feat(auth)!: decouple SMS multi-factor configuration from the phone sign-in provider (#2483)

Author: demolaf

app/src/main/java/com/firebaseui/android/demo/auth/AuthFlowControllerDemoActivity.kt

@@ -103,7 +103,6 @@ class AuthFlowControllerDemoActivity : ComponentActivity() {
                     defaultNumber = null,
                     defaultCountryCode = null,
                     allowedCountries = emptyList(),
-                    smsCodeLength = 6,
                     timeout = 120L,
                     isInstantVerificationEnabled = true
                 ),

app/src/main/java/com/firebaseui/android/demo/auth/HighLevelApiDemoActivity.kt

@@ -153,7 +153,6 @@ class HighLevelApiDemoActivity : ComponentActivity() {
                             defaultNumber = null,
                             defaultCountryCode = null,
                             allowedCountries = emptyList(),
-                            smsCodeLength = 6,
                             timeout = 120L,
                             isInstantVerificationEnabled = true
                         )

app/src/main/java/com/firebaseui/android/demo/auth/PhoneAuthSlotDemoActivity.kt

@@ -95,7 +95,6 @@ class PhoneAuthSlotDemoActivity : ComponentActivity() {
                         defaultNumber = null,
                         defaultCountryCode = "US",
                         allowedCountries = emptyList(),
-                        smsCodeLength = 6,
                         timeout = 60L,
                         isInstantVerificationEnabled = true
                     )

auth/README.md

@@ -454,9 +454,6 @@ val phoneProvider = AuthProvider.Phone(
     // Optional: Allowed countries
     allowedCountries = listOf("US", "CA", "GB"),
 
-    // Optional: SMS code length (default: 6)
-    smsCodeLength = 6,
-
     // Optional: Timeout for SMS delivery in seconds (default: 60)
     timeout = 60L,
 
@@ -1082,7 +1079,12 @@ val mfaConfig = MfaConfiguration(
     allowedFactors = listOf(MfaFactor.Sms, MfaFactor.Totp),
 
     // Optional: Require MFA enrollment (default: false)
-    requireEnrollment = false
+    requireEnrollment = false,
+
+    // Optional: restrict the SMS enrollment step's country selector, as ISO 3166-1 alpha-2
+    // codes (default: null, no restriction). Independent of the phone sign-in provider's own
+    // allowedCountries — an SMS second factor is configured separately from phone sign-in.
+    allowedCountries = listOf("US", "CA", "GB")
 )
 
 val configuration = authUIConfiguration {
@@ -1112,10 +1114,14 @@ fun MfaEnrollmentFlow() {
 
     if (currentUser != null) {
         val mfaConfig = MfaConfiguration(
-            allowedFactors = listOf(MfaFactor.Sms, MfaFactor.Totp)
+            allowedFactors = listOf(MfaFactor.Sms, MfaFactor.Totp),
+            allowedCountries = listOf("US", "CA", "GB")
         )
         val backStack = rememberNavBackStack(MfaStepKey(MfaEnrollmentStep.SelectFactor))
-        val flowState = rememberMfaEnrollmentFlowState()
+        // Pass the restriction so the SMS step opens on a country the selector will offer. The
+        // screen also reconciles this itself, so a host that forgets cannot end up sending to an
+        // unpermitted dial code.
+        val flowState = rememberMfaEnrollmentFlowState(mfaConfig.allowedCountries)
 
         NavDisplay(
             backStack = backStack,

auth/src/main/java/com/firebase/ui/auth/configuration/MfaConfiguration.kt

@@ -14,6 +14,8 @@
 
 package com.firebase.ui.auth.configuration
 
+import com.firebase.ui.auth.util.CountryUtils
+
 /**
  * Configuration class for Multi-Factor Authentication (MFA) enrollment and verification behavior.
  *
@@ -25,14 +27,29 @@ package com.firebase.ui.auth.configuration
  * @property requireEnrollment Whether MFA enrollment is mandatory for all users.
  *                             When true, users must enroll in at least one MFA factor.
  *                             Defaults to false.
+ * @property allowedCountries ISO 3166-1 alpha-2 country codes the [MfaFactor.Sms] enrollment step
+ *                            restricts its country selector to, or `null` for no restriction. Dial
+ *                            codes are rejected: the filter behind this matches alpha-2 only, so a
+ *                            dial code would silently restrict to nothing. Lives here rather
+ *                            than on the phone sign-in provider because a second factor is
+ *                            configured independently of the first: Firebase enables SMS second
+ *                            factors separately from phone sign-in, and phone sign-in cannot carry
+ *                            a second factor at all. Defaults to null.
  */
 class MfaConfiguration(
     val allowedFactors: List<MfaFactor> = listOf(MfaFactor.Sms, MfaFactor.Totp),
-    val requireEnrollment: Boolean = false
+    val requireEnrollment: Boolean = false,
+    val allowedCountries: List<String>? = null
 ) {
     init {
         require(allowedFactors.isNotEmpty()) {
             "At least one MFA factor must be allowed"
         }
+        allowedCountries?.forEach { code ->
+            require(CountryUtils.findByCountryCode(code) != null) {
+                "Invalid country code: $code. allowedCountries takes ISO 3166-1 alpha-2 codes " +
+                        "(e.g. 'us', 'GB'). Dial codes are not accepted."
+            }
+        }
     }
 }

