feat(DTOExtension): Erweiterungsmethode hinzugefügt, um totp direkt über Receiver zu prüfen

- IsValidTotp Erweiterung hinzugefügt, um die totp zu überprüfen.

EnvelopeGenerator.Application/Configurations/CodeGeneratorConfig.cs

@@ -1,7 +0,0 @@
-namespace EnvelopeGenerator.Application.Configurations
-{
-    public class CodeGeneratorConfig
-    {
-        public string CharPool { get; init; } = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890123456789012345678901234567890123456789";
-    }
-}

EnvelopeGenerator.Application/Configurations/CodeGeneratorParams.cs

@@ -0,0 +1,19 @@
+namespace EnvelopeGenerator.Application.Configurations
+{
+    public class CodeGeneratorParams
+    {
+        public string CharPool { get; init; } = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890123456789012345678901234567890123456789";
+
+        //TODO: Increase the DefaultTotpSecretKeyLength (e.g. to 32) but make sure that the QR code is generated correctly and can be scanned by the authenticator.
+        public int DefaultTotpSecretKeyLength { get; init; } = 20;
+
+        public string TotpIssuer { get; init; } = "signFlow";
+
+        /// <summary>
+        /// 0 is user email, 1 is secret key and 2 is issuer.
+        /// </summary>
+        public string TotpUrlFormat { get; init; } = "otpauth://totp/{0}?secret={1}&issuer={2}";
+
+        public int TotpQRPixelsPerModule { get; init; } = 20;
+    }
+}

EnvelopeGenerator.Application/Contracts/ICodeGenerator.cs

@@ -3,5 +3,11 @@
     public interface ICodeGenerator
     {
         string GenerateCode(int length);
+
+        public string GenerateTotpSecretKey(int? length = null);
+
+        public byte[] GenerateTotpQrCode(string userEmail, string secretKey, string? issuer = null, string? totpUrlFormat = null, int? pixelsPerModule = null);
+
+        public byte[] GenerateTotpQrCode(string userEmail, int? length = null, string? issuer = null, string? totpUrlFormat = null, int? pixelsPerModule = null);
     }
 }

EnvelopeGenerator.Application/Contracts/IEnvelopeMailService.cs

@@ -8,10 +8,12 @@ namespace EnvelopeGenerator.Application.Contracts
 {
     public interface IEnvelopeMailService : IEmailOutService
     {
-        Task<DataResult<int>> SendAsync(EnvelopeReceiverDto envelopeReceiverDto, Constants.EmailTemplateType tempType);
+        Task<DataResult<int>> SendAsync(EnvelopeReceiverDto envelopeReceiverDto, Constants.EmailTemplateType tempType, Dictionary<string, object>? optionalPlaceholders = null);
 
-        Task<DataResult<int>> SendAsync(EnvelopeReceiverReadOnlyDto dto);
+        Task<DataResult<int>> SendAsync(EnvelopeReceiverReadOnlyDto dto, Dictionary<string, object>? optionalPlaceholders = null);
 
         Task<DataResult<int>> SendAccessCodeAsync(EnvelopeReceiverDto envelopeReceiverDto);
+
+        Task<DataResult<int>> SendTFAQrCodeAsync(EnvelopeReceiverDto envelopeReceiverDto);
     }
 }

EnvelopeGenerator.Application/Contracts/IEnvelopeReceiverService.cs

@@ -9,17 +9,17 @@ namespace EnvelopeGenerator.Application.Contracts
     public interface IEnvelopeReceiverService : IBasicCRUDService<EnvelopeReceiverDto, EnvelopeReceiver, (int Envelope, int Receiver)>
     {
 
-        Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false);
+        Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false, bool readOnly = true);
 
         Task<DataResult<IEnumerable<string?>>> ReadAccessCodeByUuidAsync(string uuid, bool withEnvelope = false, bool withReceiver = true);
 
-        Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true);
+        Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true, bool readOnly = true);
 
-        Task<DataResult<EnvelopeReceiverDto>> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true);
+        Task<DataResult<EnvelopeReceiverDto>> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true);
 
-        Task<DataResult<EnvelopeReceiverSecretDto>> ReadWithSecretByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true);
+        Task<DataResult<EnvelopeReceiverSecretDto>> ReadWithSecretByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true);
 
-        Task<DataResult<EnvelopeReceiverDto>> ReadByEnvelopeReceiverIdAsync(string envelopeReceiverId, bool withEnvelope = true, bool withReceiver = true);
+        Task<DataResult<EnvelopeReceiverDto>> ReadByEnvelopeReceiverIdAsync(string envelopeReceiverId, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true);
 
         Task<DataResult<string>> ReadAccessCodeByIdAsync(int envelopeId, int receiverId);
         

EnvelopeGenerator.Application/Contracts/IReceiverService.cs

@@ -1,4 +1,5 @@
-using DigitalData.Core.Abstractions.Application;
+using DigitalData.Core.Abstractions;
+using DigitalData.Core.Abstractions.Application;
 using DigitalData.Core.DTO;
 using EnvelopeGenerator.Application.DTOs.Receiver;
 using EnvelopeGenerator.Domain.Entities;
@@ -7,8 +8,10 @@ namespace EnvelopeGenerator.Application.Contracts
 {
     public interface IReceiverService : ICRUDService<ReceiverCreateDto, ReceiverReadDto, ReceiverUpdateDto, Receiver, int>
     {
-        public Task<DataResult<ReceiverReadDto>> ReadByAsync(string? emailAddress = null, string? signature = null);
+        Task<DataResult<ReceiverReadDto>> ReadByAsync(string? emailAddress = null, string? signature = null);
 
-        public Task<Result> DeleteByAsync(string? emailAddress = null, string? signature = null);
+        Task<Result> DeleteByAsync(string? emailAddress = null, string? signature = null);
+
+        Task<Result> UpdateAsync<TUpdateDto>(TUpdateDto updateDto) where TUpdateDto : IUnique<int>;
     }
 }

EnvelopeGenerator.Application/DTOs/EnvelopeReceiver/EnvelopeReceiverBasicDto.cs

@@ -27,5 +27,7 @@ namespace EnvelopeGenerator.Application.DTOs.EnvelopeReceiver
         public DateTime? ChangedWhen { get; init; }
 
         public bool HasPhoneNumber { get; init; }
+
+        public bool TFAEnabled { get; init; }
     }
 }

EnvelopeGenerator.Application/DTOs/Receiver/ReceiverCreateDto.cs

@@ -4,7 +4,7 @@ using System.Text;
 
 namespace EnvelopeGenerator.Application.DTOs.Receiver
 {
-    public record ReceiverCreateDto([EmailAddress] string EmailAddress)
+    public record ReceiverCreateDto([EmailAddress] string EmailAddress, string? TotpSecretkey = null, DateTime? TotpExpiration = null)
     {
         public string Signature => sha256HexOfMail.Value;
 

EnvelopeGenerator.Application/DTOs/Receiver/ReceiverReadDto.cs

@@ -1,4 +1,6 @@
-using DigitalData.Core.DTO;
+using DigitalData.Core.Abstractions;
+using DigitalData.Core.DTO;
+using DigitalData.EmailProfilerDispatcher.Abstraction.Attributes;
 using EnvelopeGenerator.Application.DTOs.EnvelopeReceiver;
 using System.Text.Json.Serialization;
 
@@ -8,12 +10,17 @@ namespace EnvelopeGenerator.Application.DTOs.Receiver
         int Id,
         string EmailAddress,
         string Signature,
-        DateTime AddedWhen       
-        ) : BaseDTO<int>(Id)
+        DateTime AddedWhen
+        ) : BaseDTO<int>(Id), IUnique<int>
     {
         [JsonIgnore]
         public IEnumerable<EnvelopeReceiverBasicDto>? EnvelopeReceivers { get; init; }
 
         public string? LastUsedName => EnvelopeReceivers?.LastOrDefault()?.Name;
+
+        public string? TotpSecretkey { get; set; } = null;
+
+        [TemplatePlaceholder("[TFA_QR_EXPIRATION]")]
+        public DateTime? TotpExpiration { get; set; } = null;
     };
 }

EnvelopeGenerator.Application/DTOs/Receiver/ReceiverUpdateDto.cs

@@ -2,5 +2,5 @@
 
 namespace EnvelopeGenerator.Application.DTOs.Receiver
 {
-    public record ReceiverUpdateDto(int Id) : IUnique<int>;
-}
+    public record ReceiverUpdateDto(int Id, string? TotpSecretkey = null, DateTime? TotpExpiration = null) : IUnique<int>;
+} 

