request validator protocol added

NandanPrabhu · NandanPrabhu · commit b27231b16c2a · 2026-01-16T07:16:12.000+05:30
diff --git a/Auth0/Auth0Authentication.swift b/Auth0/Auth0Authentication.swift
@@ -5,6 +5,7 @@
 import Foundation
 
 struct Auth0Authentication: Authentication {
+
     let clientId: String
     let url: URL
     var telemetry: Telemetry
@@ -73,6 +74,94 @@ struct Auth0Authentication: Authentication {
                        dpop: self.dpop)
     }
 
+    func login(withOTP otp: String, mfaToken: String) -> Request<Credentials, AuthenticationError> {
+        let url = URL(string: "oauth/token", relativeTo: self.url)!
+
+        let payload: [String: Any] = [
+            "otp": otp,
+            "mfa_token": mfaToken,
+            "grant_type": "http://auth0.com/oauth/grant-type/mfa-otp",
+            "client_id": self.clientId
+        ]
+
+        return Request(session: session,
+                       url: url,
+                       method: "POST",
+                       handle: authenticationDecodable,
+                       parameters: payload,
+                       logger: self.logger,
+                       telemetry: self.telemetry,
+                       dpop: self.dpop)
+    }
+
+    func login(withOOBCode oobCode: String, mfaToken: String, bindingCode: String?) -> Request<Credentials, AuthenticationError> {
+        let url = URL(string: "oauth/token", relativeTo: self.url)!
+
+        var payload: [String: Any] = [
+            "oob_code": oobCode,
+            "mfa_token": mfaToken,
+            "grant_type": "http://auth0.com/oauth/grant-type/mfa-oob",
+            "client_id": self.clientId
+        ]
+
+        if let bindingCode = bindingCode {
+            payload["binding_code"] = bindingCode
+        }
+
+        return Request(session: session,
+                       url: url,
+                       method: "POST",
+                       handle: authenticationDecodable,
+                       parameters: payload,
+                       logger: self.logger,
+                       telemetry: self.telemetry,
+                       dpop: self.dpop)
+    }
+
+    func login(withRecoveryCode recoveryCode: String, mfaToken: String) -> Request<Credentials, AuthenticationError> {
+        let url = URL(string: "oauth/token", relativeTo: self.url)!
+
+        let payload: [String: Any] = [
+            "recovery_code": recoveryCode,
+            "mfa_token": mfaToken,
+            "grant_type": "http://auth0.com/oauth/grant-type/mfa-recovery-code",
+            "client_id": self.clientId
+        ]
+
+        return Request(session: session,
+                       url: url,
+                       method: "POST",
+                       handle: authenticationDecodable,
+                       parameters: payload,
+                       logger: self.logger,
+                       telemetry: self.telemetry,
+                       dpop: self.dpop)
+    }
+
+    func multifactorChallenge(mfaToken: String, types: [String]?, authenticatorId: String?) -> Request<Challenge, AuthenticationError> {
+        let url = URL(string: "mfa/challenge", relativeTo: self.url)!
+        var payload: [String: String] = [
+            "mfa_token": mfaToken,
+            "client_id": self.clientId
+        ]
+
+        if let types = types {
+            payload["challenge_type"] = types.joined(separator: " ")
+        }
+
+        if let authenticatorId = authenticatorId {
+            payload["authenticator_id"] = authenticatorId
+        }
+
+        return Request(session: session,
+                       url: url,
+                       method: "POST",
+                       handle: authenticationDecodable,
+                       parameters: payload,
+                       logger: self.logger,
+                       telemetry: self.telemetry)
+    }
+
     func login(appleAuthorizationCode authorizationCode: String,
                fullName: PersonNameComponents?,
                profile: [String: Any]?,
diff --git a/Auth0/Authentication.swift b/Auth0/Authentication.swift
@@ -165,7 +165,140 @@ public protocol Authentication: SenderConstraining, Trackable, Loggable, Sendabl
      */
     func login(usernameOrEmail username: String, password: String, realmOrConnection realm: String, audience: String?, scope: String) -> Request<Credentials, AuthenticationError>
 
