Merge feature/ENG-1111/mfa-lambda (#99)

* first lambda type

* reduce client blast radius (#92)

* Merge jaret/ENG-3601/configure-mfa-lambda (#93)

* MFA lambda configuration

* sb build consistency

---------

Co-authored-by: Brady Wied <brady.wied@fusionauth.io>

* ENG-3487: Tenant-scoped IdPs (#91)

* update domain for tenantId on IdPs (#88)
* add tenantId to IdP lookup by managed domain response (#90)

* Merge wied03/ENG-3602/mfa-lambda-invocation (#94)

* propagate client changes

* client code update from Javadoc

* Merge wied03/ENG-3603/mfa-retrieve-status-post (#95)

* propagate client changes

* client code update from Javadoc

* client generation/new method

* better method name

* missing client stuff

* redo client again

* add IP address client overload (#98)

* naming advice

* mfa lambda

* api fix

* Change function name and parameters

* PR feedback - lambda classses - new package and names

* keep value as mfaTrust within lambda

* pass raw JWT all the way in

* Lambda signature - registration out of context, action and app in

* Change context.encodedJWT to context.accessToken

* rename token to accessToken on status API

---------

Co-authored-by: Jaret Hendrickson <jaret.hendrickson+github@fusionauth.io>
Co-authored-by: Spencer Witt <3409780+spwitt@users.noreply.github.com>
Co-authored-by: Jaret Hendrickson <jaret.hendrickson@fusionauth.io>

