OTP Authentication

Adds OTP-based two-factor authentication (2FA) to Botble CMS. Supports email delivery via the built-in Botble email system and SMS delivery via the SH SMS Notifier plugin. Works for admin/staff users, customers (ecommerce), and vendors.

Features

• OTP challenge injected into the admin login pipeline (zero login-form changes).
• OTP challenge intercepted at the customer login response (ecommerce).
• Per-user enable/disable toggle on the admin profile page.
• Configurable OTP length (4–8 digits), expiry, resend cooldown, and max attempts.
• OTP codes stored as SHA-256 hashes — plain codes never persisted.
• Email delivery via Botble's EmailHandler with a fully editable template.
• SMS delivery via SH SMS Notifier (SmsHandler::sendUsingTemplate()); SMS toggle auto-disables when SSN is not installed.
• Comprehensive OTP audit log (otp_logs table).

Requirements

• Botble CMS ≥ 7.0.0
• SH SMS Notifier plugin (optional — required for SMS OTP only)
• Ecommerce plugin (optional — required for customer OTP)

Installation

1. Copy the otp-auth folder into platform/plugins/.
2. In the admin panel go to Plugins and activate OTP Authentication.
3. Run migrations if activation does not trigger them automatically:

php artisan migrate --path=platform/plugins/otp-auth/database/migrations

4. Publish assets:

php artisan vendor:publish --tag=otp-auth-assets

Configuration

Navigate to Admin → Settings → Others → OTP Authentication.

Email Template

The OTP email is managed through Admin → Settings → Email → OTP Authentication.

Available template variables:

SMS Template

The OTP SMS template is managed through SH SMS Notifier → Templates → otp_code.

Available variables:

Default template: Your verification code: {{code}}. Valid for {{expiry}} minutes. Do not share this code.

If the SH SMS Notifier plugin is not installed, the SMS OTP toggle is hidden and a notice is shown in settings.

Per-User OTP Preference

Each admin user can override the global role setting from their profile page:

• Admin → Profile → OTP Security
• Options: follow global default, explicitly enable, or explicitly disable OTP for their account.

Per-user preferences are stored in the otp_user_preferences table (polymorphic, supports both admin users and customers).

Database Tables

Delivery Logic

1. Effective method is resolved from settings (email, sms, or both).
2. If SMS is selected but SH SMS Notifier is not installed, falls back to email.
3. Both channels attempt delivery when method is both.
4. If neither channel succeeds, email is retried as last resort (if email is enabled).

Uninstall

Deactivate the plugin from Admin → Plugins → OTP Authentication → Deactivate. All settings, OTP codes, logs, and user preferences are removed automatically.

Changelog

2.0.1

• Per-user OTP preference toggle on the admin profile page.
• Botble EmailHandler integration (editable email template in admin).
• SH SMS Notifier SmsHandler integration (editable SMS template in SSN).
• Removed custom SMS gateway — SMS exclusively via SH SMS Notifier.
• Removed custom template editor — all templates managed through standard Botble / SSN interfaces.
• Plugin appears only in Settings > Others (no admin sidebar entry).
• SHA-256 code hashing, OTP audit log, and graceful null safety on deleted users.