[5.x] OTP

config/app_local.example.php

@@ -367,6 +367,14 @@
     //     'clientSecret' => '####',
     // ],
 
+    /**
+     * OTP authentication setup
+     */
+    // 'Otp' => [
+    //     'send' => '/otp',
+    //     'users_skip_otp' => [], // array of usernames to skip OTP authentication
+    // ],
+
     /**
      * Pagination default settings
      *

config/routes.php

@@ -85,6 +85,18 @@
         ['_name' => 'login:oauth2']
     );
 
+    // OTP.
+    $routes->connect(
+        '/otp',
+        ['controller' => 'Login', 'action' => 'otp'],
+        ['_name' => 'otp'],
+    );
+    $routes->connect(
+        '/otp/verify',
+        ['controller' => 'Login', 'action' => 'otpVerify'],
+        ['_name' => 'otp:verify'],
+    );
+
     // Dashboard.
     $routes->connect(
         '/',

locales/default.pot

@@ -1,7 +1,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: BEdita 4 \n"
-"POT-Creation-Date: 2026-03-10 13:13:21 \n"
+"POT-Creation-Date: 2026-03-24 09:25:54 \n"
 "MIME-Version: 1.0 \n"
 "Content-Transfer-Encoding: 8bit \n"
 "Language-Team: BEdita I18N & I10N Team \n"
@@ -322,6 +322,9 @@ msgstr ""
 msgid "External Auth"
 msgstr ""
 
+msgid "Failed to send OTP code. Please try again later."
+msgstr ""
+
 msgid "Failed to write file to disk"
 msgstr ""
 
@@ -597,6 +600,9 @@ msgstr ""
 msgid "Number of updated objects"
 msgstr ""
 
+msgid "OTP code is expired or invalid"
+msgstr ""
+
 msgid "Object Types"
 msgstr ""
 
@@ -633,6 +639,9 @@ msgstr ""
 msgid "On"
 msgstr ""
 
+msgid "One Time Password"
+msgstr ""
+
 msgid "Only my contents"
 msgstr ""
 
@@ -783,6 +792,9 @@ msgstr ""
 msgid "Request password"
 msgstr ""
 
+msgid "Resend OTP"
+msgstr ""
+
 msgid "Reset"
 msgstr ""
 
@@ -993,6 +1005,9 @@ msgstr ""
 msgid "Verified"
 msgstr ""
 
+msgid "Verify"
+msgstr ""
+
 msgid "Version"
 msgstr ""
 

locales/en_US/default.po

@@ -1,7 +1,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: BEdita Manager \n"
-"POT-Creation-Date: 2026-03-10 13:13:21 \n"
+"POT-Creation-Date: 2026-03-24 09:25:54 \n"
 "PO-Revision-Date:  \n"
 "Last-Translator:  \n"
 "Language-Team: BEdita I18N & I10N Team \n"
@@ -325,6 +325,9 @@ msgstr ""
 msgid "External Auth"
 msgstr ""
 
+msgid "Failed to send OTP code. Please try again later."
+msgstr ""
+
 msgid "Failed to write file to disk"
 msgstr ""
 
@@ -600,6 +603,9 @@ msgstr ""
 msgid "Number of updated objects"
 msgstr ""
 
+msgid "OTP code is expired or invalid"
+msgstr ""
+
 msgid "Object Types"
 msgstr ""
 
@@ -636,6 +642,9 @@ msgstr ""
 msgid "On"
 msgstr ""
 
+msgid "One Time Password"
+msgstr ""
+
 msgid "Only my contents"
 msgstr ""
 
@@ -786,6 +795,9 @@ msgstr ""
 msgid "Request password"
 msgstr ""
 
+msgid "Resend OTP"
+msgstr ""
+
 msgid "Reset"
 msgstr ""
 
@@ -996,6 +1008,9 @@ msgstr ""
 msgid "Verified"
 msgstr ""
 
+msgid "Verify"
+msgstr ""
+
 msgid "Version"
 msgstr ""
 

locales/it_IT/default.po

@@ -1,7 +1,7 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: BEdita Manager \n"
-"POT-Creation-Date: 2026-03-10 13:13:21 \n"
+"POT-Creation-Date: 2026-03-24 09:25:54 \n"
 "PO-Revision-Date:  \n"
 "Last-Translator:  \n"
 "Language-Team: BEdita I18N & I10N Team \n"
@@ -327,6 +327,9 @@ msgstr "Esporta Filtrati"
 msgid "External Auth"
 msgstr "Autenticazioni esterne"
 
+msgid "Failed to send OTP code. Please try again later."
+msgstr "Codice OTP non inviato. Riprova più tardi."
+
 msgid "Failed to write file to disk"
 msgstr "Scrittura file su disco fallita"
 
@@ -605,6 +608,9 @@ msgstr "Numero di errori di accesso"
 msgid "Number of updated objects"
 msgstr "Numero di oggetti aggiornati"
 
+msgid "OTP code is expired or invalid"
+msgstr "Codice OTP è scaduto o non valido"
+
 msgid "Object Types"
 msgstr "Tipi di Oggetto"
 
@@ -641,6 +647,9 @@ msgstr "Vecchia Password"
 msgid "On"
 msgstr ""
 
+msgid "One Time Password"
+msgstr "Codice monouso"
+
 msgid "Only my contents"
 msgstr "Solo i miei contenuti"
 
@@ -793,6 +802,9 @@ msgstr "Rimuovi"
 msgid "Request password"
 msgstr "Reimposta password"
 
+msgid "Resend OTP"
+msgstr "Invia nuovamente OTP"
+
 msgid "Reset"
 msgstr "Resetta"
 