Author: 3 people

openapi.yaml

@@ -1298,6 +1298,27 @@ components:
       - ACTIVE
       - PENDING
       - REJECTED
+    Context:
+      description: Represents the inbound lambda parameter 'context' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        accessToken:
+          type: string
+        action:
+          "$ref": "#/components/schemas/MultiFactorAction"
+        application:
+          "$ref": "#/components/schemas/Application"
+        authenticationThreats:
+          type: array
+          uniqueItems: true
+          items: {}
+        eventInfo:
+          "$ref": "#/components/schemas/EventInfo"
+        mfaTrust:
+          "$ref": "#/components/schemas/Trust"
+        policies:
+          "$ref": "#/components/schemas/Policies"
     CoseAlgorithmIdentifier:
       description: A number identifying a cryptographic algorithm. Values should be
         registered with the <a  href="https:www.iana.orgassignmentscosecose.xhtml#algorithms">IANA
@@ -4265,6 +4286,9 @@ components:
         idTokenPopulateId:
           type: string
           format: uuid
+        multiFactorRequirementId:
+          type: string
+          format: uuid
         samlv2PopulateId:
           type: string
           format: uuid
@@ -4359,6 +4383,7 @@ components:
       - SelfServiceRegistrationValidation
       - UserInfoPopulate
       - LoginValidation
+      - MFARequirement
     LinkedInApplicationConfiguration:
       description: ''
       type: object
@@ -4856,6 +4881,14 @@ components:
         total:
           type: integer
           format: int64
+    MultiFactorAction:
+      description: Communicate various actionscontexts in which multi-factor authentication
+        can be used.
+      type: string
+      enum:
+      - changePassword
+      - login
+      - stepUp
     MultiFactorAuthenticatorMethod:
       type: object
       properties:
@@ -5511,6 +5544,17 @@ components:
           type: boolean
         behavior:
           "$ref": "#/components/schemas/UnverifiedBehavior"
+    Policies:
+      description: Represents the inbound lambda parameter 'policies' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        applicationLoginPolicy:
+          "$ref": "#/components/schemas/MultiFactorLoginPolicy"
+        applicationMultiFactorTrustPolicy:
+          "$ref": "#/components/schemas/ApplicationMultiFactorTrustPolicy"
+        tenantLoginPolicy:
+          "$ref": "#/components/schemas/MultiFactorLoginPolicy"
     PreviewMessageTemplateRequest:
       description: ''
       type: object
@@ -5775,6 +5819,8 @@ components:
             type: string
         licensed:
           type: boolean
+        multiFactorLambdas:
+          "$ref": "#/components/schemas/ReactorFeatureStatus"
         scimServer:
           "$ref": "#/components/schemas/ReactorFeatureStatus"
         tenantManagerApplication:
@@ -6045,6 +6091,15 @@ components:
           type: boolean
         enabled:
           type: boolean
+    RequiredLambdaResult:
+      description: Represents the inbound lambda parameter 'result' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        required:
+          type: boolean
+        sendSuspiciousLoginEvent:
+          type: boolean
     RequiresCORSConfiguration:
       description: Interface describing the need for CORS configuration.
       type: object
@@ -6641,6 +6696,15 @@ components:
           type: string
         order:
           "$ref": "#/components/schemas/Sort"
+    StartInstant:
+      type: object
+      properties:
+        applications:
+          type: object
+          additionalProperties:
+            "$ref": "#/components/schemas/ZonedDateTime"
+        tenant:
+          "$ref": "#/components/schemas/ZonedDateTime"
     StatusResponse:
       description: The public Status API response
       type: object
@@ -7035,6 +7099,9 @@ components:
         loginValidationId:
           type: string
           format: uuid
+        multiFactorRequirementId:
+          type: string
+          format: uuid
         scimEnterpriseUserRequestConverterId:
           type: string
           format: uuid
@@ -7450,6 +7517,36 @@ components:
       - SimpleMajority
       - SuperMajority
       - AbsoluteMajority
+    Trust:
+      description: Represents the inbound lambda parameter 'mfaTrust' inside the 'context'
+        parameter for MFA Required lambdas.
+      type: object
+      properties:
+        applicationId:
+          type: string
+          format: uuid
+        attributes:
+          type: object
+          additionalProperties:
+            type: string
+        expirationInstant:
+          "$ref": "#/components/schemas/ZonedDateTime"
+        id:
+          type: string
+        insertInstant:
+          "$ref": "#/components/schemas/ZonedDateTime"
+        startInstants:
+          "$ref": "#/components/schemas/StartInstant"
+        state:
+          type: object
+          additionalProperties:
+            type: object
+        tenantId:
+          type: string
+          format: uuid
+        userId:
+          type: string
+          format: uuid
     TwilioMessengerConfiguration:
       description: ''
       type: object
@@ -7768,6 +7865,25 @@ components:
             "$ref": "#/components/schemas/TwoFactorMethod"
         twoFactorId:
           type: string
+    TwoFactorStatusRequest:
+      description: Check the status of two-factor authentication for a user, with
+        more options than on a GET request.
+      type: object
+      properties:
+        userId:
+          type: string
+          format: uuid
+        accessToken:
+          type: string
+        action:
+          "$ref": "#/components/schemas/MultiFactorAction"
+        applicationId:
+          type: string
+          format: uuid
+        twoFactorTrustId:
+          type: string
+        eventInfo:
+          "$ref": "#/components/schemas/EventInfo"
     TwoFactorStatusResponse:
       description: ''
       type: object
@@ -15638,6 +15754,32 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/Errors"
+  "/api/two-factor/status":
+    post:
+      description: Retrieve a user's two-factor status.  This can be used to see if
+        a user will need to complete a two-factor challenge to complete a login, and
+        optionally identify the state of the two-factor trust across various applications.
+        This operation provides more payload options than retrieveTwoFactorStatus.
+      operationId: retrieveTwoFactorStatusWithRequestWithId
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              "$ref": "#/components/schemas/TwoFactorStatusRequest"
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/TwoFactorStatusResponse"
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Errors"
   "/api/two-factor/status/{twoFactorTrustId}":
     get:
       description: Retrieve a user's two-factor status.  This can be used to see if
@@ -16414,12 +16556,30 @@ paths:
         completing a Two-Factor Step-Up authentication.  An HTTP status code of 400
         with a general error code of [TrustTokenRequired] indicates that a Trust Token
         is required to make a POST request to this API. OR Check to see if the user
-        must obtain a Trust Token Id in order to complete a change password request.
+        must obtain a Trust Request Id in order to complete a change password request.
         When a user has enabled Two-Factor authentication, before you are allowed
         to use the Change Password API to change your password, you must obtain a
-        Trust Token by completing a Two-Factor Step-Up authentication.  An HTTP status
-        code of 400 with a general error code of [TrustTokenRequired] indicates that
-        a Trust Token is required to make a POST request to this API.
+        Trust Request Id by completing a Two-Factor Step-Up authentication.  An HTTP
+        status code of 400 with a general error code of [TrustTokenRequired] indicates
+        that a Trust Token is required to make a POST request to this API. OR Check
+        to see if the user must obtain a Trust Request Id in order to complete a change
+        password request. When a user has enabled Two-Factor authentication, before
+        you are allowed to use the Change Password API to change your password, you
+        must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
       operationId: retrieveUserChangePassword
       parameters:
       - name: loginId
@@ -16435,6 +16595,12 @@ paths:
           items:
             type: string
         description: The identity types that FusionAuth will compare the loginId to.
+      - name: ipAddress
+        in: query
+        schema:
+          type: string
+        description: IP address of the user changing their password. This is used
+          for MFA risk assessment.
       responses:
         '200':
           description: Success
@@ -16485,8 +16651,20 @@ paths:
         your password, you must obtain a Trust Token by completing a Two-Factor Step-Up
         authentication.  An HTTP status code of 400 with a general error code of [TrustTokenRequired]
         indicates that a Trust Token is required to make a POST request to this API.
-      operationId: checkChangePasswordUsingIdWithId
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+      operationId: retrieveUserChangePasswordWithId
       parameters:
+      - name: ipAddress
+        in: query
+        schema:
+          type: string
+        description: IP address of the user changing their password. This is used
+          for MFA risk assessment.
       - name: changePasswordId
         in: path
         schema: