Sync from monorepo 8ac7a9897077

Author: FusionAuth Automation

src/main/java/io/fusionauth/domain/AuthenticationThreats.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, FusionAuth, All Rights Reserved
+ * Copyright (c) 2021-2026, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,5 +19,14 @@
  * @author Brett Pontarelli
  */
 public enum AuthenticationThreats {
-  ImpossibleTravel
+  BotDetected,
+  BlocklistedIp,
+  DormantAccount,
+  DormantPassword,
+  ImpossibleTravel,
+  RecentIdentityChange,
+  RecentPasswordChange,
+  SuspiciousUserAgent,
+  UnrecognizedDevice,
+  UntrustedDevice
 }

src/main/java/io/fusionauth/domain/ClientRiskConfiguration.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package io.fusionauth.domain;
+
+import java.util.Objects;
+
+/**
+ * Flags to enable or disable specific risk signals that contribute to the composite client risk calculation.
+ */
+public class ClientRiskConfiguration extends Enableable implements Buildable<ClientRiskConfiguration> {
+
+  public boolean blocklistedIp = true;
+
+  public boolean botDetected = true;
+
+  public boolean dormantAccount = true;
+
+  public boolean dormantPassword = true;
+
+  public boolean impossibleTravel = true;
+
+  public boolean recentIdentityChange = true;
+
+  public boolean recentPasswordChange = true;
+
+  public boolean suspiciousUserAgent = true;
+
+  public boolean unrecognizedDevice = true;
+
+  public boolean untrustedDevice = true;
+
+  public ClientRiskConfiguration() {
+  }
+
+  public ClientRiskConfiguration(ClientRiskConfiguration other) {
+    this.enabled = other.enabled;
+    this.botDetected = other.botDetected;
+    this.dormantAccount = other.dormantAccount;
+    this.impossibleTravel = other.impossibleTravel;
+    this.blocklistedIp = other.blocklistedIp;
+    this.unrecognizedDevice = other.unrecognizedDevice;
+    this.recentIdentityChange = other.recentIdentityChange;
+    this.dormantPassword = other.dormantPassword;
+    this.recentPasswordChange = other.recentPasswordChange;
+    this.untrustedDevice = other.untrustedDevice;
+    this.suspiciousUserAgent = other.suspiciousUserAgent;
+  }
+
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (!(o instanceof ClientRiskConfiguration)) {
+      return false;
+    }
+    ClientRiskConfiguration that = (ClientRiskConfiguration) o;
+    return enabled == that.enabled &&
+           blocklistedIp == that.blocklistedIp &&
+           botDetected == that.botDetected &&
+           dormantAccount == that.dormantAccount &&
+           dormantPassword == that.dormantPassword &&
+           impossibleTravel == that.impossibleTravel &&
+           recentIdentityChange == that.recentIdentityChange &&
+           recentPasswordChange == that.recentPasswordChange &&
+           suspiciousUserAgent == that.suspiciousUserAgent &&
+           unrecognizedDevice == that.unrecognizedDevice &&
+           untrustedDevice == that.untrustedDevice;
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(enabled, blocklistedIp, botDetected, dormantAccount, dormantPassword, impossibleTravel, recentIdentityChange,
+                        recentPasswordChange, suspiciousUserAgent, unrecognizedDevice, untrustedDevice);
+  }
+
+  @Override
+  public String toString() {
+    return com.inversoft.json.ToString.toString(this);
+  }
+}

src/main/java/io/fusionauth/domain/MultiFactorLoginPolicy.java

@@ -1,12 +1,26 @@
 /*
- * Copyright (c) 2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2022-2026, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
  */
 package io.fusionauth.domain;
 
 /**
  * @author Daniel DeGroff
  */
 public enum MultiFactorLoginPolicy {
+  ChallengeOnHighRisk,
+  ChallengeOnMediumRisk,
   Disabled,
   Enabled,
   Required

src/main/java/io/fusionauth/domain/Tenant.java

@@ -47,6 +47,8 @@ public class Tenant implements Buildable<Tenant> {
 
   public TenantCaptchaConfiguration captchaConfiguration = new TenantCaptchaConfiguration();
 