EnvelopeGenerator.Application/EnvelopeGenerator.Application.csproj

@@ -18,6 +18,8 @@
     <PackageReference Include="DigitalData.Core.DTO" Version="2.0.0" />
     <PackageReference Include="DigitalData.EmailProfilerDispatcher" Version="2.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="7.0.18" />
+    <PackageReference Include="QRCoder" Version="1.6.0" />
+    <PackageReference Include="QRCoder-ImageSharp" Version="0.10.0" />
     <PackageReference Include="UserManager.Application" Version="2.0.0" />
     <PackageReference Include="UserManager.Infrastructure" Version="2.0.0" />
   </ItemGroup>

EnvelopeGenerator.Application/Extensions/CacheExtensions.cs

@@ -1,11 +1,4 @@
 using Microsoft.Extensions.Caching.Distributed;
-using Microsoft.Extensions.Options;
-using Newtonsoft.Json.Linq;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Threading.Tasks;
 
 namespace EnvelopeGenerator.Application.Extensions
 {
@@ -39,5 +32,51 @@ namespace EnvelopeGenerator.Application.Extensions
             var value = await cache.GetAsync(key);
             return value is null ? null : new(BitConverter.ToInt64(value, 0));
         }
+
+        public static string GetOrSet(this IDistributedCache cache, string key, Func<string> factory, DistributedCacheEntryOptions? options = null, bool cacheInBackground = false, CancellationToken token = default)
+        {
+            var value = cache.GetString(key);
+            if (value is null)
+            {
+                // create new and save
+                value = factory();
+
+                void Cache()
+                {
+                    if (options is null)
+                        cache.SetString(key: key, value: value);
+                    else
+                        cache.SetString(key: key, value: value, options: options);
+                }
+
+                if (cacheInBackground)
+                    _ = Task.Run(() => Cache(), token);
+                else
+                    Cache();
+            }
+
+            return value;
+        }
+
+        public static async Task<string> GetOrSetAsync(this IDistributedCache cache, string key, Func<Task<string>> factory, DistributedCacheEntryOptions? options = null, bool cacheInBackground = false, CancellationToken token = default)
+        {
+            var value = await cache.GetStringAsync(key, token: token);
+            if(value is null)
+            {
+                // create new and save
+                value = await factory();
+
+                Task CacheAsync() => options is null
+                    ? cache.SetStringAsync(key: key, value: value, token: token)
+                    : cache.SetStringAsync(key: key, value: value, options: options, token: token);
+
+                if (cacheInBackground)
+                    _ = Task.Run(async () => await CacheAsync(), token);
+                else
+                    await CacheAsync();
+            }
+
+            return value;
+        }
     }
 }

EnvelopeGenerator.Application/Extensions/DIExtensions.cs

@@ -10,6 +10,7 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using DigitalData.Core.Client;
 using EnvelopeGenerator.Application.Configurations.GtxMessaging;
+using QRCoder;
 
 namespace EnvelopeGenerator.Application.Extensions
 {
@@ -55,13 +56,14 @@ namespace EnvelopeGenerator.Application.Extensions
 
             services.Configure<DispatcherConfig>(dispatcherConfigSection);
             services.Configure<MailConfig>(mailConfigSection);
-            services.Configure<CodeGeneratorConfig>(codeGeneratorConfigSection);
+            services.Configure<CodeGeneratorParams>(codeGeneratorConfigSection);
             services.Configure<EnvelopeReceiverCacheParams>(envelopeReceiverCacheParamsSection);
 
             services.AddHttpClientService<SmsParams>(smsConfigSection);
             services.TryAddSingleton<IMessagingService, GtxMessagingService>();
             services.TryAddSingleton<ICodeGenerator, CodeGenerator>();
             services.TryAddSingleton<IEnvelopeReceiverCache, EnvelopeReceiverCache>();
+            services.TryAddSingleton<QRCodeGenerator>();
 
             return services;
         }
@@ -70,7 +72,7 @@ namespace EnvelopeGenerator.Application.Extensions
             dispatcherConfigSection: config.GetSection("DispatcherConfig"),
             mailConfigSection: config.GetSection("MailConfig"),
             smsConfigSection: config.GetSection("SmsConfig"),
-            codeGeneratorConfigSection: config.GetSection("CodeGeneratorConfig"),
+            codeGeneratorConfigSection: config.GetSection("CodeGeneratorParams"),
             envelopeReceiverCacheParamsSection: config.GetSection("EnvelopeReceiverCacheParams"));
     }
 }

EnvelopeGenerator.Application/Extensions/DTOExtensions.cs

@@ -0,0 +1,22 @@
+using EnvelopeGenerator.Application.DTOs.Receiver;
+using EnvelopeGenerator.Extensions;
+using Newtonsoft.Json;
+
+namespace EnvelopeGenerator.Application.Extensions
+{
+    public static class DTOExtensions
+    {
+        public static bool IsTotpSecretExpired(this ReceiverReadDto dto, int minutesBeforeExpiration = 30)
+            => dto.TotpExpiration < DateTime.Now.AddMinutes(minutesBeforeExpiration * -1);
+
+        public static bool IsTotpSecretInvalid(this ReceiverReadDto dto, int minutesBeforeExpiration = 30)
+            => dto.IsTotpSecretExpired(minutesBeforeExpiration) || dto.TotpSecretkey is null;
+
+        public static bool IsTotpSecretValid(this ReceiverReadDto dto, int minutesBeforeExpiration = 30)
+            => !dto.IsTotpSecretInvalid(minutesBeforeExpiration);
+
+        public static bool IsTotpValid(this ReceiverReadDto dto, string totp) => dto.TotpSecretkey is null ? throw new ArgumentNullException(nameof(dto), $"TotpSecretkey of DTO cannot validate without TotpSecretkey. Dto: {JsonConvert.SerializeObject(dto)}") : totp.IsValidTotp(dto.TotpSecretkey);
+
+        public static bool IsTotpInvalid(this ReceiverReadDto dto, string totp) => !dto.IsTotpValid(totp: totp);
+    }
+}

EnvelopeGenerator.Application/Extensions/MappingExtensions.cs

@@ -1,5 +1,4 @@
-using EnvelopeGenerator.Application.DTOs.EnvelopeReceiver;
-using EnvelopeGenerator.Domain.HttpResponse;
+using EnvelopeGenerator.Domain.HttpResponse;
 
 namespace EnvelopeGenerator.Application.Extensions
 {
@@ -8,5 +7,8 @@ namespace EnvelopeGenerator.Application.Extensions
         public static bool Ok(this GtxMessagingResponse gtxMessagingResponse)
             => gtxMessagingResponse.TryGetValue("message-status", out var status)
             && status?.ToString()?.ToLower() == "ok";
+
+        public static string ToBase64String(this byte[] bytes)
+            => Convert.ToBase64String(bytes);
     }
 }

EnvelopeGenerator.Application/MappingProfiles/BasicDtoMappingProfile.cs

@@ -46,7 +46,7 @@ namespace EnvelopeGenerator.Application.MappingProfiles
             CreateMap<EnvelopeHistoryCreateDto, EnvelopeHistory>();
             CreateMap<EnvelopeReceiverDto, EnvelopeReceiver>();
             CreateMap<EnvelopeTypeDto, EnvelopeType>();
-            CreateMap<ReceiverReadDto, Receiver>();
+            CreateMap<ReceiverReadDto, Receiver>().ForMember(rcv => rcv.EnvelopeReceivers, rcvReadDto => rcvReadDto.Ignore());
             CreateMap<ReceiverCreateDto, Receiver>();
             CreateMap<ReceiverUpdateDto, Receiver>();
             CreateMap<UserReceiverDto, UserReceiver>();

