From 3963b65f68da206766752f007f4cf3f873409fbf Mon Sep 17 00:00:00 2001
From: Torsten Dittmann <torsten.dittmann@googlemail.com>
Date: Sun, 25 Feb 2024 11:21:56 +0100
Subject: [PATCH] fix: mfa delete

---
 app/controllers/api/users.php | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/app/controllers/api/users.php b/app/controllers/api/users.php
index 987c146e0d..3edecc23c3 100644
--- a/app/controllers/api/users.php
+++ b/app/controllers/api/users.php
@@ -1599,30 +1599,20 @@ App::delete('/v1/users/:userId/mfa/:type')
     ->label('sdk.response.model', Response::MODEL_USER)
     ->param('userId', '', new UID(), 'User ID.')
     ->param('type', null, new WhiteList(['totp']), 'Type of authenticator.')
-    ->param('otp', '', new Text(256), 'Valid verification token.')
     ->inject('requestTimestamp')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $userId, string $type, string $otp, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $userId, string $type, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Event $queueForEvents) {
         $user = $dbForProject->getDocument('users', $userId);
 
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $success = match ($type) {
-            'totp' => Challenge\TOTP::verify($user, $otp),
-            default => false
-        };
-
-    if (!$success) {
-        throw new Exception(Exception::USER_INVALID_TOKEN);
-    }
-
-    if (!$user->getAttribute('totp')) {
-        throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP not added.');
-    }
+        if (!$user->getAttribute('totp')) {
+            throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP not added.');
+        }
 
         $user
             ->setAttribute('totp', false)