feat: Option to disable 2FA for OAuth users

.changeset/tiny-geckos-kiss.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Added a new setting which allows workspace admins to disable email two factor authentication for SSO (OAuth) users. If enabled, SSO users won't be asked for email two factor authentication.

apps/meteor/app/2fa/server/code/EmailCheck.ts

@@ -1,4 +1,4 @@
-import type { IUser } from '@rocket.chat/core-typings';
+import { isOAuthUser, type IUser } from '@rocket.chat/core-typings';
 import { Users } from '@rocket.chat/models';
 import { Random } from '@rocket.chat/random';
 import bcrypt from 'bcrypt';
@@ -28,6 +28,10 @@ export class EmailCheck implements ICodeCheck {
 			return false;
 		}
 
+		if (settings.get('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users') && isOAuthUser(user)) {
+			return false;
+		}
+
 		return this.getUserVerifiedEmails(user).length > 0;
 	}
 

apps/meteor/app/2fa/server/code/PasswordCheckFallback.ts

@@ -14,7 +14,7 @@ export class PasswordCheckFallback implements ICodeCheck {
 		// TODO: Remove this setting for version 4.0 forcing the
 		// password fallback for who has password set.
 		if (settings.get('Accounts_TwoFactorAuthentication_Enforce_Password_Fallback')) {
-			return user.services?.password?.bcrypt != null;
+			return user.services?.password?.bcrypt !== undefined;
 		}
 		return false;
 	}

apps/meteor/app/api/server/v1/misc.ts

@@ -1,6 +1,6 @@
 import crypto from 'crypto';
 
-import type { IUser } from '@rocket.chat/core-typings';
+import { isOAuthUser, type IUser } from '@rocket.chat/core-typings';
 import { Settings, Users } from '@rocket.chat/models';
 import {
 	isShieldSvgProps,
@@ -26,7 +26,6 @@ import { hasPermissionAsync } from '../../../authorization/server/functions/hasP
 import { passwordPolicy } from '../../../lib/server';
 import { notifyOnSettingChangedById } from '../../../lib/server/lib/notifyListener';
 import { settings } from '../../../settings/server';
-import { getDefaultUserFields } from '../../../utils/server/functions/getDefaultUserFields';
 import { isSMTPConfigured } from '../../../utils/server/functions/isSMTPConfigured';
 import { getURL } from '../../../utils/server/getURL';
 import { API } from '../api';
@@ -35,6 +34,38 @@ import { getPaginationItems } from '../helpers/getPaginationItems';
 import { getUserFromParams } from '../helpers/getUserFromParams';
 import { getUserInfo } from '../helpers/getUserInfo';
 
+const userFields = {
+	'name': 1,
+	'username': 1,
+	'nickname': 1,
+	'emails': 1,
+	'status': 1,
+	'statusDefault': 1,
+	'statusText': 1,
+	'statusConnection': 1,
+	'bio': 1,
+	'avatarOrigin': 1,
+	'utcOffset': 1,
+	'language': 1,
+	'settings': 1,
+	'enableAutoAway': 1,
+	'idleTimeLimit': 1,
+	'roles': 1,
+	'active': 1,
+	'defaultRoom': 1,
+	'customFields': 1,
+	'requirePasswordChange': 1,
+	'requirePasswordChangeReason': 1,
+	'statusLivechat': 1,
+	'banners': 1,
+	'oauth.authorizedClients': 1,
+	'_updatedAt': 1,
+	'avatarETag': 1,
+	'extension': 1,
+	'openBusinessHours': 1,
+	'services': 1,
+};
+
 /**
  * @openapi
  *  /api/v1/me:
@@ -176,15 +207,18 @@ API.v1.addRoute(
 	{ authRequired: true },
 	{
 		async get() {
-			const fields = getDefaultUserFields();
-			const { services, ...user } = (await Users.findOneById(this.userId, { projection: fields })) as IUser;
+			const { services, ...user } = (await Users.findOneById(this.userId, { projection: userFields })) as IUser;
 
 			return API.v1.success(
 				await getUserInfo({
 					...user,
+					isOAuthUser: isOAuthUser({ ...user, services }),
 					...(services && {
 						services: {
-							...services,
+							...(services.github && { github: services.github }),
+							...(services.gitlab && { gitlab: services.gitlab }),
+							...(services.email2fa?.enabled && { email2fa: { enabled: services.email2fa.enabled } }),
+							...(services.totp?.enabled && { totp: { enabled: services.totp.enabled } }),
 							password: {
 								// The password hash shouldn't be leaked but the client may need to know if it exists.
 								exists: Boolean(services?.password?.bcrypt),

apps/meteor/client/views/account/security/TwoFactorEmail.tsx

@@ -1,15 +1,18 @@
 import { Box, Button, Margins } from '@rocket.chat/fuselage';
-import { useUser, useTranslation } from '@rocket.chat/ui-contexts';
-import type { ComponentProps, ReactElement } from 'react';
+import { useUser, useTranslation, useSetting } from '@rocket.chat/ui-contexts';
+import type { ComponentProps } from 'react';
 import React, { useCallback } from 'react';
 
 import { useEndpointAction } from '../../../hooks/useEndpointAction';
 
-const TwoFactorEmail = (props: ComponentProps<typeof Box>): ReactElement => {
+const TwoFactorEmail = (props: ComponentProps<typeof Box>): JSX.Element | null => {
 	const t = useTranslation();
 	const user = useUser();
 