EnvelopeGenerator.Application/Resources/Resource.de-DE.resx

@@ -159,41 +159,56 @@
   <data name="HomePageDescription" xml:space="preserve">
     <value>Das digitale Unterschriftenportal ist eine Plattform, die entwickelt wurde, um Ihre Dokumente sicher zu unterschreiben und zu verwalten. Mit seiner benutzerfreundlichen Oberfläche können Sie Ihre Dokumente schnell hochladen, die Unterschriftsprozesse verfolgen und Ihre digitalen Unterschriftenanwendungen einfach durchführen. Dieses Portal beschleunigt Ihren Arbeitsablauf mit rechtlich gültigen Unterschriften und erhöht gleichzeitig die Sicherheit Ihrer Dokumente.</value>
   </data>
-  <data name="LocakedOpen" xml:space="preserve">
-    <value>Öffnen</value>
-  </data>
   <data name="LocationWarning" xml:space="preserve">
     <value>Bitte überprüfen Sie die Standortinformationen. Wenn sie falsch sind, korrigieren Sie diese bitte.</value>
   </data>
-  <data name="LockedAccessCode" xml:space="preserve">
-    <value>Zugriffscode</value>
-  </data>
-  <data name="LockedBody" xml:space="preserve">
+  <data name="LockedBodyAccess" xml:space="preserve">
     <value>Wir haben Ihnen gerade den Zugriffscode an die hinterlegte Email Adresse gesendet. Dies kann evtl. einige Minuten dauern.</value>
   </data>
-  <data name="LockedFooterBody" xml:space="preserve">
-    <value>Bitte überprüfen Sie Ihr Email Postfach inklusive Spam-Ordner. Sie können auch den Absender bitten, Ihnen den Code auf anderem Wege zukommen zu lassen.</value>
+  <data name="LockedBodyAuthenticator" xml:space="preserve">
+    <value>Ihr QR-Code ist bis {0} gültig.</value>
   </data>
-  <data name="LockedFooterTitle" xml:space="preserve">
-    <value>Sie haben keinen Zugriffscode erhalten?</value>
+  <data name="LockedBodyAuthenticatorNew" xml:space="preserve">
+    <value>Wir haben den QR-Code an Ihre E-Mail-Adresse gesendet. Ihr QR-Code ist bis {0} gültig. Sie können ihn für alle Umschläge verwenden, die Sie an diese E-Mail-Adresse erhalten.</value>
   </data>
-  <data name="LockedSmsAccessCode" xml:space="preserve">
-    <value>SMS-Code</value>
-  </data>
-  <data name="LockedSmsTfaBody" xml:space="preserve">
+  <data name="LockedBodySms" xml:space="preserve">
     <value>Wir haben soeben den Zugangscode als SMS an die von Ihnen angegebene Telefonnummer gesendet.</value>
   </data>
-  <data name="LockedSmsTfaFooterBody" xml:space="preserve">
+  <data name="LockedCodeLabelAccess" xml:space="preserve">
+    <value>Zugriffscode</value>
+  </data>
+  <data name="LockedCodeLabelAuthenticator" xml:space="preserve">
+    <value>TOTP</value>
+  </data>
+  <data name="LockedCodeLabelSms" xml:space="preserve">
+    <value>SMS-Code</value>
+  </data>
+  <data name="LockedFooterBodyAccess" xml:space="preserve">
+    <value>Bitte überprüfen Sie Ihr Email Postfach inklusive Spam-Ordner. Sie können auch den Absender bitten, Ihnen den Code auf anderem Wege zukommen zu lassen.</value>
+  </data>
+  <data name="LockedFooterBodyAuthenticator" xml:space="preserve">
+    <value>Der neue QR-Code wird nur einmal für einen bestimmten Zeitraum gesendet und nach dem Scannen in Ihrer Authenticator-App gespeichert. Er kann für alle Umschläge verwendet werden, die an dieselbe E-Mail-Adresse gesendet werden, bis er abläuft. Wenn Sie die QR-Code-Mail nicht erhalten oder sie sowohl aus der Mail als auch aus authenticator löschen, kontaktieren Sie bitte den Absender.</value>
+  </data>
+  <data name="LockedFooterBodySms" xml:space="preserve">
     <value>Sie können den Absender bitten, Ihre Rufnummer zu überprüfen. Die Telefonnummer muss mit der Ortsvorwahl eingegeben werden. Andernfalls können Sie beantragen, den Zwei-Faktor-Schutz zu entfernen.</value>
   </data>
-  <data name="LockedSmsTfaFooterTitle" xml:space="preserve">
+  <data name="LockedFooterTitleAccess" xml:space="preserve">
+    <value>Sie haben keinen Zugriffscode erhalten?</value>
+  </data>
+  <data name="LockedFooterTitleAuthenticator" xml:space="preserve">
+    <value>Sie haben keinen QR-Code erhalten?</value>
+  </data>
+  <data name="LockedFooterTitleSms" xml:space="preserve">
     <value>Sie haben keine SMS erhalten?</value>
   </data>
-  <data name="LockedSmsTfaTitle" xml:space="preserve">
+  <data name="LockedTitleAccess" xml:space="preserve">
+    <value>Dokument erfordert einen Zugriffscode</value>
+  </data>
+  <data name="LockedTitleAuthenticator" xml:space="preserve">
     <value>2-Faktor-Authentifizierung</value>
   </data>
-  <data name="LockedTitle" xml:space="preserve">
-    <value>Dokument erfordert einen Zugriffscode</value>
+  <data name="LockedTitleSms" xml:space="preserve">
+    <value>2-Faktor-Authentifizierung</value>
   </data>
   <data name="Privacy" xml:space="preserve">
     <value>Datenschutz</value>

EnvelopeGenerator.Application/Resources/Resource.en-US.resx

@@ -159,41 +159,56 @@
   <data name="HomePageDescription" xml:space="preserve">
     <value>The Digital Signature Portal is a platform developed for securely signing and managing your documents. With its user-friendly interface, you can quickly upload your documents, track the signing processes, and easily carry out your digital signature applications. This portal accelerates your workflow with legally valid signatures while enhancing the security of your documents.</value>
   </data>
-  <data name="LocakedOpen" xml:space="preserve">
-    <value>Open</value>
-  </data>
   <data name="LocationWarning" xml:space="preserve">
     <value>Please review the location information. If it is incorrect, kindly make the necessary corrections.</value>
   </data>
-  <data name="LockedAccessCode" xml:space="preserve">
-    <value>Access Code</value>
-  </data>
-  <data name="LockedBody" xml:space="preserve">
+  <data name="LockedBodyAccess" xml:space="preserve">
     <value>We have just sent you the access code to the email address you provided. This may take a few minutes.</value>
   </data>
-  <data name="LockedFooterBody" xml:space="preserve">
-    <value>Please check your email inbox including your spam folder. Furthermore, you can also ask the sender to send the code by other means.</value>
+  <data name="LockedBodyAuthenticator" xml:space="preserve">
+    <value>Your QR code is valid until {0}.</value>
   </data>
-  <data name="LockedFooterTitle" xml:space="preserve">
-    <value>You have not received an access code?</value>
+  <data name="LockedBodyAuthenticatorNew" xml:space="preserve">
+    <value>We have sent the QR code to your e-mail address. Your QR code is valid until {0}. You can use it for all envelopes received at this email address.</value>
   </data>
-  <data name="LockedSmsAccessCode" xml:space="preserve">
-    <value>SMS Code</value>
-  </data>
-  <data name="LockedSmsTfaBody" xml:space="preserve">
+  <data name="LockedBodySms" xml:space="preserve">
     <value>We have just sent the access code as an SMS to the phone number you provided.</value>
   </data>
-  <data name="LockedSmsTfaFooterBody" xml:space="preserve">
+  <data name="LockedCodeLabelAccess" xml:space="preserve">
+    <value>Access Code</value>
+  </data>
+  <data name="LockedCodeLabelAuthenticator" xml:space="preserve">
+    <value>TOTP</value>
+  </data>
+  <data name="LockedCodeLabelSms" xml:space="preserve">
+    <value>SMS Code</value>
+  </data>
+  <data name="LockedFooterBodyAccess" xml:space="preserve">
+    <value>Please check your email inbox including your spam folder. Furthermore, you can also ask the sender to send the code by other means.</value>
+  </data>
+  <data name="LockedFooterBodyAuthenticator" xml:space="preserve">
+    <value>The new QR code is sent only once for a given period and is saved in your authenticator app once scanned. It can be used for all envelopes received at the same email address until it expires. If you do not receive the QR code mail or delete it both from the mail and from authenticator, please contact the sender.</value>
+  </data>
+  <data name="LockedFooterBodySms" xml:space="preserve">
     <value>You can ask the sender to check your phone number. The phone number must be entered with the area code. Otherwise you can request to remove the two-factor protection.</value>
   </data>
-  <data name="LockedSmsTfaFooterTitle" xml:space="preserve">
+  <data name="LockedFooterTitleAccess" xml:space="preserve">
+    <value>You have not received an access code?</value>
+  </data>
+  <data name="LockedFooterTitleAuthenticator" xml:space="preserve">
+    <value>You have not received a QR code?</value>
+  </data>
+  <data name="LockedFooterTitleSms" xml:space="preserve">
     <value>You have not received an SMS?</value>
   </data>
-  <data name="LockedSmsTfaTitle" xml:space="preserve">
+  <data name="LockedTitleAccess" xml:space="preserve">
+    <value>Document requires an access code</value>
+  </data>
+  <data name="LockedTitleAuthenticator" xml:space="preserve">
     <value>2-Factor Authentication</value>
   </data>
-  <data name="LockedTitle" xml:space="preserve">
-    <value>Document requires an access code</value>
+  <data name="LockedTitleSms" xml:space="preserve">
+    <value>2-Factor Authentication</value>
   </data>
   <data name="Privacy" xml:space="preserve">
     <value>Privacy</value>

