Change verificationCodeSendRateLimit to minVerificationCodeSendPeriod

application/src/main/java/org/thingsboard/server/controller/TwoFaConfigController.java

@@ -214,7 +214,7 @@ public class TwoFaConfigController extends BaseController {
     @ApiOperation(value = "Save platform 2FA settings (savePlatformTwoFaSettings)",
             notes = "Save 2FA settings for platform. The settings have following properties:\n" +
                     "- `providers` - the list of 2FA providers' configs. Users will only be allowed to use 2FA providers from this list. \n\n" +
-                    "- `verificationCodeSendRateLimit` - rate limit configuration for verification code sending. " +
+                    "- `minVerificationCodeSendPeriod` - minimal period in seconds to wait after verification code send request to send next request. " +
                     "The format is standard: 'amountOfRequests:periodInSeconds'. The value of '1:60' would limit verification " +
                     "code sending requests to one per minute.\n" +
                     "- `verificationCodeCheckRateLimit` - rate limit configuration for verification code checking.\n" +
@@ -246,7 +246,7 @@ public class TwoFaConfigController extends BaseController {
                     "      \"smsVerificationMessageTemplate\": \"Here is your verification code: ${code}\"\n" +
                     "    }\n" +
                     "  ],\n" +
-                    "  \"verificationCodeSendRateLimit\": \"1:60\",\n" +
+                    "  \"minVerificationCodeSendPeriod\": 60,\n" +
                     "  \"verificationCodeCheckRateLimit\": \"3:900\",\n" +
                     "  \"maxVerificationFailuresBeforeUserLockout\": 10,\n" +
                     "  \"totalAllowedTimeForVerification\": 600\n" +

application/src/main/java/org/thingsboard/server/service/security/auth/mfa/DefaultTwoFactorAuthService.java

@@ -86,7 +86,12 @@ public class DefaultTwoFactorAuthService implements TwoFactorAuthService {
         PlatformTwoFaSettings twoFaSettings = configManager.getPlatformTwoFaSettings(user.getTenantId(), true)
                 .orElseThrow(() -> PROVIDER_NOT_CONFIGURED_ERROR);
         if (checkLimits) {
-            checkRateLimits(user.getId(), accountConfig.getProviderType(), twoFaSettings.getVerificationCodeSendRateLimit(), verificationCodeSendingRateLimits);
+            Integer minVerificationCodeSendPeriod = twoFaSettings.getMinVerificationCodeSendPeriod();
+            String rateLimit = null;
+            if (minVerificationCodeSendPeriod != null && minVerificationCodeSendPeriod > 0) {
+                rateLimit = "1:" + minVerificationCodeSendPeriod;
+            }
+            checkRateLimits(user.getId(), accountConfig.getProviderType(), rateLimit, verificationCodeSendingRateLimits);
         }
 
         TwoFaProviderConfig providerConfig = twoFaSettings.getProviderConfig(accountConfig.getProviderType())

application/src/test/java/org/thingsboard/server/controller/TwoFactorAuthConfigTest.java

@@ -96,7 +96,6 @@ public abstract class TwoFactorAuthConfigTest extends AbstractControllerTest {
 
         PlatformTwoFaSettings twoFaSettings = new PlatformTwoFaSettings();
         twoFaSettings.setProviders(List.of(totpTwoFaProviderConfig, smsTwoFaProviderConfig));
-        twoFaSettings.setVerificationCodeSendRateLimit("1:60");
         twoFaSettings.setVerificationCodeCheckRateLimit("3:900");
         twoFaSettings.setMaxVerificationFailuresBeforeUserLockout(10);
         twoFaSettings.setTotalAllowedTimeForVerification(3600);
@@ -115,7 +114,6 @@ public abstract class TwoFactorAuthConfigTest extends AbstractControllerTest {
 
         PlatformTwoFaSettings twoFaSettings = new PlatformTwoFaSettings();
         twoFaSettings.setProviders(Collections.emptyList());
-        twoFaSettings.setVerificationCodeSendRateLimit("ab:aba");
         twoFaSettings.setVerificationCodeCheckRateLimit("0:12");
         twoFaSettings.setMaxVerificationFailuresBeforeUserLockout(-1);
         twoFaSettings.setTotalAllowedTimeForVerification(0);
@@ -124,7 +122,6 @@ public abstract class TwoFactorAuthConfigTest extends AbstractControllerTest {
                 .andExpect(status().isBadRequest()));
 
         assertThat(errorMessage).contains(
-                "verification code send rate limit configuration is invalid",
                 "verification code check rate limit configuration is invalid",
                 "maximum number of verification failure before user lockout must be positive",
                 "total amount of time allotted for verification must be greater than 0"

application/src/test/java/org/thingsboard/server/controller/TwoFactorAuthTest.java

@@ -202,15 +202,13 @@ public abstract class TwoFactorAuthTest extends AbstractControllerTest {
     @Test
     public void testSendVerificationCode_rateLimit() throws Exception {
         configureTotpTwoFa(twoFaSettings -> {
-            twoFaSettings.setVerificationCodeSendRateLimit("3:10");
+            twoFaSettings.setMinVerificationCodeSendPeriod(10);
         });
 
         logInWithPreVerificationToken(username, password);
 
-        for (int i = 0; i < 3; i++) {
-            doPost("/api/auth/2fa/verification/send?providerType=TOTP")
-                    .andExpect(status().isOk());
-        }
+        doPost("/api/auth/2fa/verification/send?providerType=TOTP")
+                .andExpect(status().isOk());
 
         String rateLimitExceededError = getErrorMessage(doPost("/api/auth/2fa/verification/send?providerType=TOTP")
                 .andExpect(status().isTooManyRequests()));

common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/PlatformTwoFaSettings.java

@@ -33,8 +33,7 @@ public class PlatformTwoFaSettings {
     @Valid
     private List<TwoFaProviderConfig> providers;
 
-    @Pattern(regexp = "[1-9]\\d*:[1-9]\\d*", message = "verification code send rate limit configuration is invalid")
-    private String verificationCodeSendRateLimit;
+    private Integer minVerificationCodeSendPeriod;
     @Pattern(regexp = "[1-9]\\d*:[1-9]\\d*", message = "verification code check rate limit configuration is invalid")
     private String verificationCodeCheckRateLimit;
     @Min(value = 0, message = "maximum number of verification failure before user lockout must be positive")