-     /**
+    /**
+     Verifies multi-factor authentication (MFA) using a one-time password (OTP).
+
+     ## Usage
+
+     ```swift
+     Auth0
+         .authentication()
+         .login(withOTP: "123456", mfaToken: "mfa-token")
+         .start { result in
+             switch result {
+             case .success(let credentials):
+                 print("Obtained credentials: \(credentials)")
+             case .failure(let error):
+                 print("Failed with: \(error)")
+             }
+         }
+     ```
+
+     - Parameters:
+       - otp:      One-time password supplied by a MFA authenticator.
+       - mfaToken: Token returned when authentication fails with an ``AuthenticationError/isMultifactorRequired`` error due to MFA requirement.
+     - Returns: A request that will yield Auth0 user's credentials.
+     - Requires: The `http://auth0.com/oauth/grant-type/mfa-otp` grant. Check
+     [our documentation](https://auth0.com/docs/get-started/applications/application-grant-types) for more information.
+
+     ## See Also
+
+     - [Authentication API Endpoint](https://auth0.com/docs/api/authentication/muti-factor-authentication/verify-mfa-with-otp)
+     */
+    func login(withOTP otp: String, mfaToken: String) -> Request<Credentials, AuthenticationError>
+
+    /// Verifies multi-factor authentication (MFA) using an out-of-band (OOB) challenge (either push notification, SMS
+    /// or voice).
+    ///
+    /// ## Usage
+    ///
+    /// ```swift
+    /// Auth0
+    ///     .authentication()
+    ///     .login(withOOBCode: "123456", mfaToken: "mfa-token")
+    ///     .start { result in
+    ///         switch result {
+    ///         case .success(let credentials):
+    ///             print("Obtained credentials: \(credentials)")
+    ///         case .failure(let error):
+    ///             print("Failed with: \(error)")
+    ///         }
+    ///     }
+    /// ```
+    ///
+    /// - Parameters:
+    ///   - oobCode:     The OOB code received from the challenge request.
+    ///   - mfaToken:    Token returned when authentication fails with an ``AuthenticationError/isMultifactorRequired`` error due to MFA requirement.
+    ///   - bindingCode: A code used to bind the side channel (used to deliver the challenge) with the main channel you are using to authenticate. This is usually an OTP-like code delivered as part of the challenge message.
+    /// - Returns: A request that will yield Auth0 user's credentials.
+    /// - Requires: The `http://auth0.com/oauth/grant-type/mfa-oob` grant. Check
+    /// [our documentation](https://auth0.com/docs/get-started/applications/application-grant-types) for more information.
+    ///
+    /// ## See Also
+    ///
+    /// - [Authentication API Endpoint](https://auth0.com/docs/api/authentication/muti-factor-authentication/verify-with-out-of-band)
+    func login(withOOBCode oobCode: String, mfaToken: String, bindingCode: String?) -> Request<Credentials, AuthenticationError>
+
+    /// Verifies multi-factor authentication (MFA) using a recovery code.
+    /// Some multi-factor authentication (MFA) providers support using a recovery code to login. Use this method to
+    /// authenticate when the user's enrolled device is unavailable, or the user cannot receive the challenge or accept
+    /// it due to connectivity issues.
+    ///
+    /// ## Usage
+    ///
+    /// ```swift
+    /// Auth0
+    ///     .authentication()
+    ///     .login(withRecoveryCode: "recovery-code", mfaToken: "mfa-token")
+    ///     .start { result in
+    ///         switch result {
+    ///         case .success(let credentials):
+    ///             print("Obtained credentials: \(credentials)")
+    ///         case .failure(let error):
+    ///             print("Failed with: \(error)")
+    ///         }
+    ///     }
+    /// ```
+    ///
+    /// - Parameters:
+    ///   - recoveryCode: Recovery code provided by the user.
+    ///   - mfaToken:     Token returned when authentication fails with an ``AuthenticationError/isMultifactorRequired`` error due to MFA requirement.
+    /// - Returns: A request that will yield Auth0 user's credentials. Might include a **recovery code**, which the
+    /// application must display to the user to be stored securely for future use.
+    /// - Requires: The `http://auth0.com/oauth/grant-type/mfa-recovery-code` grant. Check
+    /// [our documentation](https://auth0.com/docs/get-started/applications/application-grant-types) for more information.
+    ///
+    /// ## See Also
+    ///
+    /// - ``Credentials/recoveryCode``
+    /// - [Authentication API Endpoint](https://auth0.com/docs/api/authentication/muti-factor-authentication/verify-with-recovery-code)
+    func login(withRecoveryCode recoveryCode: String, mfaToken: String) -> Request<Credentials, AuthenticationError>
+
+    /// Requests a challenge for multi-factor authentication (MFA) based on the challenge types supported by the
+    /// application and user.
+    ///
+    /// ## Usage
+    ///
+    /// ```swift
+    /// Auth0
+    ///     .authentication()
+    ///     .multifactorChallenge(mfaToken: "mfa-token", types: ["otp"])
+    ///     .start { result in
+    ///         switch result {
+    ///         case .success(let challenge):
+    ///             print("Obtained challenge: \(challenge)")
+    ///         case .failure(let error):
+    ///             print("Failed with: \(error)")
+    ///         }
+    ///     }
+    /// ```
+    ///
+    /// The challenge type is how the user will get the challenge and prove possession. Supported challenge types include:
+    /// * `otp`:  for one-time password (OTP)
+    /// * `oob`:  for SMS/voice messages or out-of-band (OOB)
+    ///
+    /// - Parameters:
+    ///   - mfaToken:        Token returned when authentication fails with an ``AuthenticationError/isMultifactorRequired`` error due to MFA requirement.
+    ///   - types:           A list of the challenges types accepted by your application. Accepted challenge types are `oob` or `otp`. Excluding this parameter means that your application accepts all supported challenge types.
+    ///   - authenticatorId: The ID of the authenticator to challenge. You can get the ID by querying the list of available authenticators for the user.
+    /// - Returns: A request that will yield a multi-factor challenge.
+    ///
+    /// ## See Also
+    ///
+    /// - [Authentication API Endpoint](https://auth0.com/docs/api/authentication/muti-factor-authentication/request-mfa-challenge)
+    func multifactorChallenge(mfaToken: String, types: [String]?, authenticatorId: String?) -> Request<Challenge, AuthenticationError>
+
+    /**
      Logs a user in with their Sign In with Apple authorization code.
 
