Improve usability of totp generate secret mutation

Author: Taucher2003

app/graphql/mutations/users/mfa/totp/generate_secret.rb

@@ -7,11 +7,19 @@ module Totp
         class GenerateSecret < BaseMutation
           description 'Generates an encrypted totp secret'
 
-          field :secret, String, null: true, description: 'The created and signed secret'
+          field :secret, String, null: true, description: 'The created secret'
+          field :signed_secret, String, null: true, description: 'The created and signed secret'
 
           def resolve
-            ::Users::Mfa::Totp::GenerateSecretService.new(current_authentication).execute
-                                                     .to_mutation_response(success_key: :secret)
+            response = ::Users::Mfa::Totp::GenerateSecretService.new(current_authentication).execute
+
+            return response.to_mutation_response unless response.success?
+
+            {
+              secret: response.payload[:secret],
+              signed_secret: response.payload[:signed_secret],
+              errors: [],
+            }
           end
         end
       end

app/services/users/mfa/totp/generate_secret_service.rb

@@ -22,8 +22,12 @@ def execute
           totp_secret = ROTP::Base32.random
 
           ServiceResponse.success(message: 'TOTP secret generated',
-                                  payload: Rails.application.message_verifier(:totp_secret)
-                                                .generate(totp_secret))
+                                  payload: {
+                                    signed_secret: Rails.application
+                                                        .message_verifier(:totp_secret)
+                                                        .generate(totp_secret),
+                                    secret: totp_secret,
+                                  })
         end
       end
     end

docs/graphql/mutation/usersmfatotpgeneratesecret.md

@@ -16,4 +16,5 @@ Generates an encrypted totp secret
 |------|------|-------------|
 | `clientMutationId` | [`String`](../scalar/string.md) | A unique identifier for the client performing the mutation. |
 | `errors` | [`[Error!]!`](../object/error.md) | Errors encountered during execution of the mutation. |
-| `secret` | [`String`](../scalar/string.md) | The created and signed secret |
+| `secret` | [`String`](../scalar/string.md) | The created secret |
+| `signedSecret` | [`String`](../scalar/string.md) | The created and signed secret |

spec/requests/graphql/mutation/users/mfa/totp/generate_secret_mutation_spec.rb

@@ -13,6 +13,7 @@
         usersMfaTotpGenerateSecret(input: {}) {
           #{error_query}
           secret
+          signedSecret
         }
       }
     QUERY
@@ -25,7 +26,13 @@
 
     it 'generates secret' do
       mutate!
-      expect(graphql_data_at(:users_mfa_totp_generate_secret, :secret)).to be_present
+      secret = graphql_data_at(:users_mfa_totp_generate_secret, :secret)
+      signed_secret = graphql_data_at(:users_mfa_totp_generate_secret, :signed_secret)
+
+      expect(secret).to be_present
+
+      signed_totp = Rails.application.message_verifier(:totp_secret).verify(signed_secret)
+      expect(signed_totp).to eq(secret)
     end
   end
 end

spec/services/users/mfa/totp/generate_secret_service_spec.rb

@@ -26,9 +26,14 @@
       it { is_expected.to be_success }
 
       it 'is valid totp secret' do
-        totp = ROTP::TOTP.new(service_response.payload.split('--').first)
+        totp = ROTP::TOTP.new(service_response.payload[:signed_secret].split('--').first)
         expect(totp.secret.length).to eq(48)
       end
+
+      it 'returns a matching secret' do
+        signed_totp = Rails.application.message_verifier(:totp_secret).verify(service_response.payload[:signed_secret])
+        expect(signed_totp).to eq(service_response.payload[:secret])
+      end
     end
   end
 end