ -220,7 +222,7 @@ class UserApi extends Api {
   }
 
   @override
-  Future<ApiResponse> confirmTOTP(final Map<String, String> body) async {
+  Future<ApiResponse> confirmMFA(final Map<String, String> body) async {
 
     final headers = {
       'Content-Type': 'application/json'
@@ -230,7 +232,7 @@ class UserApi extends Api {
 
     try {
       final request = await http.post(
-          Uri.parse('/confirmOTP'),
+          Uri.parse('/auth0/confirmMFA'),
           headers: headers,
           body: reqBody
       );
@@ -249,8 +251,7 @@ class UserApi extends Api {
   }
 
   @override
-  Future<ApiResponse> unenrollAuthenticator(final Map<String, String> body)
-  async {
+  Future<ApiResponse> unenrollMFA(final Map<String, String> body) async {
 
     final headers = {
       'Content-Type': 'application/json'
@@ -260,7 +261,7 @@ class UserApi extends Api {
 
     try {
       final request = await http.post(
-          Uri.parse('/unenrollMFA'),
+          Uri.parse('/auth0/unenrollMFA'),
           headers: headers,
           body: reqBody
       );