+  public ClientRiskConfiguration clientRiskConfiguration = new ClientRiskConfiguration();
+
   public boolean configured;
 
   public List<ConnectorPolicy> connectorPolicies = new ArrayList<>();
@@ -133,6 +135,7 @@ public Tenant() {
   public Tenant(Tenant other) {
     this.baseURL = other.baseURL;
     this.captchaConfiguration = new TenantCaptchaConfiguration(other.captchaConfiguration);
+    this.clientRiskConfiguration = new ClientRiskConfiguration(other.clientRiskConfiguration);
     this.configured = other.configured;
     this.connectorPolicies.addAll(other.connectorPolicies.stream().map(ConnectorPolicy::new).collect(Collectors.toList()));
     this.data.putAll(other.data);
@@ -184,6 +187,7 @@ public boolean equals(Object o) {
            httpSessionMaxInactiveInterval == tenant.httpSessionMaxInactiveInterval &&
            Objects.equals(baseURL, tenant.baseURL) &&
            Objects.equals(captchaConfiguration, tenant.captchaConfiguration) &&
+           Objects.equals(clientRiskConfiguration, tenant.clientRiskConfiguration) &&
            Objects.equals(connectorPolicies, tenant.connectorPolicies) &&
            Objects.equals(data, tenant.data) &&
            Objects.equals(emailConfiguration, tenant.emailConfiguration) &&
@@ -228,6 +232,7 @@ public ConnectorPolicy getPolicyByConnectorId(UUID connectorId) {
   public int hashCode() {
     return Objects.hash(baseURL,
                         captchaConfiguration,
+                        clientRiskConfiguration,
                         configured,
                         connectorPolicies,
                         data,

src/main/java/io/fusionauth/domain/TenantMultiFactorConfiguration.java

@@ -29,6 +29,8 @@
 public class TenantMultiFactorConfiguration implements Buildable<TenantMultiFactorConfiguration> {
   public MultiFactorAuthenticatorMethod authenticator = new MultiFactorAuthenticatorMethod().with(mfa -> mfa.enabled = true);
 
+  public boolean debug;
+
   public MultiFactorEmailMethod email = new MultiFactorEmailMethod();
 
   public MultiFactorLoginPolicy loginPolicy = MultiFactorLoginPolicy.Enabled;
@@ -43,6 +45,7 @@ public TenantMultiFactorConfiguration() {
 
   public TenantMultiFactorConfiguration(TenantMultiFactorConfiguration other) {
     this.authenticator = new MultiFactorAuthenticatorMethod(other.authenticator);
+    this.debug = other.debug;
     this.email = new MultiFactorEmailMethod(other.email);
     this.loginPolicy = other.loginPolicy;
     this.sms = new MultiFactorSMSMethod(other.sms);
@@ -67,6 +70,7 @@ public boolean equals(Object o) {
     }
     TenantMultiFactorConfiguration that = (TenantMultiFactorConfiguration) o;
     return Objects.equals(authenticator, that.authenticator) &&
+           debug == that.debug &&
            Objects.equals(email, that.email) &&
            loginPolicy == that.loginPolicy &&
            Objects.equals(sms, that.sms) &&
@@ -75,7 +79,7 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(authenticator, email, loginPolicy, sms, voice);
+    return Objects.hash(authenticator, debug, email, loginPolicy, sms, voice);
   }
 
   @Override

src/main/java/io/fusionauth/domain/TwoFactorMethod.java

@@ -37,6 +37,11 @@ public class TwoFactorMethod implements Buildable<TwoFactorMethod> {
 
   public static final int MaximumNameLength = 256;
 
