[MM-59069] Make sure OTP are actual One Time Password (#28074)

Automatic Merge

server/public/model/user.go

@@ -75,40 +75,41 @@ const (
 // This struct's serializer methods are auto-generated. If a new field is added/removed,
 // please run make gen-serialized.
 type User struct {
-	Id                     string    `json:"id"`
-	CreateAt               int64     `json:"create_at,omitempty"`
-	UpdateAt               int64     `json:"update_at,omitempty"`
-	DeleteAt               int64     `json:"delete_at"`
-	Username               string    `json:"username"`
-	Password               string    `json:"password,omitempty"`
-	AuthData               *string   `json:"auth_data,omitempty"`
-	AuthService            string    `json:"auth_service"`
-	Email                  string    `json:"email"`
-	EmailVerified          bool      `json:"email_verified,omitempty"`
-	Nickname               string    `json:"nickname"`
-	FirstName              string    `json:"first_name"`
-	LastName               string    `json:"last_name"`
-	Position               string    `json:"position"`
-	Roles                  string    `json:"roles"`
-	AllowMarketing         bool      `json:"allow_marketing,omitempty"`
-	Props                  StringMap `json:"props,omitempty"`
-	NotifyProps            StringMap `json:"notify_props,omitempty"`
-	LastPasswordUpdate     int64     `json:"last_password_update,omitempty"`
-	LastPictureUpdate      int64     `json:"last_picture_update,omitempty"`
-	FailedAttempts         int       `json:"failed_attempts,omitempty"`
-	Locale                 string    `json:"locale"`
-	Timezone               StringMap `json:"timezone"`
-	MfaActive              bool      `json:"mfa_active,omitempty"`
-	MfaSecret              string    `json:"mfa_secret,omitempty"`
-	RemoteId               *string   `json:"remote_id,omitempty"`
-	LastActivityAt         int64     `json:"last_activity_at,omitempty"`
-	IsBot                  bool      `json:"is_bot,omitempty"`
-	BotDescription         string    `json:"bot_description,omitempty"`
-	BotLastIconUpdate      int64     `json:"bot_last_icon_update,omitempty"`
-	TermsOfServiceId       string    `json:"terms_of_service_id,omitempty"`
-	TermsOfServiceCreateAt int64     `json:"terms_of_service_create_at,omitempty"`
-	DisableWelcomeEmail    bool      `json:"disable_welcome_email"`
-	LastLogin              int64     `json:"last_login,omitempty"`
+	Id                     string      `json:"id"`
+	CreateAt               int64       `json:"create_at,omitempty"`
+	UpdateAt               int64       `json:"update_at,omitempty"`
+	DeleteAt               int64       `json:"delete_at"`
+	Username               string      `json:"username"`
+	Password               string      `json:"password,omitempty"`
+	AuthData               *string     `json:"auth_data,omitempty"`
+	AuthService            string      `json:"auth_service"`
+	Email                  string      `json:"email"`
+	EmailVerified          bool        `json:"email_verified,omitempty"`
+	Nickname               string      `json:"nickname"`
+	FirstName              string      `json:"first_name"`
+	LastName               string      `json:"last_name"`
+	Position               string      `json:"position"`
+	Roles                  string      `json:"roles"`
+	AllowMarketing         bool        `json:"allow_marketing,omitempty"`
+	Props                  StringMap   `json:"props,omitempty"`
+	NotifyProps            StringMap   `json:"notify_props,omitempty"`
+	LastPasswordUpdate     int64       `json:"last_password_update,omitempty"`
+	LastPictureUpdate      int64       `json:"last_picture_update,omitempty"`
+	FailedAttempts         int         `json:"failed_attempts,omitempty"`
+	Locale                 string      `json:"locale"`
+	Timezone               StringMap   `json:"timezone"`
+	MfaActive              bool        `json:"mfa_active,omitempty"`
+	MfaSecret              string      `json:"mfa_secret,omitempty"`
+	RemoteId               *string     `json:"remote_id,omitempty"`
+	LastActivityAt         int64       `json:"last_activity_at,omitempty"`
+	IsBot                  bool        `json:"is_bot,omitempty"`
+	BotDescription         string      `json:"bot_description,omitempty"`
+	BotLastIconUpdate      int64       `json:"bot_last_icon_update,omitempty"`
+	TermsOfServiceId       string      `json:"terms_of_service_id,omitempty"`
+	TermsOfServiceCreateAt int64       `json:"terms_of_service_create_at,omitempty"`
+	DisableWelcomeEmail    bool        `json:"disable_welcome_email"`
+	LastLogin              int64       `json:"last_login,omitempty"`
+	MfaUsedTimestamps      StringArray `json:"mfa_used_timestamps,omitempty"`
 }
 
 func (u *User) Auditable() map[string]interface{} {
@@ -660,6 +661,7 @@ func (u *User) Sanitize(options map[string]bool) {
 	u.Password = ""
 	u.AuthData = NewPointer("")
 	u.MfaSecret = ""
+	u.MfaUsedTimestamps = nil
 	u.LastLogin = 0
 
 	if len(options) != 0 && !options["email"] {
@@ -694,6 +696,7 @@ func (u *User) SanitizeInput(isAdmin bool) {
 	u.FailedAttempts = 0
 	u.MfaActive = false
 	u.MfaSecret = ""
+	u.MfaUsedTimestamps = StringArray{}
 	u.Email = strings.TrimSpace(u.Email)
 	u.LastActivityAt = 0
 }
@@ -702,6 +705,7 @@ func (u *User) ClearNonProfileFields(asAdmin bool) {
 	u.Password = ""
 	u.AuthData = NewPointer("")
 	u.MfaSecret = ""
+	u.MfaUsedTimestamps = nil
 	u.EmailVerified = false
 	u.AllowMarketing = false
 	u.LastPasswordUpdate = 0