feat: email-based authentication codes for MFA/2FA

[netroms]

Summary

This adds 2FA login with a code sent via email as a new feature.

NOTE: This PR removes the enforced 2FA enrollment with TOTP functionality and does not address this for email 2FA either. The requirements for enforced enrollment needs to be addressed in a separate JIRA ticket. Enforced enrollment for TOTP was never used, so it's safe to remove.

TODO:

• Add rate limiting to email 2FA sending
• Do sending of 2FA email async so we don't block UI
• Enforced enrollment

Automatic tests

• TwoFactorControllerTest
• UserServiceTest
• AuthenticationControllerTest
• LoginTest (E2E)

Manual tests

• Enable 2FA email in system settings: POST api/42/systemSettings/email2FAEnabled?value=true
• Set up a working email SMTP server in settings
• Verify your email: POST api/account/sendEmailVerification (email with code will be sent to your verified email)
• Enroll in email 2FA: POST api/2fa/enrollEmail2FA
• Enable email 2FA with code sent to your email: POST api/2fa/enable with {code:CODE_SENT_TO_EMAIL}
• Try to login, code should be sent to email
• Now login should show 2FA code input, enter the code and submit
• Observe you are logged in

Jira:

DHIS2-13334

[david-mackessy]

some small comments left, good job 👍

[jbee]

I saw you moved more (internal) APIs from using a user's UID to the username which I think is a good thing. As we discussed it seems to me that the username is our identifier when it comes to questions of authentication. 👍

The are a handful or so details to correct and some suggestions about the REST API endpoints.

[jbee]

There a some comments left

• on visibility and TX-annotations in services
• on which HTTP method and response code to use for the new endpoints (session controller)

[sonarcloud]

Quality Gate passed

Issues
0 New issues
8 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud