feat(duo): multi device selection (#2137)

Allow users to select and save the preferred duo device and method, depending on availability in the duo account. A default enrollment URL is provided and adjusted if returned by the duo API. This allows auto-enrollment if enabled by the administrator.

Closes #594. Closes #1039.

1 files changed, 47 insertions, 0 deletions

diff --git a/internal/handlers/types.go b/internal/handlers/types.go
index 4fa4886e9..2082b62c2 100644
--- a/internal/handlers/types.go
+++ b/internal/handlers/types.go
@@ -11,6 +11,24 @@ type MethodList = []string
 
 type authorizationMatching int
 
+// UserInfo is the model of user info and second factor preferences.
+type UserInfo struct {
+	// The users display name.
+	DisplayName string `json:"display_name"`
+
+	// The preferred 2FA method.
+	Method string `json:"method" valid:"required"`
+
+	// True if a security key has been registered.
+	HasU2F bool `json:"has_u2f" valid:"required"`
+
+	// True if a TOTP device has been registered.
+	HasTOTP bool `json:"has_totp" valid:"required"`
+
+	// True if a Duo device and method has been enrolled.
+	HasDuo bool `json:"has_duo" valid:"required"`
+}
+
 // signTOTPRequestBody model of the request body received by TOTP authentication endpoint.
 type signTOTPRequestBody struct {
 	Token     string `json:"token" valid:"required"`
@@ -25,6 +43,7 @@ type signU2FRequestBody struct {
 
 type signDuoRequestBody struct {
 	TargetURL string `json:"targetURL"`
+	Passcode  string `json:"passcode"`
 }
 
 // firstFactorRequestBody represents the JSON body received by the endpoint.
@@ -60,6 +79,34 @@ type TOTPKeyResponse struct {
 	OTPAuthURL   string `json:"otpauth_url"`
 }
 
+// DuoDeviceBody the selected Duo device and method.
+type DuoDeviceBody struct {
+	Device string `json:"device" valid:"required"`
+	Method string `json:"method" valid:"required"`
+}
+
+// DuoDevice represents Duo devices and methods.
+type DuoDevice struct {
+	Device       string   `json:"device"`
+	DisplayName  string   `json:"display_name"`
+	Capabilities []string `json:"capabilities"`
+}
+
+// DuoDevicesResponse represents all available user devices and methods as well as an optional enrollment url.
+type DuoDevicesResponse struct {
+	Result    string      `json:"result" valid:"required"`
+	Devices   []DuoDevice `json:"devices,omitempty"`
+	EnrollURL string      `json:"enroll_url,omitempty"`
+}
+
+// DuoSignResponse represents a result of the preauth and or auth call with further optional info.
+type DuoSignResponse struct {
+	Result    string      `json:"result" valid:"required"`
+	Devices   []DuoDevice `json:"devices,omitempty"`
+	Redirect  string      `json:"redirect,omitempty"`
+	EnrollURL string      `json:"enroll_url,omitempty"`
+}
+
 // StateResponse represents the response sent by the state endpoint.
 type StateResponse struct {
 	Username              string               `json:"username"`