auth/src/main/java/com/firebase/ui/auth/configuration/auth_provider/AuthProvider.kt

@@ -273,11 +273,6 @@ abstract class AuthProvider(open val providerId: String, open val providerName:
          */
         val allowedCountries: List<String>?,
 
-        /**
-         * The expected length of the SMS verification code. Defaults to 6.
-         */
-        val smsCodeLength: Int = 6,
-
         /**
          * The timeout in seconds for receiving the SMS. Defaults to 60L.
          */

auth/src/main/java/com/firebase/ui/auth/mfa/MfaEnrollmentContentState.kt

@@ -69,6 +69,7 @@ import com.google.firebase.auth.MultiFactorInfo
  * @property phoneNumber (Step: [MfaEnrollmentStep.ConfigureSms]) The current value of the phone number input field. Does not include country code prefix.
  * @property onPhoneNumberChange (Step: [MfaEnrollmentStep.ConfigureSms]) Callback invoked when the phone number input changes. Receives the new phone number string.
  * @property selectedCountry (Step: [MfaEnrollmentStep.ConfigureSms]) The currently selected country for phone number formatting. Contains dial code, country code, and flag.
+ * @property allowedCountries (Step: [MfaEnrollmentStep.ConfigureSms]) Country codes the selector is restricted to, or `null` for no restriction. Determined by [com.firebase.ui.auth.configuration.MfaConfiguration.allowedCountries].
  * @property onCountrySelected (Step: [MfaEnrollmentStep.ConfigureSms]) Callback invoked when the user selects a different country. Receives the new [CountryData].
  * @property onSendSmsCodeClick (Step: [MfaEnrollmentStep.ConfigureSms]) Callback to send the SMS verification code to the entered phone number.
  *
@@ -119,6 +120,8 @@ data class MfaEnrollmentContentState(
 
     val selectedCountry: CountryData? = null,
 
+    val allowedCountries: List<String>? = null,
+
     val onCountrySelected: (CountryData) -> Unit = {},
 
     val onSendSmsCodeClick: () -> Unit = {},

auth/src/main/java/com/firebase/ui/auth/mfa/SmsEnrollmentHandler.kt

@@ -72,7 +72,6 @@ class SmsEnrollmentHandler(
         defaultNumber = null,
         defaultCountryCode = null,
         allowedCountries = null,
-        smsCodeLength = SMS_CODE_LENGTH,
         timeout = VERIFICATION_TIMEOUT_SECONDS,
         isInstantVerificationEnabled = true
     )

auth/src/main/java/com/firebase/ui/auth/ui/screens/FirebaseAuthScreen.kt

@@ -197,7 +197,7 @@ fun FirebaseAuthScreen(
     val lastSuccessfulUserId = remember { mutableStateOf<String?>(null) }
     val pendingLinkingCredential = remember { mutableStateOf<AuthCredential?>(null) }
     val pendingResolver = remember { mutableStateOf<MultiFactorResolver?>(null) }
-    val mfaEnrollmentFlowState = rememberMfaEnrollmentFlowState()
+    val mfaEnrollmentFlowState = rememberMfaEnrollmentFlowState(mfaConfiguration.allowedCountries)
     val phoneAuthFlowState = rememberPhoneAuthFlowState(configuration)
     val reauthRequest = reauthState?.request
     val reauthConfig = reauthRequest?.let { configuration.toReauthConfiguration(it.user) }

auth/src/main/java/com/firebase/ui/auth/ui/screens/mfa/MfaEnrollmentDefaults.kt

@@ -160,6 +160,9 @@ internal fun DefaultMfaEnrollmentContent(
                         onPhoneNumberChange = state.onPhoneNumberChange,
                         onCountrySelected = state.onCountrySelected,
                         onSendCodeClick = state.onSendSmsCodeClick,
+                        allowedCountries = remember(state.allowedCountries) {
+                            state.allowedCountries?.toSet()
+                        },
                         title = stringProvider.mfaEnrollmentEnterPhoneNumber
                     )
                 }