      ## Usage
@@ -200,7 +333,7 @@ public protocol Authentication: SenderConstraining, Trackable, Loggable, Sendabl
        - authorizationCode: Authorization Code retrieved from Apple Authorization.
        - fullName:          The full name property returned with the Apple ID Credentials.
        - profile:           Additional user profile data returned with the Apple ID Credentials.
-       - audience:          API Identifier that your application is requesting access to.   
+       - audience:          API Identifier that your application is requesting access to.
        - scope:             Space-separated list of requested scope values. Defaults to `openid profile email`.
      - Returns: A request that will yield Auth0 user's credentials.
 
@@ -542,7 +675,7 @@ public protocol Authentication: SenderConstraining, Trackable, Loggable, Sendabl
     /// - Returns: A request that will yield Auth0 user's credentials.
     ///
     /// ## See Also
-    /// 
+    ///
     /// - [Authentication API Endpoint](https://auth0.com/docs/native-passkeys-api#authenticate-new-user)
     /// - [Native Passkeys for Mobile Applications](https://auth0.com/docs/native-passkeys-for-mobile-applications)
     /// - [Supporting passkeys](https://developer.apple.com/documentation/authenticationservices/supporting-passkeys#Register-a-new-account-on-a-service)
@@ -1035,6 +1168,14 @@ public extension Authentication {
         return self.login(usernameOrEmail: username, password: password, realmOrConnection: realm, audience: audience, scope: scope)
     }
 
+    func login(withOOBCode oobCode: String, mfaToken: String, bindingCode: String? = nil) -> Request<Credentials, AuthenticationError> {
+        return self.login(withOOBCode: oobCode, mfaToken: mfaToken, bindingCode: bindingCode)
+    }
+
+    func multifactorChallenge(mfaToken: String, types: [String]? = nil, authenticatorId: String? = nil) -> Request<Challenge, AuthenticationError> {
+        return self.multifactorChallenge(mfaToken: mfaToken, types: types, authenticatorId: authenticatorId)
+    }
+
     func login(appleAuthorizationCode authorizationCode: String,
                fullName: PersonNameComponents? = nil,
                profile: [String: Any]? = nil,
diff --git a/Auth0/AuthenticationHandlers.swift b/Auth0/AuthenticationHandlers.swift
@@ -34,24 +34,6 @@ func authenticationObject<T: JSONObjectPayload>(from result: Result<ResponseValu
     }
 }
 
