...
| Code Block | ||||
|---|---|---|---|---|
| ||||
Api details:
URI : v1/otp/generate
Method: POST
header: api key
request body:
{
"request":
{
"userId":"valid user id"
"key":"email/phone/prevUsedEmail/prevUsedPhone value", // prevUsedEmail/prevUsedPhone value should be used if userId is not null for forgot password flow
"type" : "supported type as of now{email or phone}"
}
}
Response:
Case 1 : 200
Success or failure . (in case of success , user will get OTP either on email or phone) - Response structure will be same as sunbird other api's.
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "",
"status": "success",
"errmsg": ""
},
"responseCode": "OK",
"result": {
"response":"SUCCESS"
}
}
Case 2 : 400
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "MAX_LIMIT_EXHAUSTED",
"status": "MAX_LIMIT_EXHAUSTED",
"errmsg": "Only 4 OTP can be generated with in 24 hours"
},
"responseCode": "CLIENT_ERROR",
"result": {
}
}
// 400 error code can have : Phone or email is already in used , INVALID_PHONE/EMAIL , PHONE/EMAIL IS BLOCKED.
Case 3 : 500
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "SERVER_ERROR",
"status": "SERVER_ERROR",
"errmsg": "Process failed, please try again."
},
"responseCode": "SERVER_ERROR",
"result": {
}
}
|
-- This api will have following validations:
...
1. User ID validation(Optional)2. Request validation based on type {phone or email}.23. Requested phone/email should not present in user data base. if it's present in user DB then throw error.- {"Phone or email is already in used."}34. If requested phone/email is already in otp _ authenticate table and is not expired yet and attempt threshold is less than set value then send same OTP.45. if OTP request is for first time then generate an OTP, store into db and send to user with valid channel. valid channel can be (email/Phone)56. If user requested for OTP and OTP is expired and attempt count is less than threshold value-...
- Scenario 3: Generate new OTP and reset only attempt count and generated time. 67. If user requested for OTP and OTP is expired and attempt count greater than equal to threshold value Or OTP is not expired but attempt count more than threshold then throw an error. and put this data into in-memory for particular time to , so that next time it will check in cache it self if phone/email found then through error78. Api gateway will have ip based throttling for this api, so that from same IP you can't continuously hit it.89. Sunbird will have phone based throttling. (it will have separate design doc) API throttling or OTP API Throttling-- OTP generation will have following setting :...
https://docs.msg91.com/collection/msg91-api-integration/5/send-otp-message/TZ6HN0YI
| Pros | Cons |
|---|---|
|
|
|
Table structure to store OTP:
| Key | data type | purpose |
|---|---|---|
| idtype+key | text (composite primary key) | |
| type | text | possible values are email or phone. Based on type we can identify key having value as email or phone |
| key | text (encrypted in DB) | source against which OTP is generated (key will have value as either email or phone) |
| OTP | text | generated OTP |
| createdOn | timestamp | at which time it was generated |
| lastUsedOn | ||
Table structure to store invalid/blocked phone number
Structure : 1
| key | data type | purpose |
|---|---|---|
| phone | text | phone number which is marked as invalid or blocked by sms gateway. |
| createdOn | timestamp | when row inserted |
| blockedOn | timestamp | when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it. |
Structure 2:
| key | data type | purpose |
|---|---|---|
| key | text | can be invalid/blocked phone number or email |
| type | text | As of now it can be email or phone |
| createdOn | timestamp | when row inserted |
| blockedOn | timestamp | when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it. |
Open questions:
- Process to clear expired OTP or blocked OTP (when exactly we need to clear it.)
...
1. Use TTL and cassandra will automatically removed that records from table. (Accepted solution: OTP cleanup will happen based on ttl)
2. When ever user try next time , and then based on business logic if he is applicable for new OTP then remove old one
...
- Sending SMS or Email are Async call , if format is valid it will return success , but later it will try to send it that might got failure.
- As SMS gate way will have api to check delivery reports : https://docs.msg91.com/collection/msg91-api-integration/5/delivery-report/T19VM23R
- Msg91 provides webhooks to get delivery reports , so instead of we making call to get reports , we can use webhook: https://help.msg91.com/article/56-how-can-i-get-the-delivery-reports-on-my-url-through-api-what-is-the-reason-for-not-getting-report-on-my-url
- possibility to attach a scheduler to get the status based on messageId and update the status in DB
- In case of email how can we confirm delivery reports? ( In this release we are not using any delivery reports)
- What will happen if delivery reports indicates failure ? (cases like blocked or invalid numbers)
- What should be frequency to get OTP delivery reports? ( In this release we are not using any delivery reports)