EnvelopeGenerator.Application/Services/CodeGenerator.cs

@@ -1,21 +1,26 @@
 using EnvelopeGenerator.Application.Configurations;
 using EnvelopeGenerator.Application.Contracts;
 using Microsoft.Extensions.Options;
+using OtpNet;
+using QRCoder;
 using System.Text;
 
 namespace EnvelopeGenerator.Application.Services
 {
     public class CodeGenerator : ICodeGenerator
     {
-        public static Lazy<CodeGenerator> LazyStatic => new(() => new CodeGenerator(Options.Create<CodeGeneratorConfig>(new())));
+        public static Lazy<CodeGenerator> LazyStatic => new(() => new CodeGenerator(Options.Create<CodeGeneratorParams>(new()), new QRCodeGenerator()));
 
         public static CodeGenerator Static => LazyStatic.Value;
 
-        private readonly string _charPool;
+        private readonly CodeGeneratorParams _params;
 
-        public CodeGenerator(IOptions<CodeGeneratorConfig> options)
+        private readonly QRCodeGenerator _qrCodeGenerator;
+
+        public CodeGenerator(IOptions<CodeGeneratorParams> options, QRCodeGenerator qrCodeGenerator)
         {
-            _charPool = options.Value.CharPool;
+            _params = options.Value;
+            _qrCodeGenerator = qrCodeGenerator;
         }
 
         public string GenerateCode(int length)
@@ -29,9 +34,33 @@ namespace EnvelopeGenerator.Application.Services
             var passwordBuilder = new StringBuilder(length);
 
             for (int i = 0; i < length; i++)
-                passwordBuilder.Append(_charPool[random.Next(_charPool.Length)]);
+                passwordBuilder.Append(_params.CharPool[random.Next(_params.CharPool.Length)]);
 
             return passwordBuilder.ToString();
         }
+
+        public string GenerateTotpSecretKey(int? length = null)
+            => Base32Encoding.ToString(KeyGeneration.GenerateRandomKey(length ?? _params.DefaultTotpSecretKeyLength));
+
+        public byte[] GenerateTotpQrCode(string userEmail, string secretKey, string? issuer = null, string? totpUrlFormat = null, int? pixelsPerModule = null)
+        {
+            var url = string.Format(totpUrlFormat ?? _params.TotpUrlFormat,
+                Uri.EscapeDataString(userEmail),
+                Uri.EscapeDataString(secretKey),
+                Uri.EscapeDataString(issuer ?? _params.TotpIssuer));
+            using var qrCodeData = _qrCodeGenerator.CreateQrCode(url, QRCodeGenerator.ECCLevel.Q);
+            using var qrCode = new BitmapByteQRCode(qrCodeData);
+            return qrCode.GetGraphic(pixelsPerModule ?? _params.TotpQRPixelsPerModule);
+        }
+
+        public byte[] GenerateTotpQrCode(string userEmail, int? length = null, string? issuer = null, string? totpUrlFormat = null, int? pixelsPerModule = null)
+        {
+            return GenerateTotpQrCode(
+                userEmail: userEmail,
+                secretKey: GenerateTotpSecretKey(length: length),
+                issuer: issuer,
+                totpUrlFormat: totpUrlFormat,
+                pixelsPerModule: pixelsPerModule);
+        }
     }
 }

EnvelopeGenerator.Application/Services/EnvelopeMailService.cs

@@ -12,6 +12,8 @@ using static EnvelopeGenerator.Common.Constants;
 using EnvelopeGenerator.Extensions;
 using EnvelopeGenerator.Application.DTOs.EnvelopeReceiverReadOnly;
 using EnvelopeGenerator.Application.Configurations;
+using EnvelopeGenerator.Application.Extensions;
+using Newtonsoft.Json;
 
 namespace EnvelopeGenerator.Application.Services
 {
@@ -22,17 +24,19 @@ namespace EnvelopeGenerator.Application.Services
 		private readonly DispatcherConfig _dConfig;
 		private readonly IConfigService _configService;
 		private readonly Dictionary<string, string> _placeholders;
+		private readonly ICodeGenerator _codeGenerator;
 
-		public EnvelopeMailService(IEmailOutRepository repository, IMapper mapper, IEmailTemplateService tempService, IEnvelopeReceiverService envelopeReceiverService, IOptions<DispatcherConfig> dispatcherConfigOptions, IConfigService configService, IOptions<MailConfig> mailConfig) : base(repository, mapper)
+        public EnvelopeMailService(IEmailOutRepository repository, IMapper mapper, IEmailTemplateService tempService, IEnvelopeReceiverService envelopeReceiverService, IOptions<DispatcherConfig> dispatcherConfigOptions, IConfigService configService, IOptions<MailConfig> mailConfig, ICodeGenerator codeGenerator) : base(repository, mapper)
         {
             _tempService = tempService;
 			_envRcvService = envelopeReceiverService;
 			_dConfig = dispatcherConfigOptions.Value;
 			_configService = configService;
 			_placeholders = mailConfig.Value.Placeholders;
+			_codeGenerator = codeGenerator;
         }
 
-		private async Task<Dictionary<string, string>> CreatePlaceholders(string? accessCode = null, EnvelopeReceiverDto? envelopeReceiverDto = null, EnvelopeReceiverReadOnlyDto? readOnlyDto = null)
+		private async Task<Dictionary<string, string>> CreatePlaceholders(string? accessCode = null, EnvelopeReceiverDto? envelopeReceiverDto = null)
 		{
 			if (accessCode is not null)
                 _placeholders["[DOCUMENT_ACCESS_CODE]"] = accessCode;
@@ -63,10 +67,8 @@ namespace EnvelopeGenerator.Application.Services
 
             return _placeholders;
         }
-
-        public async Task<DataResult<int>> SendAccessCodeAsync(EnvelopeReceiverDto dto) => await SendAsync(dto: dto, tempType: Constants.EmailTemplateType.DocumentAccessCodeReceived);
-
-        public async Task<DataResult<int>> SendAsync(EnvelopeReceiverDto dto, Constants.EmailTemplateType tempType)
+		
+        public async Task<DataResult<int>> SendAsync(EnvelopeReceiverDto dto, EmailTemplateType tempType, Dictionary<string, object>? optionalPlaceholders = null)
         {
 			var tempSerResult = await _tempService.ReadByNameAsync(tempType);
 			if (tempSerResult.IsFailed)
@@ -104,14 +106,19 @@ namespace EnvelopeGenerator.Application.Services
 			
 			var placeholders = await CreatePlaceholders(accessCode: accessCode, envelopeReceiverDto: dto);
 
+			// Add optional place holders.
+			if (optionalPlaceholders is not null)
+				foreach (var oph in optionalPlaceholders)
+					placeholders[oph.Key] = oph.Value.ToString() ?? "NULL";
+
 			//TODO: remove the requirement to add the models using reflections
 			return await CreateWithTemplateAsync(createDto: mail,placeholders: placeholders,
 				dto, dto.Envelope.User!, dto.Envelope);
 		}
 
-		public async Task<DataResult<int>> SendAsync(EnvelopeReceiverReadOnlyDto dto)
+		public async Task<DataResult<int>> SendAsync(EnvelopeReceiverReadOnlyDto dto, Dictionary<string, object>? optionalPlaceholders = null)
 		{
-            var tempSerResult = await _tempService.ReadByNameAsync(Constants.EmailTemplateType.DocumentShared);
+            var tempSerResult = await _tempService.ReadByNameAsync(EmailTemplateType.DocumentShared);
             if (tempSerResult.IsFailed)
                 return tempSerResult.ToFail<int>().Notice(LogLevel.Error, Flag.DataIntegrityIssue, $"The email cannot send because '{Constants.EmailTemplateType.DocumentShared}' template cannot found.");
             var temp = tempSerResult.Data;
@@ -140,7 +147,32 @@ namespace EnvelopeGenerator.Application.Services
 
             var placeholders = await CreatePlaceholders(readOnlyDto: dto);
 
