Implement OTP-Based Authentication Endpoints

[sanaderi]

Implement OTP (One-Time Password) verification for authentication flows, including login, registration, and password recovery. OTP codes should be sent to the user's email address and verified before completing sensitive operations.

Additionally, implement configurable email templates for OTP messages to allow customization from the admin panel or application settings.

---

Requirements

General

• Generate a 5 digit numeric OTP.
• Send OTP via email.
• OTP should have an expiration time.
• OTP should be single-use.
• Limit OTP resend attempts and verification attempts.
• Return appropriate error messages for expired or invalid OTPs.

---

Login Flow

Current Behavior

• User logs in using email and password.

New Behavior

1. User submits:

   • Email
   • Password

2. Validate the password.

3. If:

   • the password is incorrect, or
   • the user's password is considered weak/simple,

   then:

   • Generate an OTP.
   • Send the OTP to the user's email.
   • Return a response indicating that OTP verification is required.

4. User submits the received OTP.

5. If the OTP is valid:

   • Complete the login process.
   • Return authentication tokens.

---

Registration Flow

Step 1

Request

• Email

Actions

• Validate that the email is not already registered.
• Generate an OTP.
• Send the OTP to the provided email.

Step 2

Request

• Email
• OTP

Actions

• Verify the OTP.
• If valid, allow the user to continue registration.

Step 3

Request

• Email
• Password

Password Requirements

• Minimum length: 6 characters.
• Simple or complex passwords are allowed.

Actions

• Create the user account.
• Complete registration.

---

Password Recovery Flow

Step 1

Request

• Email

Actions

• Generate an OTP.
• Send the OTP to the user's email.

Step 2

Request

• Email
• OTP

Actions

• Verify the OTP.

Step 3

Request

• Email
• New Password

Password Requirements

• Minimum length: 6 characters.
• Simple or complex passwords are allowed.

Actions

• Update the user's password.
• Invalidate any active OTPs for the user.

---

OTP Email Template Configuration

Implement configurable email templates for OTP messages.

Requirements

• Add a dedicated email template for OTP messages.
• Allow administrators to customize:
  • Subject
  • Email body
• Support template placeholders, including:
  • {{OTP}}
  • {{ExpirationMinutes}}
  • {{ApplicationName}}
• Use the configured template for:
  • Login OTP
  • Registration OTP
  • Password recovery OTP
• Fall back to the default template if no custom template is configured.

---

Acceptance Criteria

• OTP is a 5 digit numeric code.
• OTP is sent via email.
• OTP expires after the configured duration.
• OTP cannot be reused.
• Registration requires successful email verification before password creation.
• Password recovery requires successful OTP verification before password reset.
• Login requires OTP verification when the password is incorrect or the user's password is considered weak.
• Passwords must be at least 6 characters long.
• Both simple and complex passwords are accepted.
• A configurable OTP email template is available.
• OTP email templates support placeholders ({{OTP}}, {{ExpirationMinutes}}, {{ApplicationName}}).
• The configured template is used for all OTP-related emails.
• Proper validation and error responses are returned for invalid, expired, or reused OTPs.