Repository navigation
feat: require recent verified ID to invoke action - #198
Closed
Philivanei wants to merge 23 commits into
Closed
Philivanei wants to merge 23 commits into
Philivanei wants to merge 23 commits into
Conversation
1 task done
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Configuration validation, verification-state handling, revocation availability, accessibility, and security-gate coverage need correction before approval.
6 open issues
What changed in this PR
Adds an optional recent Verified ID requirement for sensitive self-service actions, enforced by the server and reflected in the Function Plane UI.
Changes:
- Adds configurable verification validity and server-side checks for password reset, Temporary Access Pass creation, and risk dismissal.
- Introduces verification-status retrieval, polling, expiry handling, and refresh after verification.
- Adds blocked-action messages, verification badges, and contextual guidance.
| File | Description |
|---|---|
terraform/variables.tf |
Defines requirement and validity inputs. |
terraform/main.tf |
Passes settings to the backend. |
terraform/locals.tf |
Maps new configuration inputs. |
terraform/config.auto.tfvars.sample |
Shows basic requirement settings. |
terraform/config.auto.tfvars.advanced.sample |
Documents optional configuration. |
src/MyWorkID.Server/Strings.cs |
Adds verification error messages. |
src/MyWorkID.Server/ServicesExtensions.cs |
Registers and validates requirement options. |
src/MyWorkID.Server/Options/VerifiedIdRequirementOptions.cs |
Defines enablement and validity defaults. |
src/MyWorkID.Server/Filters/RequireRecentVerifiedIdEndpointFilter.cs |
Enforces recent verification. |
src/MyWorkID.Server/Features/VerifiedId/VerifiedIdRequirementService.cs |
Retrieves and evaluates verification timestamps. |
src/MyWorkID.Server/Features/VerifiedId/VerifiedIdModule.cs |
Registers the service and time provider. |
src/MyWorkID.Server/Features/VerifiedId/Queries/GetVerifiedIdStatus.cs |
Exposes signed-in verification status. |
src/MyWorkID.Server/Features/VerifiedId/LastVerificationTimestampParser.cs |
Parses directory verification attributes. |
src/MyWorkID.Server/Features/VerifiedId/IVerifiedIdRequirementService.cs |
Defines the verification service contract. |
src/MyWorkID.Server/Features/VerifiedId/Entities/VerifiedIdVerificationState.cs |
Models verification validity. |
src/MyWorkID.Server/Features/VerifiedId/Entities/GetVerifiedIdStatusResponse.cs |
Defines the status response. |
src/MyWorkID.Server/Features/UserRiskState/Commands/DismissUserRisk.cs |
Gates risk dismissal. |
src/MyWorkID.Server/Features/ResetPassword/Commands/ResetPassword.cs |
Gates password resets. |
src/MyWorkID.Server/Features/GenerateTap/Commands/GenerateTap.cs |
Gates access-pass creation. |
src/MyWorkID.Server/appsettings-dummy.json |
Documents backend configuration defaults. |
src/MyWorkID.Client/src/types.ts |
Adds status and panel contracts. |
src/MyWorkID.Client/src/services/api-service.ts |
Adds the status API request. |
src/MyWorkID.Client/src/lib/verified-id-status.ts |
Adds timestamp and validity utilities. |
src/MyWorkID.Client/src/hooks/use-verified-id-status.ts |
Loads, polls, and refreshes status. |
src/MyWorkID.Client/src/components/function-plane/user-display.tsx |
Displays verification badges. |
src/MyWorkID.Client/src/components/function-plane/function-plane.tsx |
Integrates blocking and verification guidance. |
src/MyWorkID.Client/src/components/function-plane/function-plane-components/validate-identity.tsx |
Explains requirements and refreshes status after success. |
src/MyWorkID.Client/src/components/function-plane/function-plane-components/password-reset.tsx |
Displays blocked password-reset state. |
src/MyWorkID.Client/src/components/function-plane/function-plane-components/create-tap.tsx |
Adds access-pass blocking and redirect handling. |
src/MyWorkID.Client/src/components/function-plane/blocked-action-notice.tsx |
Provides a shared blocked-action notice. |
src/MyWorkID.Client/src/assets/css/main.css |
Styles badges and generalizes status colors. |
Review effort: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The verification gate trusts timestamps not bound to the signed-in user, allowing someone with access to an account’s session to unlock sensitive actions using their own credential.
7 open issues
6 resolved since last review
Review effort: Balanced
Philivanei
marked this pull request as ready for review
October 30, 2026 10:30
This was referenced Nov 9, 2026
Contributor
Author
|
Superseded by a stack of four smaller PRs (bottom to top): #204, #205, #206, #207. Stack: https://github.com/glueckkanja/MyWorkID/stack/208 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a comprehensive "Verified ID" (identity verification) requirement for sensitive actions in the Function Plane UI. It ensures users must have a recent identity verification to perform actions like password reset, access pass creation, and risk dismissal, and provides clear UI feedback and guidance throughout the process. The changes include new UI badges, blocking logic, and improved user messaging.
Identity Verification Enforcement and User Feedback:
UserDisplaycomponent now shows a verification badge indicating verification status (required, expired, or checking), alongside risk status. [1] [2] [3]Verification Guidance and Recommendations:
ValidateIdentityPaneldisplays a warning box explaining why verification is needed and the validity window, using new icons and formatting. [1] [2] [3]Panel and Component Integration:
blockedReasonprop to display appropriate blocking messages and disable actions when verification is required. [1] [2] [3] [4] [5] [6]ValidateIdentityPanelnow accepts handlers and status objects to refresh verification state after a successful check. [1] [2] [3]Supporting Hooks and Utilities:
useVerifiedIdStatushook to manage and provide verification status throughout the UI. [1] [2]User Experience Improvements:
These changes collectively ensure that users are clearly guided to verify their identity when required and are prevented from performing sensitive actions without proper verification, improving both security and usability.
closes #96