+            // Add optional place holders.
+            if (optionalPlaceholders is not null)
+                foreach (var oph in optionalPlaceholders)
+                placeholders[oph.Key] = oph.Value.ToString() ?? "NULL";
+
             return await CreateWithTemplateAsync(createDto: mail, placeholders: placeholders, dto.Envelope);
         }
+
+        public async Task<DataResult<int>> SendAccessCodeAsync(EnvelopeReceiverDto dto) => await SendAsync(dto: dto, tempType: EmailTemplateType.DocumentAccessCodeReceived);
+
+        public Task<DataResult<int>> SendTFAQrCodeAsync(EnvelopeReceiverDto dto)
+        {
+            // Check if receiver or secret key is null
+            if (dto.Receiver is null)
+                throw new ArgumentNullException(nameof(dto), $"TFA Qr Code cannot sent. Receiver information is missing. Envelope receiver dto is {JsonConvert.SerializeObject(dto)}");
+            if (dto.Receiver.TotpSecretkey is null)
+                throw new ArgumentNullException(nameof(dto), $"TFA Qr Code cannot sent. Receiver.TotpSecretKey is null. Envelope receiver dto is {JsonConvert.SerializeObject(dto)}");
+            if (dto.Receiver.TotpExpiration is null)
+                throw new ArgumentNullException(nameof(dto), $"TFA Qr Code cannot sent. Receiver.TotpExpiration is null. Envelope receiver dto is {JsonConvert.SerializeObject(dto)}");
+
+            var totp_qr_64 = _codeGenerator.GenerateTotpQrCode(userEmail: dto.Receiver.EmailAddress, secretKey: dto.Receiver.TotpSecretkey).ToBase64String();
+            return SendAsync(dto, EmailTemplateType.TotpSecret, new()
+			{
+				{"[TFA_QR_CODE]", totp_qr_64 },
+				{"[TFA_EXPIRATION]", dto.Receiver.TotpExpiration }
+			});
+        }
     }
 }

EnvelopeGenerator.Application/Services/EnvelopeReceiverService.cs

@@ -26,15 +26,15 @@ namespace EnvelopeGenerator.Application.Services
             _messagingService = messagingService;
         }
 
-        public async Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true)
+        public async Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true, bool readOnly = true)
         {
-            var env_rcvs = await _repository.ReadBySignatureAsync(signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver);
+            var env_rcvs = await _repository.ReadBySignatureAsync(signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly);
             return Result.Success(_mapper.Map<IEnumerable<EnvelopeReceiverDto>>(env_rcvs));
         }
 
-        public async Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false)
+        public async Task<DataResult<IEnumerable<EnvelopeReceiverDto>>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false, bool readOnly = true)
         {
-            var env_rcvs = await _repository.ReadByUuidAsync(uuid: uuid, withEnvelope: withEnvelope, withReceiver: withReceiver);
+            var env_rcvs = await _repository.ReadByUuidAsync(uuid: uuid, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly);
             return Result.Success(_mapper.Map<IEnumerable<EnvelopeReceiverDto>>(env_rcvs));
         }
 
@@ -44,9 +44,9 @@ namespace EnvelopeGenerator.Application.Services
             return Result.Success(env_rcvs.Select(er => er.AccessCode));
         }
 
-        public async Task<DataResult<EnvelopeReceiverDto>> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true)
+        public async Task<DataResult<EnvelopeReceiverDto>> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true)
         {
-            var env_rcv = await _repository.ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver);
+            var env_rcv = await _repository.ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly);
             if (env_rcv is null)
                 return Result.Fail<EnvelopeReceiverDto>()
                     .Message(Key.EnvelopeReceiverNotFound);
@@ -54,9 +54,9 @@ namespace EnvelopeGenerator.Application.Services
             return Result.Success(_mapper.Map<EnvelopeReceiverDto>(env_rcv));
         }
 
-        public async Task<DataResult<EnvelopeReceiverSecretDto>> ReadWithSecretByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true)
+        public async Task<DataResult<EnvelopeReceiverSecretDto>> ReadWithSecretByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true)
         {
-            var env_rcv = await _repository.ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver);
+            var env_rcv = await _repository.ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly);
             if (env_rcv is null)
                 return Result.Fail<EnvelopeReceiverSecretDto>()
                     .Message(Key.EnvelopeReceiverNotFound);
@@ -64,7 +64,7 @@ namespace EnvelopeGenerator.Application.Services
             return Result.Success(_mapper.Map<EnvelopeReceiverSecretDto>(env_rcv));
         }
 
-        public async Task<DataResult<EnvelopeReceiverDto>> ReadByEnvelopeReceiverIdAsync(string envelopeReceiverId, bool withEnvelope = true, bool withReceiver = true)
+        public async Task<DataResult<EnvelopeReceiverDto>> ReadByEnvelopeReceiverIdAsync(string envelopeReceiverId, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true)
         {
             (string? uuid, string? signature)  = envelopeReceiverId.DecodeEnvelopeReceiverId();
 
@@ -75,7 +75,7 @@ namespace EnvelopeGenerator.Application.Services
                     .Notice(LogLevel.Warning, EnvelopeFlag.WrongEnvelopeReceiverId)
                     .Notice(LogLevel.Warning, Flag.PossibleSecurityBreach);
 
-            return await ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver);
+            return await ReadByUuidSignatureAsync(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly);
         }
 
         public async Task<DataResult<bool>> VerifyAccessCodeAsync(string uuid, string signature, string accessCode)

EnvelopeGenerator.Application/Services/ReceiverService.cs

@@ -5,6 +5,8 @@ using EnvelopeGenerator.Domain.Entities;
 using EnvelopeGenerator.Infrastructure.Contracts;
 using EnvelopeGenerator.Application.DTOs.Receiver;
 using DigitalData.Core.DTO;
+using DigitalData.Core.Abstractions;
+using Microsoft.Extensions.Logging;
 
 namespace EnvelopeGenerator.Application.Services
 {
@@ -34,5 +36,17 @@ namespace EnvelopeGenerator.Application.Services
 
             return await _repository.DeleteAsync(rcv) ? Result.Success() : Result.Fail();
         }
+
+        public virtual async Task<Result> UpdateAsync<TUpdateDto>(TUpdateDto updateDto) where TUpdateDto : IUnique<int>
+        {
+            var val = await _repository.ReadByIdAsync(updateDto.Id);
+            if (val == null)
+            {
+                return Result.Fail().Notice(LogLevel.Warning, Flag.NotFound, $"{updateDto.Id} is not found in update process of {GetType()} entity.");
+            }
+
+            var entity = _mapper.Map(updateDto, val);
+            return (await _repository.UpdateAsync(entity)) ? Result.Success() : Result.Fail();
+        }
     }
 }

EnvelopeGenerator.Common/Constants.vb

@@ -99,6 +99,7 @@
         DocumentCompleted
         DocumentAccessCodeReceived
         DocumentShared
+        TotpSecret
     End Enum
 
     Public Enum EncodeType

EnvelopeGenerator.Domain/Entities/EnvelopeReceiverBase.cs

@@ -46,6 +46,9 @@ namespace EnvelopeGenerator.Domain.Entities
         [RegularExpression(@"^\+[0-9]+$", ErrorMessage = "Phone number must start with '+' followed by digits.")]
         public string? PhoneNumber { get; set; }
 
+        [Column("TFA_ENABLED", TypeName = "bit")]
+        public bool TFAEnabled { get; set; }
+
         [NotMapped]
         public (int Envelope, int Receiver) Id => (Envelope: EnvelopeId, Receiver: ReceiverId);
 

EnvelopeGenerator.Domain/Entities/Receiver.cs

@@ -24,6 +24,12 @@ namespace EnvelopeGenerator.Domain.Entities
         [Column("ADDED_WHEN", TypeName = "datetime")]
         public DateTime AddedWhen { get; set; }
 
+        [Column("TOTP_SECRET_KEY", TypeName = "nvarchar(MAX)")]
+        public string? TotpSecretkey { get; set; }
+
+        [Column("TOTP_EXPIRATION", TypeName = "datetime")]
+        public DateTime? TotpExpiration { get; set; }
+
         public IEnumerable<EnvelopeReceiver>? EnvelopeReceivers { get; init; }
     }
 }

EnvelopeGenerator.Extensions/EnvelopeGenerator.Extensions.csproj

@@ -10,6 +10,7 @@
     <PackageReference Include="HtmlSanitizer" Version="8.0.865" />
     <PackageReference Include="Microsoft.Extensions.Localization.Abstractions" Version="7.0.19" />
     <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageReference Include="Otp.NET" Version="1.4.0" />
   </ItemGroup>
 
   <ItemGroup>

EnvelopeGenerator.Extensions/StringExtension.cs

@@ -0,0 +1,14 @@
+using OtpNet;
+
+namespace EnvelopeGenerator.Extensions
+{
+    public static class StringExtension
+    {
+        public static bool IsValidTotp(this string totp, string secret)
+        {
+            var secret_bytes = Base32Encoding.ToBytes(secret);
+            var secret_totp = new Totp(secret_bytes);
+            return secret_totp.VerifyTotp(totp, out _, VerificationWindow.RfcSpecifiedNetworkDelay);
+        }
+    }
+}

