Login

Description#

Allows clients to log into the system.

Input#

Phone number#

  • Validation
    • Required

OTP#

Additional validation#

  • The phone number must belong to an existing client.

Access#

Any non-authenticated user can access this function.

Mechanism#

  • If Function inputOTP is not provided
    1. Generate & save (or overwrite existing) the following OTP data:
      1. Entity propertyToken - A random 4 digit number
      2. Entity propertyExpiration date - 2 minutes from the moment of creation
      3. Entity propertyFailed login attempts - defaults to 0
    2. Send the generated OTP to the provided Function inputphone number via Twilio.
  • If Function inputOTP is provided
    1. Validate the Function inputOTP as follows:
      1. Check if maximum number of attempts (3) has been reached.
      2. Check if the Function inputOTP is expired.
      3. Check if the provided Function inputOTP matches the stored one.
    2. If the validation fails
      • If all the checks pass, but the Function inputOTP is incorrect, increment the failed attempt counter.
      • Return an error to the user with the amount of failed attempts and the maximum possible amount of failed attempts.
    3. If the validation passes
      1. Mark the client as verified if not already verified.
      2. Destroy all existing sessions of the client.
      3. Create a new session for the client.

Notes#

Caveats
  • The validation of the Function inputOTP is split between the input section and the mechanism section because the mechanism validation failure increases the counter while the input does not.