@@ -1004,6 +1016,9 @@ msgstr "Partita Iva"
 msgid "Verified"
 msgstr "Verificato"
 
+msgid "Verify"
+msgstr "Verifica"
+
 msgid "Version"
 msgstr "Versione"
 

src/Application.php

@@ -15,6 +15,7 @@
 use App\Event\TreeCacheEventHandler;
 use App\Identifier\ApiIdentifier;
 use App\Middleware\ConfigurationMiddleware;
+use App\Middleware\OtpMiddleware;
 use App\Middleware\ProjectMiddleware;
 use App\Middleware\RecoveryMiddleware;
 use App\Middleware\StatusMiddleware;
@@ -150,6 +151,9 @@ public function middleware($middlewareQueue): MiddlewareQueue
             // Authentication middleware.
             ->add(new AuthenticationMiddleware($this))
 
+            // Otp middleware.
+            ->add(new OtpMiddleware())
+
             // Authentication middleware.
             ->add(new OAuth2Middleware())
 

src/Controller/LoginController.php

@@ -1,4 +1,6 @@
 <?php
+declare(strict_types=1);
+
 /**
  * BEdita, API-first content management framework
  * Copyright 2022 ChannelWeb Srl, Chialab Srl
@@ -13,8 +15,11 @@
 namespace App\Controller;
 
 use App\Application;
+use Cake\Core\Configure;
 use Cake\Core\InstanceConfigTrait;
 use Cake\Http\Response;
+use Cake\Utility\Hash;
+use Throwable;
 
 /**
  * Perform basic login and logout operations.
@@ -27,7 +32,7 @@ class LoginController extends AppController
      * @inheritDoc
      */
     protected $_defaultConfig = [
-        // Projects configuration files base path
+        'otp' => null,
         'projectsPath' => CONFIG . 'projects' . DS,
     ];
 
@@ -38,6 +43,10 @@ public function initialize(): void
     {
         parent::initialize();
         $this->Authentication->allowUnauthenticated(['login']);
+        $otpConfig = (array)Configure::read('Otp');
+        if (!empty($otpConfig)) {
+            $this->setConfig('otp', $otpConfig);
+        }
     }
 
     /**
@@ -82,6 +91,14 @@ protected function authRequest(): ?Response
         if ($result->isValid()) {
             // Setup current project name.
             $this->setupCurrentProject();
+
+            $provider = $this->request->getParam('provider');
+            $username = $result->getData()['attributes']['username'];
+
+            if (empty($provider) && $this->otpEnabled($username)) {
+                return $this->redirect('/otp');
+            }
+
             // Redirect.
             $target = $this->Authentication->getLoginRedirect() ?? ['_name' => 'dashboard'];
 
@@ -160,4 +177,80 @@ public function handleFlashMessages(array $query): void
             $this->getRequest()->getSession()->delete('Flash');
         }
     }
+
+    /**
+     * Otp verification page.
+     *
+     * @return \Cake\Http\Response|null
+     */
+    public function otp(): ?Response
+    {
+        $this->getRequest()->allowMethod(['get']);
+        if (!$this->otpEnabled()) {
+            return $this->redirect('/login');
+        }
+        try {
+            $otpSession = (array)$this->getRequest()->getSession()->read('Otp');
+            $pending = (string)Hash::get($otpSession, 'pending');
+            $force = $this->getRequest()->getQuery('force', false);
+            if (!$pending || $force) {
+                 // Send OTP code via API
+                $response = $this->apiClient->post(
+                    $this->getConfig('otp.send'),
+                    null,
+                    ['Content-Type' => 'application/json'],
+                );
+                $this->getRequest()->getSession()->write('Otp', [
+                    'otp_code' => $response['data']['otp_code'],
+                    'expires_at' => $response['data']['expires_at'],
+                    'pending' => true,
+                ]);
+            }
+        } catch (Throwable $e) {
+            $this->Flash->error(__('Failed to send OTP code. Please try again later.'));
+        }
+
+        return null;
+    }
+
+    /**
+     * Otp verification request.
+     *
+     * @return \Cake\Http\Response|null
+     */
+    public function otpVerify(): ?Response
+    {
+        $this->getRequest()->allowMethod(['post']);
+        if (!$this->otpEnabled()) {
+            return $this->redirect('/login');
+        }
+        $requestOtpCode = (string)$this->getRequest()->getData('otp_code');
+        $sessionOtpData = $this->getRequest()->getSession()->read('Otp');
+        $sessionOtpCode = (string)Hash::get($sessionOtpData, 'otp_code');
+        $sessionExpiresAt = (string)Hash::get($sessionOtpData, 'expires_at');
+        if (empty($sessionOtpData) || $sessionOtpCode !== $requestOtpCode || strtotime($sessionExpiresAt) < time()) {
+            $reason = __('OTP code is expired or invalid');
+            $this->getRequest()->getSession()->delete('Otp');
+            $this->Flash->error(__($reason));
+
+            return $this->redirect('/otp');
+        }
+        $this->getRequest()->getSession()->delete('Otp');
+
+        return $this->redirect($this->Authentication->getLoginRedirect() ?? ['_name' => 'dashboard']);
+    }
+
+    /**
+     * Check otp is enabled
+     *
+     * @return bool
+     */
+    protected function otpEnabled(?string $username = null): bool
+    {
+        $otpConfig = (array)$this->getConfig('otp');
+        $usersSkipOtp = (array)Hash::get($otpConfig, 'users_skip_otp', []);
+        $skip = $username !== null && in_array($username, $usersSkipOtp);
+
+        return !empty($otpConfig) && !$skip;
+    }
 }