Page Comparison

...

Code Block

language	js
title	Generate OTP

Api details:
URI : v1/otp/generate
Method: POST
header: api key
request body:
 {
 "request":
     {
       "userId":"valid user id"
       "key":"email/phone/prevUsedEmail/prevUsedPhone value", // prevUsedEmail/prevUsedPhone value should be used if userId is not null for forgot password flow
        "type" : "supported type as of now{email or phone}" 
     }

}

Response:
    Case 1 : 200
     {
    "id": "api.otp.generate",
    "ver": "v1",
    "ts": "2018-11-28 11:12:31:853+0000",
    "params": {
        "resmsgid": null,
        "msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
        "err": "",
        "status": "success",
        "errmsg": ""
    },
    "responseCode": "OK",
    "result": {
         "response":"SUCCESS"
        }
}

 Case 2 : 400
     {
    "id": "api.otp.generate",
    "ver": "v1",
    "ts": "2018-11-28 11:12:31:853+0000",
    "params": {
        "resmsgid": null,
        "msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
        "err": "MAX_LIMIT_EXHAUSTED",
        "status": "MAX_LIMIT_EXHAUSTED",
        "errmsg": "Only 4 OTP can be generated with in 24 hours"
    },
    "responseCode": "CLIENT_ERROR",
    "result": {
        }
}

// 400 error code can have : Phone or email is already in used , INVALID_PHONE/EMAIL , PHONE/EMAIL IS BLOCKED.

Case 3 : 500
     {
    "id": "api.otp.generate",
    "ver": "v1",
    "ts": "2018-11-28 11:12:31:853+0000",
    "params": {
        "resmsgid": null,
        "msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
        "err": "SERVER_ERROR",
        "status": "SERVER_ERROR",
        "errmsg": "Process failed, please try again."
    },
    "responseCode": "SERVER_ERROR",
    "result": {
        }
}

...

-- This api will have following validations:

...

1. User ID validation(Optional)

2. Request validation based on type {phone or email}.

23. Requested phone/email should not present in user data base. if it's present in user DB then throw error.- {"Phone or email is already in used."}

34. If requested phone/email is already in otp authenticate table and is not expired yet and attempt threshold is less than set value then send same OTP.

45. if OTP request is for first time then generate an OTP, store into db and send to user with valid channel. valid channel can be (email/Phone)

56. If user requested for OTP and OTP is expired and attempt count is less than threshold value-

...

- Scenario 3: Generate new OTP and reset only attempt count and generated time.

67. If user requested for OTP and OTP is expired and attempt count greater than equal to threshold value  Or OTP is not expired but attempt count more than threshold then throw an error. and put this data into in-memory for particular time to , so that next time it will check in cache it self if phone/email found then through error

78. Api gateway will have ip based throttling for this api, so that from same IP you can'~~t continuously hit it.~~

89. Sunbird will have phone based throttling. (it will have separate design doc) API throttling or OTP API Throttling

-- OTP generation will have following setting :

...

Table structure to store OTP:

Key	data type	purpose
idtype+key	text (composite primary key)
type	text	possible values are email or phone. Based on type we can identify key having value as email or phone
key	text (encrypted in DB)	source against which OTP is generated (key will have value as either email or phone)
OTP	text	generated OTP
createdOn	timestamp	at which time it was generated
~~updatedOn~~	~~timestamp~~	~~when it was last used~~
~~retryCount~~	~~int~~	~~how many time user already retried it~~
~~isLocked~~	~~boolean~~	~~if retry count exceed limit then isLocked true~~
~~lockedOn~~	~~timestamp~~	~~when it was locked.~~

...

Table structure to store invalid/blocked phone number

Structure : 1

key	data type	purpose
phone	text	phone number which is marked as invalid or blocked by sms gateway.
createdOn	timestamp	when row inserted
blockedOn	timestamp	when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it.

Structure 2:

key	data type	purpose
key	text	can be invalid/blocked phone number or email
type	text	As of now it can be email or phone
createdOn	timestamp	when row inserted
blockedOn	timestamp	when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it.

Open questions:

Process to clear expired OTP or blocked OTP (when exactly we need to clear it.)

...

1. Use TTL and cassandra will automatically removed that records from table. (Accepted solution: OTP cleanup will happen based on ttl)

2. When ever user try next time , and then based on business logic if he is applicable for new OTP then remove old one

...

Sending SMS or Email are Async call , if format is valid it will return success , but later it will try to send it that might got failure.
As SMS gate way will have api to check delivery reports : https://docs.msg91.com/collection/msg91-api-integration/5/delivery-report/T19VM23R
Msg91 provides webhooks to get delivery reports , so instead of we making call to get reports , we can use webhook: https://help.msg91.com/article/56-how-can-i-get-the-delivery-reports-on-my-url-through-api-what-is-the-reason-for-not-getting-report-on-my-url
- possibility to attach a scheduler to get the status based on messageId and update the status in DB
In case of email how can we confirm delivery reports? ( In this release we are not using any delivery reports)
What will happen if delivery reports indicates failure ? (cases like blocked or invalid numbers)
What should be frequency to get OTP delivery reports? ( In this release we are not using any delivery reports)

Versions Compared

Old Version 12

New Version Current

Key

Table structure to store OTP:

Table structure to store invalid/blocked phone number

Open questions:

Accepted Solution is proposed solution 1