EnvelopeGenerator.Infrastructure/Contracts/IEnvelopeReceiverRepository.cs

@@ -5,19 +5,19 @@ namespace EnvelopeGenerator.Infrastructure.Contracts
 {
     public interface IEnvelopeReceiverRepository : ICRUDRepository<EnvelopeReceiver, (int Envelope, int Receiver)>
     {
-        Task<IEnumerable<EnvelopeReceiver>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false);
+        Task<IEnumerable<EnvelopeReceiver>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false, bool readOnly = true);
 
-        Task<IEnumerable<EnvelopeReceiver>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true);
+        Task<IEnumerable<EnvelopeReceiver>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true, bool readOnly = true);
 
-        Task<EnvelopeReceiver?> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true);
+        Task<EnvelopeReceiver?> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true);
 
-        Task<string?> ReadAccessCodeAsync(string uuid, string signature);
+        Task<string?> ReadAccessCodeAsync(string uuid, string signature, bool readOnly = true);
 
         Task<int> CountAsync(string uuid, string signature);
 
-		Task<EnvelopeReceiver?> ReadByIdAsync(int envelopeId, int receiverId);
+		Task<EnvelopeReceiver?> ReadByIdAsync(int envelopeId, int receiverId, bool readOnly = true);
 
-		Task<string?> ReadAccessCodeByIdAsync(int envelopeId, int receiverId);
+		Task<string?> ReadAccessCodeByIdAsync(int envelopeId, int receiverId, bool readOnly = true);
 
         Task<IEnumerable<EnvelopeReceiver>> ReadByUsernameAsync(string username, int? min_status = null, int? max_status = null, params int[] ignore_statuses);
 

EnvelopeGenerator.Infrastructure/Repositories/EnvlopeReceiverRepository.cs

@@ -11,9 +11,9 @@ namespace EnvelopeGenerator.Infrastructure.Repositories
         {
         }
 
-        private IQueryable<EnvelopeReceiver> ReadWhere(string? uuid = null, string? signature = null, bool withEnvelope = false, bool withReceiver = false)
+        private IQueryable<EnvelopeReceiver> ReadWhere(string? uuid = null, string? signature = null, bool withEnvelope = false, bool withReceiver = false, bool readOnly = true)
         {
-            var query = _dbSet.AsNoTracking();
+            var query = readOnly ? _dbSet.AsNoTracking() : _dbSet;
 
             if (uuid is not null)
                 query = query.Where(er => er.Envelope != null && er.Envelope.Uuid == uuid);
@@ -32,31 +32,34 @@ namespace EnvelopeGenerator.Infrastructure.Repositories
             return query;
         }
 
-        public async Task<IEnumerable<EnvelopeReceiver>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false)
-            => await ReadWhere(uuid: uuid, withEnvelope: withEnvelope, withReceiver: withReceiver).ToListAsync();
+        public async Task<IEnumerable<EnvelopeReceiver>> ReadByUuidAsync(string uuid, bool withEnvelope = true, bool withReceiver = false, bool readOnly = true)
+            => await ReadWhere(uuid: uuid, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly).ToListAsync();
 
-        public async Task<IEnumerable<EnvelopeReceiver>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true)
-            => await ReadWhere(signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver).ToListAsync();
+        public async Task<IEnumerable<EnvelopeReceiver>> ReadBySignatureAsync(string signature, bool withEnvelope = false, bool withReceiver = true, bool readOnly = true)
+            => await ReadWhere(signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly).ToListAsync();
 
-        public async Task<EnvelopeReceiver?> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true)
-            => await ReadWhere(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver).FirstOrDefaultAsync();
+        public async Task<EnvelopeReceiver?> ReadByUuidSignatureAsync(string uuid, string signature, bool withEnvelope = true, bool withReceiver = true, bool readOnly = true)
+            => await ReadWhere(uuid: uuid, signature: signature, withEnvelope: withEnvelope, withReceiver: withReceiver, readOnly: readOnly).FirstOrDefaultAsync();
 
-        public async Task<string?> ReadAccessCodeAsync(string uuid, string signature)
-            => await ReadWhere(uuid: uuid, signature: signature)
+        public async Task<string?> ReadAccessCodeAsync(string uuid, string signature, bool readOnly = true)
+            => await ReadWhere(uuid: uuid, signature: signature, readOnly: readOnly)
                 .Select(er => er.AccessCode)
                 .FirstOrDefaultAsync();
 
         public async Task<int> CountAsync(string uuid, string signature) => await ReadWhere(uuid: uuid, signature: signature).CountAsync();
 
-        public IQueryable<EnvelopeReceiver> ReadById(int envelopeId, int receiverId) => _dbSet.AsNoTracking()
-            .Where(er => er.EnvelopeId == envelopeId && er.ReceiverId == receiverId);
+        private IQueryable<EnvelopeReceiver> ReadById(int envelopeId, int receiverId, bool readOnly = true)
+        {
+            var query = readOnly ? _dbSet.AsNoTracking() : _dbSet;
+            return query.Where(er => er.EnvelopeId == envelopeId && er.ReceiverId == receiverId);
+        }
 
-        public async Task<EnvelopeReceiver?> ReadByIdAsync(int envelopeId, int receiverId)
-            => await ReadById(envelopeId: envelopeId, receiverId: receiverId)
+        public async Task<EnvelopeReceiver?> ReadByIdAsync(int envelopeId, int receiverId, bool readOnly = true)
+            => await ReadById(envelopeId: envelopeId, receiverId: receiverId, readOnly: readOnly)
             .FirstOrDefaultAsync();
 
-        public async Task<string?> ReadAccessCodeByIdAsync(int envelopeId, int receiverId)
-            => await ReadById(envelopeId: envelopeId, receiverId: receiverId)
+        public async Task<string?> ReadAccessCodeByIdAsync(int envelopeId, int receiverId, bool readOnly = true)
+            => await ReadById(envelopeId: envelopeId, receiverId: receiverId, readOnly: readOnly)
             .Select(er => er.AccessCode)
             .FirstOrDefaultAsync();
 

EnvelopeGenerator.Web/Controllers/HomeController.cs

@@ -19,7 +19,7 @@ using Ganss.Xss;
 using Newtonsoft.Json;
 using EnvelopeGenerator.Application.DTOs;
 using DigitalData.Core.Client;
-using DevExpress.Utils.About;
+using EnvelopeGenerator.Application.Extensions;
 
 namespace EnvelopeGenerator.Web.Controllers
 {
@@ -37,8 +37,10 @@ namespace EnvelopeGenerator.Web.Controllers
         private readonly IEnvelopeReceiverReadOnlyService _readOnlyService;
         private readonly IMessagingService _msgService;
         private readonly IEnvelopeReceiverCache _erCache;
+        private readonly ICodeGenerator _codeGenerator;
+        private readonly IReceiverService _rcvService;
 
-        public HomeController(EnvelopeOldService envelopeOldService, ILogger<HomeController> logger, IEnvelopeReceiverService envelopeReceiverService, IEnvelopeHistoryService historyService, IStringLocalizer<Resource> localizer, IConfiguration configuration, HtmlSanitizer sanitizer, Cultures cultures, IEnvelopeMailService envelopeMailService, IEnvelopeReceiverReadOnlyService readOnlyService, IMessagingService messagingService, IEnvelopeReceiverCache envelopeReceiverCache)
+        public HomeController(EnvelopeOldService envelopeOldService, ILogger<HomeController> logger, IEnvelopeReceiverService envelopeReceiverService, IEnvelopeHistoryService historyService, IStringLocalizer<Resource> localizer, IConfiguration configuration, HtmlSanitizer sanitizer, Cultures cultures, IEnvelopeMailService envelopeMailService, IEnvelopeReceiverReadOnlyService readOnlyService, IMessagingService messagingService, IEnvelopeReceiverCache envelopeReceiverCache, ICodeGenerator codeGenerator, IReceiverService receiverService)
         {
             this.envelopeOldService = envelopeOldService;
             _envRcvService = envelopeReceiverService;
@@ -52,6 +54,8 @@ namespace EnvelopeGenerator.Web.Controllers
             _readOnlyService = readOnlyService;
             _msgService = messagingService;
             _erCache = envelopeReceiverCache;
+            _codeGenerator = codeGenerator;
+            _rcvService = receiverService;
         }
 
