Module for Magento 2

This module provides a top-notch security for your customers' accounts by adopting a passwordless approach, effectively removing the vulnerability of weak passwords from your database. This instills a sense of confidence and reliability in your platform among your customers.

• Setup
  • Composer installation
  • Setup the module
• Settings
• Documentation
• Support
• Authors
• License

Setup

Magento 2 Open Source or Commerce edition is required.

Composer installation

Run the following composer command:

composer require opengento/module-hoodoor

Setup the module

Run the following magento command:

bin/magento setup:upgrade

If you are in production mode, do not forget to recompile and redeploy the static resources.

Settings

The configuration for this module is available in Stores > Configuration > OpenGento > Hoodoor.

Make sure you have generated a secret key.

Documentation

Compatibility and Activation:

This module is compatible with Magento 2 version 2.4.6-p4.

You have the flexibility to enable its functionality either on the Magento frontend or backend. To activate either option, adjust the corresponding values in the config settings.

Token Expiration and Customization:

By default, the authentication token remains valid for 15 minutes after the email is sent. However, you have the option to customize this duration according to your requirements. Refer to the PHP documentation on how to modify the datetime value.

Enhanced Security Measures:

We have implemented a robust security layer to ensure a high level of protection for the data transmitted via the HTTP protocol.

Private Key Generation:

To process requests securely, it is essential to generate a private key in the settings. This private key serves as a crucial component for decrypting and authenticating requests. Failure to provide this key may hinder the ability to decipher and establish connections effectively.

Support

Raise a new request to the issue tracker.

Authors

• Opengento Community - Lead -
• Ronan Guérin - Maintainer -
• Contributors - Contributor -

License

This project is licensed under the MIT License - see the LICENSE details.

That's all folks!

Changelog

[0.2.0]

Added

• PHPDoc blocks on all previously undocumented methods across the module
• #[\Override] attributes on all overriding methods (PHP 8.3)
• Typed constants (const string) where applicable (PHP 8.3)
• Admin email template registration (admin_login) in etc/email_templates.xml
• Login URL is now built in PHP (EmailProcessor) and passed as login_url template variable

Changed

• RequestException now extends LocalizedException instead of \Exception
• AccountManagement plugin throws LocalizedException instead of \Exception and uses __() instead of _()
• Admin emails use a dedicated admin_login template instead of the generic customer one
• Email templates use {{var login_url}} instead of this.getUrl(...) calls
• Removed unused catch variables ($e, $exception)

Refactored

• Extracted shared ProcessLogin logic into ProcessLoginTrait — both frontend and admin controllers now use the trait and implement 3 abstract methods
• Extracted shared RequestLogin logic into RequestLoginTrait — both frontend and admin controllers now use the trait and implement 5 abstract methods
• Consolidated 3 identical RemoveReAuthVerification plugin classes into a single class using Generic type hint
• PasswordVerification::remove() signature changed from AccountForm|UserMain|RoleInfo to Generic

Fixed

• PHP 8.4 compatibility: implicit nullable parameters now use explicit ?Type syntax (CreatePost, Model/Admin/User)
• AccountManagementTest expectations updated to match LocalizedException change