+  /**
+   * Method which authenticates using a recovery code that was saved during registration.
+   */
+  public static final String RecoveryCode = "recoveryCode";
+
   /**
    * Method which authenticates using a code sent to a phone via SMS or voice.
    */

src/main/java/io/fusionauth/domain/api/BaseLoginRequest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2026, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,8 @@
 public class BaseLoginRequest extends BaseEventRequest {
   public UUID applicationId;
 
+  public Double botDetectionScore;
+
   @Deprecated
   public String ipAddress;
 

src/main/java/io/fusionauth/domain/event/EventType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2026, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -103,6 +103,8 @@ public enum EventType {
 
   UserLoginSuspicious("user.login.suspicious"),
 
+  UserTwoFactorChallenge("user.two-factor.challenge"),
+
   UserPasswordBreach("user.password.breach"),
 
   UserPasswordResetSend("user.password.reset.send"),
@@ -141,7 +143,11 @@ public enum EventType {
 
   UserIdentityVerified("user.identity.verified"),
 
-  UserIdentityUpdate("user.identity.update");
+  UserIdentityUpdate("user.identity.update"),
+
+  UserTwoFactorFailedAttempt("user.two-factor.failed-attempt"),
+
+  UserTwoFactorSuccess("user.two-factor.success");
 
   private static final Map<String, EventType> nameMap = new HashMap<>(EventType.values().length);
 
@@ -205,8 +211,11 @@ public static List<EventType> allTypes() {
                          EventType.UserRegistrationUpdate,
                          EventType.UserRegistrationUpdateComplete,
                          EventType.UserRegistrationVerified,
+                         EventType.UserTwoFactorChallenge,
+                         EventType.UserTwoFactorFailedAttempt,
                          EventType.UserTwoFactorMethodAdd,
                          EventType.UserTwoFactorMethodRemove,
+                         EventType.UserTwoFactorSuccess,
                          EventType.UserUpdate,
                          EventType.UserUpdateComplete
     );

src/main/java/io/fusionauth/domain/event/UserLoginSuspiciousEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021-2024, FusionAuth, All Rights Reserved
+ * Copyright (c) 2021-2026, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,10 +15,12 @@
  */
 package io.fusionauth.domain.event;
 
-import java.util.HashSet;
+import java.util.Comparator;
+import java.util.LinkedHashSet;
 import java.util.Objects;
 import java.util.Set;
 import java.util.UUID;
+import java.util.stream.Collectors;
 
 import com.inversoft.json.JacksonConstructor;
 import io.fusionauth.domain.AuthenticationThreats;
@@ -32,7 +34,7 @@
  * @author Daniel DeGroff
  */
 public class UserLoginSuspiciousEvent extends UserLoginSuccessEvent {
-  public Set<AuthenticationThreats> threatsDetected = new HashSet<>();
+  public Set<AuthenticationThreats> threatsDetected = new LinkedHashSet<>();
 
   @JacksonConstructor
   public UserLoginSuspiciousEvent() {
@@ -41,14 +43,17 @@ public UserLoginSuspiciousEvent() {
   public UserLoginSuspiciousEvent(EventInfo info, UUID applicationId, String authenticationType, BaseIdentityProvider<?> identityProvider,
                                   User user, Set<AuthenticationThreats> threatsDetected) {
     super(info, applicationId, authenticationType, identityProvider, user);
-    this.threatsDetected = threatsDetected;
-
+    this.threatsDetected = threatsDetected.stream()
+                                          .sorted(Comparator.comparing(Enum::name))
+                                          .collect(Collectors.toCollection(LinkedHashSet::new));
   }
 
   public UserLoginSuspiciousEvent(EventInfo info, UUID applicationId, UUID connectorId, String authenticationType, User user,
                                   Set<AuthenticationThreats> threatsDetected) {
     super(info, applicationId, connectorId, authenticationType, user);
-    this.threatsDetected = threatsDetected;
+    this.threatsDetected = threatsDetected.stream()
+                                          .sorted(Comparator.comparing(Enum::name))
+                                          .collect(Collectors.toCollection(LinkedHashSet::new));
   }
 
   @Override