         [HttpGet("/")]
@@ -140,7 +144,10 @@ namespace EnvelopeGenerator.Web.Controllers
                 ViewData["UserCulture"] = _cultures[UserLanguage];
 
                 return await _envRcvService.ReadByEnvelopeReceiverIdAsync(envelopeReceiverId: envelopeReceiverId).ThenAsync(
-                    Success: er => View().WithData("EnvelopeKey", envelopeReceiverId),
+                    Success: er => View()
+                        .WithData("EnvelopeKey", envelopeReceiverId)
+                        .WithData("TFAEnabled", er.TFAEnabled)
+                        .WithData("HasPhoneNumber", er.HasPhoneNumber),
                     Fail: IActionResult (messages, notices) =>
                     {
                         _logger.LogNotice(notices);
@@ -176,21 +183,28 @@ namespace EnvelopeGenerator.Web.Controllers
                 //check access code
                 EnvelopeResponse response = await envelopeOldService.LoadEnvelope(envelopeReceiverId);
 
-                return await _envRcvService.ReadWithSecretByUuidSignatureAsync(uuid: uuid, signature: signature).ThenAsync<EnvelopeReceiverSecretDto, IActionResult>(
+                return await _envRcvService.ReadWithSecretByUuidSignatureAsync(uuid: uuid, signature: signature).ThenAsync(
                         SuccessAsync: async er_secret =>
                         {
-                            async Task<IActionResult> SendSmsView()
+                            async Task<IActionResult> TFAView(bool viaSms)
                             {
-                                var res = await _msgService.SendSmsCodeAsync(er_secret.PhoneNumber!, envelopeReceiverId: envelopeReceiverId);
-                                if (res.Ok)
-                                    return View("EnvelopeLocked").WithData("ViaSms", true).WithData("Expiration", res.Expiration);
-                                else if (!res.Allowed)
-                                    return View("EnvelopeLocked").WithData("ViaSms", true).WithData("Expiration", res.AllowedAt);
+                                if (viaSms)
+                                {
+                                    var res = await _msgService.SendSmsCodeAsync(er_secret.PhoneNumber!, envelopeReceiverId: envelopeReceiverId);
+                                    if (res.Ok)
+                                        return View("EnvelopeLocked").WithData("CodeType", "smsCode").WithData("SmsExpiration", res.Expiration);
+                                    else if (!res.Allowed)
+                                        return View("EnvelopeLocked").WithData("CodeType", "smsCode").WithData("SmsExpiration", res.AllowedAt);
+                                    else
+                                    {
+                                        var res_json = JsonConvert.SerializeObject(res);
+                                        _logger.LogEnvelopeError(envelopeReceiverId: envelopeReceiverId, message: $"An unexpected error occurred while sending an SMS code. Response: ${res_json}");
+                                        return this.ViewInnerServiceError();
+                                    }
+                                }
                                 else
                                 {
-                                    var res_json = JsonConvert.SerializeObject(res);
-                                    _logger.LogEnvelopeError(envelopeReceiverId: envelopeReceiverId, message: $"An unexpected error occurred while sending an SMS code. Response: ${res_json}");
-                                    return this.ViewInnerServiceError();
+                                    return View("EnvelopeLocked").WithData("CodeType", "authenticatorCode").WithData("QRCodeExpiration", er_secret.Receiver?.TotpExpiration);
                                 }
                             }
 
@@ -206,19 +220,28 @@ namespace EnvelopeGenerator.Web.Controllers
                                 if (er_secret.AccessCode != auth.AccessCode)
                                 {
                                     //Constants.EnvelopeStatus.AccessCodeIncorrect
-                                    await _historyService.RecordAsync(er_secret.EnvelopeId, er_secret.Receiver!.EmailAddress, Constants.EnvelopeStatus.AccessCodeIncorrect);
+                                    await _historyService.RecordAsync(er_secret.EnvelopeId, er_secret.Receiver!.EmailAddress, EnvelopeStatus.AccessCodeIncorrect);
                                     Response.StatusCode = StatusCodes.Status401Unauthorized;
                                     return View("EnvelopeLocked")
                                             .WithData("ErrorMessage", _localizer[WebKey.WrongAccessCode].Value);
                                 }
 
-                                await _historyService.RecordAsync(er_secret.EnvelopeId, er_secret.Receiver!.EmailAddress, Constants.EnvelopeStatus.AccessCodeCorrect);
+                                await _historyService.RecordAsync(er_secret.EnvelopeId, er_secret.Receiver!.EmailAddress, EnvelopeStatus.AccessCodeCorrect);
 
                                 //check if the user has phone is added
-                                if (er_secret.HasPhoneNumber)
+                                if (er_secret.TFAEnabled)
                                 {
-                                    return await SendSmsView();
+                                    var rcv = er_secret.Receiver;
+                                    if (rcv.IsTotpSecretInvalid())
+                                    {
+                                        rcv.TotpSecretkey = _codeGenerator.GenerateTotpSecretKey();
+                                        rcv.TotpExpiration = DateTime.Now.AddMonths(1);
+                                        await _rcvService.UpdateAsync(rcv);
+                                        await _mailService.SendTFAQrCodeAsync(er_secret);
+                                    }
+                                    return await TFAView(auth.UserSelectSMS);
                                 }
+                                    
                             }
                             else if (auth.HasSmsCode)
                             {
@@ -230,7 +253,16 @@ namespace EnvelopeGenerator.Web.Controllers
                                 {
                                     Response.StatusCode = StatusCodes.Status401Unauthorized;
                                     ViewData["ErrorMessage"] = _localizer[WebKey.WrongAccessCode].Value;
-                                    return await SendSmsView();
+                                    return await TFAView(viaSms: true);
+                                }
+                            }
+                            else if (auth.HasAuthenticatorCode)
+                            {
+                                if (er_secret.Receiver!.IsTotpInvalid(totp: auth.AuthenticatorCode!))
+                                {
+                                    Response.StatusCode = StatusCodes.Status401Unauthorized;
+                                    ViewData["ErrorMessage"] = _localizer[WebKey.WrongAccessCode].Value;
+                                    return await TFAView(viaSms: false);
                                 }
                             }
                             else

EnvelopeGenerator.Web/Models/Auth.cs

@@ -1,13 +1,15 @@
 namespace EnvelopeGenerator.Web.Models
 {
-    public record Auth(string? AccessCode = null, string? SmsCode = null)
+    public record Auth(string? AccessCode = null, string? SmsCode = null, string? AuthenticatorCode = null, bool UserSelectSMS = default)
     {
         public bool HasAccessCode => AccessCode is not null;
 
         public bool HasSmsCode => SmsCode is not null;
 
-        public bool HasMulti => HasAccessCode && HasSmsCode;
+        public bool HasAuthenticatorCode => AuthenticatorCode is not null;
 
-        public bool HasNone => !(HasAccessCode || HasSmsCode);
+        public bool HasMulti => new[] { HasAccessCode, HasSmsCode, HasAuthenticatorCode }.Count(state => state) > 1;
+
+        public bool HasNone => !(HasAccessCode || HasSmsCode || HasAuthenticatorCode);
     }
 }