-func listAuthenticatorsResponseMapper(factorsAllowed: [String], result: Result<ResponseValue, AuthenticationError>, callback: Request<[Authenticator], AuthenticationError>.Callback) {
-    do {
-        let response = try result.get()
-        if let data = response.data {
-            let decoder = JSONDecoder()
-            let authenticators = try decoder.decode([Authenticator].self, from: data)
-            let filteredAuthenticators = authenticators.filter { authenticator in factorsAllowed.isEmpty || factorsAllowed.contains { $0 == authenticator.type } }
-            callback(.success(filteredAuthenticators))
-        } else {
-            callback(.failure(AuthenticationError(from: response)))
-        }
-    } catch let error as AuthenticationError {
-        callback(.failure(error))
-    } catch {
-        callback(.failure(AuthenticationError(cause: error)))
-    }
-}
-
 func authenticationDatabaseUser(from result: Result<ResponseValue, AuthenticationError>,
                                 callback: Request<DatabaseUser, AuthenticationError>.Callback) {
     do {
diff --git a/Auth0/Request.swift b/Auth0/Request.swift
@@ -27,6 +27,7 @@ public struct Request<T, E: Auth0APIError>: Requestable {
     let session: URLSession
     let url: URL
     let method: String
+    let requestValidator: [RequestValidator]
     let handle: (Result<ResponseValue, E>, Callback) -> Void
     let parameters: [String: Any]
     let headers: [String: String]
@@ -37,6 +38,7 @@ public struct Request<T, E: Auth0APIError>: Requestable {
     init(session: URLSession,
          url: URL,
          method: String,
+         requestValidator: [RequestValidator] = [],
          handle: @escaping (Result<ResponseValue, E>, Callback) -> Void,
          parameters: [String: Any] = [:],
          headers: [String: String] = [:],
@@ -47,6 +49,7 @@ public struct Request<T, E: Auth0APIError>: Requestable {
         self.url = url
         self.method = method
         self.handle = handle
+        self.requestValidator = requestValidator
         self.parameters = parameters
         self.logger = logger
         self.telemetry = telemetry
@@ -91,6 +94,13 @@ public struct Request<T, E: Auth0APIError>: Requestable {
 
     private func startDataTask(retryCount: Int, request: URLRequest, callback: @escaping Callback) {
         var request = request
+
+        do {
+            try runClientValidation()
+        } catch {
+            handle(.failure(E(cause: error)), callback)
+            return
+        }
         do {
             if let dpop = dpop, try dpop.shouldGenerateProof(for: url, parameters: parameters) {
                 let proof = try dpop.generateProof(for: request as URLRequest)
@@ -127,6 +137,12 @@ public struct Request<T, E: Auth0APIError>: Requestable {
         task.resume()
     }
 
+    func runClientValidation() throws {
+        for validator in requestValidator {
+            try validator.validate()
+        }
+    }
+
     // MARK: - Request Modifiers
 
     /**
@@ -168,6 +184,17 @@ public struct Request<T, E: Auth0APIError>: Requestable {
                        telemetry: self.telemetry,
                        dpop: self.dpop)
     }
+
+    public func requestValidators(_ extraValidators: [RequestValidator]) -> Self {
+        var requestValidator = extraValidators
+        requestValidator.append(contentsOf: self.requestValidator)
+        return Request(session: session,
+                       url: url,
+                       method: method,
+                       handle: handle,
+                       logger: logger,
+                       telemetry: telemetry)
+    }
 }
 
 // MARK: - Combine
diff --git a/Auth0/Response.swift b/Auth0/Response.swift
@@ -26,6 +26,7 @@ struct Response<E: Auth0APIError> {
             // Not using the custom initializer because data could be empty
             throw E(description: nil, statusCode: response.statusCode)
         }
+
         return ResponseValue(value: response, data: data)
     }
 

Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,7 @@ struct Response<E: Auth0APIError> {`
`26`	`26`	`// Not using the custom initializer because data could be empty`
`27`	`27`	`throw E(description: nil, statusCode: response.statusCode)`
`28`	`28`	`}`
	`29`	`+`
`29`	`30`	`return ResponseValue(value: response, data: data)`
`30`	`31`	`}`
`31`	`32`