+	const disableEmail2FAForOAuth = useSetting('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users');
+	const isOAuthUser = user?.isOAuthUser;
 	const isEnabled = user?.services?.email2fa?.enabled;
+	const isAllowed = !isOAuthUser || !disableEmail2FAForOAuth;
 
 	const enable2faAction = useEndpointAction('POST', '/v1/users.2fa.enableEmail', {
 		successMessage: t('Two-factor_authentication_enabled'),
@@ -25,6 +28,10 @@ const TwoFactorEmail = (props: ComponentProps<typeof Box>): ReactElement => {
 		await disable2faAction();
 	}, [disable2faAction]);
 
+	if (!isAllowed) {
+		return null;
+	}
+
 	return (
 		<Box display='flex' flexDirection='column' alignItems='flex-start' mbs={16} {...props}>
 			<Margins blockEnd={8}>

apps/meteor/server/settings/accounts.ts

@@ -31,6 +31,18 @@ export const createAccountSettings = () =>
 				public: true,
 			});
 
+			await this.add('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users', false, {
+				type: 'boolean',
+				enableQuery: [
+					enable2FA,
+					{
+						_id: 'Accounts_TwoFactorAuthentication_By_Email_Enabled',
+						value: true,
+					},
+				],
+				public: true,
+			});
+
 			await this.add('Accounts_TwoFactorAuthentication_By_Email_Auto_Opt_In', true, {
 				type: 'boolean',
 				enableQuery: [

packages/core-typings/src/IUser.ts

@@ -45,7 +45,35 @@ export type ILoginUsername =
 	  };
 export type LoginUsername = string | ILoginUsername;
 
-export interface IUserServices {
+export interface IOAuthUserServices {
+	google?: any;
+	facebook?: any;
+	github?: any;
+	linkedin?: any;
+	twitter?: any;
+	gitlab?: any;
+	saml?: {
+		inResponseTo?: string;
+		provider?: string;
+		idp?: string;
+		idpSession?: string;
+		nameID?: string;
+	};
+	ldap?: {
+		id: string;
+		idAttribute?: string;
+	};
+	nextcloud?: {
+		accessToken: string;
+		refreshToken: string;
+		serverURL: string;
+	};
+	dolphin?: {
+		NickName?: string;
+	};
+}
+
+export interface IUserServices extends IOAuthUserServices {
 	password?: {
 		exists?: boolean;
 		bcrypt?: string;
@@ -62,12 +90,6 @@ export interface IUserServices {
 		refreshToken: string;
 		expiresAt: Date;
 	};
-	google?: any;
-	facebook?: any;
-	github?: any;
-	linkedin?: any;
-	twitter?: any;
-	gitlab?: any;
 	totp?: {
 		enabled: boolean;
 		hashedBackup: string[];
@@ -79,27 +101,37 @@ export interface IUserServices {
 		changedAt: Date;
 	};
 	emailCode?: IUserEmailCode;
-	saml?: {
-		inResponseTo?: string;
-		provider?: string;
-		idp?: string;
-		idpSession?: string;
-		nameID?: string;
-	};
-	ldap?: {
-		id: string;
-		idAttribute?: string;
-	};
-	nextcloud?: {
-		accessToken: string;
-		refreshToken: string;
-		serverURL: string;
-	};
-	dolphin?: {
-		NickName?: string;
-	};
 }
 
+type IUserService = keyof IUserServices;
+type IOAuthServices = keyof IOAuthUserServices;
+
+const defaultOAuthKeys = [
+	'google',
+	'dolphin',
+	'facebook',
+	'github',
+	'gitlab',
+	'google',
+	'ldap',
+	'linkedin',
+	'nextcloud',
+	'saml',
+	'twitter',
+] as IOAuthServices[];
+const userServiceKeys = ['emailCode', 'email2fa', 'totp', 'resume', 'password', 'passwordHistory', 'cloud', 'email'] as IUserService[];
+
+export const isUserServiceKey = (key: string): key is IUserService => key in userServiceKeys || key in defaultOAuthKeys;
+
+export const isDefaultOAuthUser = (user: IUser): boolean =>
+	!!(user.services && Object.keys(user.services).some((key) => key in defaultOAuthKeys));
+
+export const isCustomOAuthUser = (user: IUser): boolean =>
+	!!(user.services && Object.keys(user.services).some((key) => !isUserServiceKey(key)));
+
+export const isOAuthUser = (user: IUser): boolean =>
+	!!(user.services && Object.keys(user.services).some((key: any) => !userServiceKeys.includes(key)));
+
 export interface IUserEmail {
 	address: string;
 	verified?: boolean;
@@ -185,6 +217,7 @@ export interface IUser extends IRocketChatRecord {
 	_pendingAvatarUrl?: string;
 	requirePasswordChange?: boolean;
 	requirePasswordChangeReason?: string;
+	isOAuthUser?: boolean;
 }
 
 export interface IRegisterUser extends IUser {

packages/i18n/src/locales/en.i18n.json

@@ -282,6 +282,7 @@
   "Accounts_TwoFactorAuthentication_By_Email_Code_Expiration": "Time to expire the code sent via email in seconds",
   "Accounts_TwoFactorAuthentication_By_Email_Enabled": "Enable Two Factor Authentication via Email",
   "Accounts_TwoFactorAuthentication_By_Email_Enabled_Description": "Users with email verified and the option enabled in their profile page will receive an email with a temporary code to authorize certain actions like login, save the profile, etc.",
+  "Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users": "Disable two factor authentication via email for OAuth users",
   "Accounts_TwoFactorAuthentication_Enabled": "Enable Two Factor Authentication",
   "Accounts_TwoFactorAuthentication_Enabled_Description": "If deactivated, this setting will deactivate all Two Factor Authentication.  \nTo force users to use Two Factor Authentication, the admin has to configure the 'user' role to enforce it.",
   "Accounts_TwoFactorAuthentication_Enforce_Password_Fallback": "Enforce password fallback",