EnvelopeGenerator.Web/Views/Home/EnvelopeLocked.cshtml

@@ -1,13 +1,21 @@
 @using EnvelopeGenerator.Application.DTOs.EnvelopeReceiver;
 @using Newtonsoft.Json
+@model Auth;
 @{
     var nonce = _accessor.HttpContext?.Items["csp-nonce"] as string;
     var logo = _logoOpt.Value;
     ViewData["Title"] = _localizer[WebKey.DocProtected];
     var userCulture = ViewData["UserCulture"] as Culture;
-    bool viaSms = ViewData["ViaSms"] is bool _viaSms && _viaSms;
-    var accessCodeName = viaSms ? "smsCode" : "accessCode";
-    DateTime? expiration = ViewData["Expiration"] is DateTime _expiration ? _expiration : null;
+    string codeType = ViewData["CodeType"] is string _codeType ? _codeType : "accessCode";
+    string codePropName = char.ToUpper(codeType[0]) + codeType.Substring(1);
+    string codeKeyName = codePropName.Replace("Code", "");
+    bool viaSms = codeType == "smsCode";
+    bool viaAuthenticator = codeType == "authenticatorCode";
+    bool viaTFA = viaSms || viaAuthenticator;
+    DateTime? smsExpiration = ViewData["SmsExpiration"] is DateTime _smsExpiration ? _smsExpiration : null;
+    DateTime? qrCodeExpiration = ViewData["QRCodeExpiration"] is DateTime _qrCodeExpiration ? _qrCodeExpiration : null;
+    bool tfaEnabled = ViewData["TFAEnabled"] is bool _tfaEnabled && _tfaEnabled;
+    bool hasPhoneNumber = ViewData["HasPhoneNumber"] is bool _hasPhoneNumber && _hasPhoneNumber;
 }
 <div class="page container py-4 px-4">
     <header class="text-center">
@@ -15,29 +23,43 @@
             <h3 class="text">@_localizer[WebKey.WelcomeToTheESignPortal]</h3>
             <img class="@logo.LockedPageClass" src="@logo.Src" />
         </div>
-        <div class="icon locked @(viaSms ? "sms-tfa" : "") mt-4 mb-1">
+        <div class="icon locked @(viaTFA ? "tfa" : "") mt-4 mb-1">
             <svg xmlns="http://www.w3.org/2000/svg" width="72" height="72" fill="currentColor" class="bi bi-shield-lock" viewBox="0 0 16 16">
                 <path d="M5.338 1.59a61 61 0 0 0-2.837.856.48.48 0 0 0-.328.39c-.554 4.157.726 7.19 2.253 9.188a10.7 10.7 0 0 0 2.287 2.233c.346.244.652.42.893.533q.18.085.293.118a1 1 0 0 0 .101.025 1 1 0 0 0 .1-.025q.114-.034.294-.118c.24-.113.547-.29.893-.533a10.7 10.7 0 0 0 2.287-2.233c1.527-1.997 2.807-5.031 2.253-9.188a.48.48 0 0 0-.328-.39c-.651-.213-1.75-.56-2.837-.855C9.552 1.29 8.531 1.067 8 1.067c-.53 0-1.552.223-2.662.524zM5.072.56C6.157.265 7.31 0 8 0s1.843.265 2.928.56c1.11.3 2.229.655 2.887.87a1.54 1.54 0 0 1 1.044 1.262c.596 4.477-.787 7.795-2.465 9.99a11.8 11.8 0 0 1-2.517 2.453 7 7 0 0 1-1.048.625c-.28.132-.581.24-.829.24s-.548-.108-.829-.24a7 7 0 0 1-1.048-.625 11.8 11.8 0 0 1-2.517-2.453C1.928 10.487.545 7.169 1.141 2.692A1.54 1.54 0 0 1 2.185 1.43 63 63 0 0 1 5.072.56" />
                 <path d="M9.5 6.5a1.5 1.5 0 0 1-1 1.415l.385 1.99a.5.5 0 0 1-.491.595h-.788a.5.5 0 0 1-.49-.595l.384-1.99a1.5 1.5 0 1 1 2-1.415" />
             </svg>
         </div>
-        <h1>@_localizer[viaSms ? WebKey.LockedSmsTfaTitle : WebKey.LockedTitle]</h1>
+        <h1>@_localizer[WebKey.Formats.LockedTitle.Format(codeKeyName)]</h1>
     </header>
     <section class="text-center">
-        <p>@_localizer[viaSms ? WebKey.LockedSmsTfaBody : WebKey.LockedBody]</p>
+        <p>@_localizer[WebKey.Formats.LockedBody.Format(codeKeyName)].Value.Format(qrCodeExpiration.ToString())</p>
     </section>
     <div class="row m-0 p-0">
         <div class="access-code-panel justify-content-center align-items-center p-0 m-0">
             <form id="form-access-code" class="form form-floating mb-0" method="post"> 
                 <div class="form-floating access-code-form-floating">
-                    <input type="password" id="access_code" class="form-control" name="@accessCodeName" placeholder="@_localizer[viaSms ? WebKey.LockedSmsAccessCode : WebKey.LockedAccessCode]" required="required">
-                    <label for="access_code">@_localizer[viaSms ? WebKey.LockedSmsAccessCode : WebKey.LockedAccessCode]</label>
+                    <input type="password" id="access_code" class="form-control" name="@codeType" placeholder="@_localizer[WebKey.Formats.LockedCodeLabel.Format(codeKeyName)]" required="required">
+                    <label for="access_code">@_localizer[WebKey.Formats.LockedCodeLabel.Format(codeKeyName)]</label>
                     <button type="submit" class="btn btn-primary">
                         <span class="material-symbols-outlined">
                             login
                         </span>
                     </button>
-                    @if (expiration is not null)
+                    @if (tfaEnabled)
+                    {
+                    <div class="form-check form-switch tfa-sms">
+                        @if(hasPhoneNumber)
+                        {
+                        <input asp-for="UserSelectSMS" class="form-check-input" name="userSelectSMS" type="checkbox" role="switch" id="flexSwitchCheckChecked">
+                        }
+                        else
+                        {
+                        <input asp-for="UserSelectSMS" class="form-check-input" name="userSelectSMS" type="checkbox" role="switch" id="flexSwitchCheckChecked" disabled)>
+                        }                        
+                        <label class="form-check-label" for="flexSwitchCheckChecked">2FA per SMS</label>
+                    </div>
+                    }
+                    @if (smsExpiration is not null)
                     {
                     <div id="sms-timer" class="alert alert-primary" role="alert">00:00</div>
                     }
@@ -54,13 +76,13 @@
     }
     <section class="no-receiver-explanation text-center">
         <details>
-            <summary>@_localizer[viaSms ? WebKey.LockedSmsTfaFooterTitle : WebKey.LockedFooterTitle]</summary>
-            <p>@_localizer[viaSms ? WebKey.LockedSmsTfaFooterBody : WebKey.LockedFooterBody]</p>
+            <summary>@_localizer[WebKey.Formats.LockedFooterTitle.Format(codeKeyName)]</summary>
+            <p>@_localizer[WebKey.Formats.LockedFooterBody.Format(codeKeyName)]</p>
         </details>
     </section>
 </div>
 <script nonce="@nonce">
-    var expiration = new Date(@Html.Raw(JsonConvert.SerializeObject(expiration)));
+    var expiration = new Date(@Html.Raw(JsonConvert.SerializeObject(smsExpiration)));
 
     const element = document.getElementById("sms-timer");
 

EnvelopeGenerator.Web/WebKey.cs

@@ -10,17 +10,6 @@
         public static readonly string NonDecodableEnvelopeReceiverId = nameof(NonDecodableEnvelopeReceiverId);
         public static readonly string de_DE = nameof(de_DE).Replace("_", "-");
         public static readonly string en_US = nameof(en_US).Replace("_", "-");
-        public static readonly string LockedTitle = nameof(LockedTitle);
-        public static readonly string LockedSmsTfaTitle = nameof(LockedSmsTfaTitle);
-        public static readonly string LockedBody = nameof(LockedBody);
-        public static readonly string LockedSmsTfaBody = nameof(LockedSmsTfaBody);
-        public static readonly string LocakedOpen = nameof(LocakedOpen);
-        public static readonly string LockedAccessCode = nameof(LockedAccessCode);
-        public static readonly string LockedSmsAccessCode = nameof(LockedSmsAccessCode);
-        public static readonly string LockedFooterTitle = nameof(LockedFooterTitle);
-        public static readonly string LockedSmsTfaFooterTitle = nameof(LockedSmsTfaFooterTitle);
-        public static readonly string LockedFooterBody = nameof(LockedFooterBody);
-        public static readonly string LockedSmsTfaFooterBody = nameof(LockedSmsTfaFooterBody);
         public static readonly string WrongAccessCode = nameof(WrongAccessCode);
         public static readonly string SignDoc = nameof(SignDoc);
         public static readonly string DocRejected = nameof(DocRejected);
@@ -42,5 +31,22 @@
         public static readonly string ViewDoc = nameof(ViewDoc);
         public static readonly string HomePageDescription = nameof(HomePageDescription);
         public static readonly string Privacy = nameof(Privacy);
+        
+        public static class Formats
+        {
+            public static readonly string LockedTitle = nameof(LockedTitle) + "{0}";
+
+            public static readonly string LockedBody = nameof(LockedBody) + "{0}";
+
+            public static readonly string LockedCodeLabel = nameof(LockedCodeLabel) + "{0}";
+
+            public static readonly string LockedFooterTitle = nameof(LockedFooterTitle) + "{0}";
+
+            public static readonly string LockedFooterBody = nameof(LockedFooterBody) + "{0}";
+        }
+
+        public static string Format(this string st, object? arg0) => string.Format(st, arg0: arg0);
+
+        public static string Format(this string st, params object?[] args) => string.Format(st, args: args);
     }
 }

EnvelopeGenerator.Web/wwwroot/css/site.css

@@ -225,7 +225,7 @@ footer {
             color: #000;
         }
 
-            .page header .icon.locked.sms-tfa {
+            .page header .icon.locked.tfa {
                 background-color: #ff7207;
                 color: #000;
             }
@@ -448,6 +448,16 @@ footer#page-footer {
         cursor: pointer;
     }
 
+.form-check.tfa-sms {
+    margin-left: 2rem;
+}
+
+    .form-check.tfa-sms .form-check-label {
+        font-size: 0.875rem;
+        font-weight: 500;
+        margin-left: -.1rem;
+    }
+
 /*.flag-dropdown button {
     height: 100%;
 }*/