Repository: juspay/hyperswitch
File: crates/router/src/core/user.rs (Rust)

Code before:
        }));
    };

    let totp = user_api::TwoFactorAuthAttempts {
        is_completed: tfa_utils::check_totp_in_redis(&state, &user_token.user_id).await?,
        remaining_attempts: consts::user::TOTP_MAX_ATTEMPTS
            - tfa_utils::get_totp_attempts_from_redis(&state, &user_token.user_id).await?,
    };
    let recovery_code = user_api::TwoFactorAuthAttempts {
        is_completed: tfa_utils::check_recovery_code_in_redis(&state, &user_token.user_id).await?,
        remaining_attempts: consts::user::RECOVERY_CODE_MAX_ATTEMPTS
            - tfa_utils::get_recovery_code_attempts_from_redis(&state, &user_token.user_id).await?,
    };
    Ok(ApplicationResponse::Json(user_api::TwoFactorStatus {
        status: Some(user_api::TwoFactorAuthStatusResponseWithAttempts {
            totp,
            recovery_code,
        }),
        is_skippable,
    }))
}

pub async fn create_user_authentication_method(
    state: SessionState,
    req: user_api::CreateUserAuthenticationMethodRequest,
) -> UserResponse<Vec<user_api::CreateUserAuthenticationMethodResponse>> {
    let user_auth_encryption_key = hex::decode(
        state
            .conf
            .user_auth_methods
            .get_inner()
            .encryption_key
            .clone()
            .expose(),
    )
    .change_context(UserErrors::InternalServerError)
    .attach_printable("Failed to decode DEK")?;

    let id = uuid::Uuid::new_v4().to_string();

    let id_for_response = id.clone();

    let (private_config, public_config) = utils::user::construct_public_and_private_db_configs(
        &state,
        &req.auth_method,
        &user_auth_encryption_key,
        id,
    )
    .await?;

    let auth_methods = state

Review comment (security):
We can return `user_api::CreateUserAuthenticationMethodResponse`, since a single authentication method will be created, we don't need `Vec`. Please change this.

Code after:
        }));
    };

    let totp = user_api::TwoFactorAuthAttempts {
        is_completed: tfa_utils::check_totp_in_redis(&state, &user_token.user_id).await?,
        remaining_attempts: consts::user::TOTP_MAX_ATTEMPTS
            - tfa_utils::get_totp_attempts_from_redis(&state, &user_token.user_id).await?,
    };
    let recovery_code = user_api::TwoFactorAuthAttempts {
        is_completed: tfa_utils::check_recovery_code_in_redis(&state, &user_token.user_id).await?,
        remaining_attempts: consts::user::RECOVERY_CODE_MAX_ATTEMPTS
            - tfa_utils::get_recovery_code_attempts_from_redis(&state, &user_token.user_id).await?,
    };
    Ok(ApplicationResponse::Json(user_api::TwoFactorStatus {
        status: Some(user_api::TwoFactorAuthStatusResponseWithAttempts {
            totp,
            recovery_code,
        }),
        is_skippable,
    }))
}

pub async fn create_user_authentication_method(
    state: SessionState,
    req: user_api::CreateUserAuthenticationMethodRequest,
) -> UserResponse<user_api::CreateUserAuthenticationMethodResponse> {
    let user_auth_encryption_key = hex::decode(
        state
            .conf
            .user_auth_methods
            .get_inner()
            .encryption_key
            .clone()
            .expose(),
    )
    .change_context(UserErrors::InternalServerError)
    .attach_printable("Failed to decode DEK")?;

    let id = uuid::Uuid::new_v4().to_string();

    let (private_config, public_config) = utils::user::construct_public_and_private_db_configs(
        &state,
        &req.auth_method,
        &user_auth_encryption_key,
        id.clone(),
    )
    .await?;

    let auth_methods = state
        .store
        .list_user_authentication_methods_for_owner_id(&req.owner_id)