feat: Add FoD Session MFA Code Request Command

fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/output/cli/mixin/FoDOutputHelperMixins.java

@@ -110,4 +110,9 @@ public static class GetConfigLegacy extends OutputHelperMixins.DetailsNoQuery {
     public static class UploadFile extends OutputHelperMixins.TableNoQuery {
         public static final String CMD_NAME = "upload-file";
     }
+
+    @Command(aliases = "mfa")
+    public static class RequestMfaCode extends OutputHelperMixins.TableNoQuery {
+        public static final String CMD_NAME = "request-mfa-code";
+    }
 }

fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/session/cli/cmd/FoDSessionCommands.java

@@ -21,7 +21,8 @@
         subcommands = {
                 FoDSessionListCommand.class,
                 FoDSessionLoginCommand.class,
-                FoDSessionLogoutCommand.class 
+                FoDSessionLogoutCommand.class,
+                FoDSessionRequestMfaCodeCommand.class 
         }
 )
 public class FoDSessionCommands extends AbstractContainerCommand {

fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/session/cli/cmd/FoDSessionRequestMfaCodeCommand.java

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.fod._common.session.cli.cmd;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fortify.cli.common.log.LogSensitivityLevel;
+import com.fortify.cli.common.log.MaskValue;
+import com.fortify.cli.common.output.cli.cmd.AbstractOutputCommand;
+import com.fortify.cli.common.output.cli.cmd.IJsonNodeSupplier;
+import com.fortify.cli.common.output.transform.IActionCommandResultSupplier;
+import com.fortify.cli.common.session.cli.mixin.UserCredentialOptions;
+import com.fortify.cli.fod._common.output.cli.mixin.FoDOutputHelperMixins;
+import com.fortify.cli.fod._common.rest.helper.FoDProductHelper;
+import com.fortify.cli.fod._common.session.cli.mixin.FoDSessionLoginOptions;
+import com.fortify.cli.fod._common.session.helper.FoDMfaDeliveryType;
+import com.fortify.cli.fod._common.session.helper.FoDMfaHelper;
+
+import lombok.Getter;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+/**
+ * Command for requesting a Multi-Factor Authentication (MFA) code via Email or SMS.
+ * @author Sangamesh Vijaykumar
+ */
+@Command(name = FoDOutputHelperMixins.RequestMfaCode.CMD_NAME, sortOptions = false)
+public class FoDSessionRequestMfaCodeCommand extends AbstractOutputCommand implements IJsonNodeSupplier, IActionCommandResultSupplier {
+    @Getter @Mixin private FoDOutputHelperMixins.RequestMfaCode outputHelper;
+    @Mixin private FoDSessionLoginOptions.FoDUrlConfigOptions urlConfigOptions;
+    @Mixin private UserCredentialOptions userCredentials;
+    @Option(names = {"-t", "--tenant"}, required = true)
+    @MaskValue(sensitivity = LogSensitivityLevel.low, description = "FOD TENANT")
+    private String tenant;
+    @Option(names = {"--delivery-mode", "-m"}, required = true)
+    private FoDMfaDeliveryType deliveryMode;
+
+    @Override
+    public JsonNode getJsonNode() {
+        FoDMfaHelper.requestMfaCode(
+            urlConfigOptions,
+            tenant,
+            userCredentials.getUser(),
+            userCredentials.getPassword(),
+            deliveryMode
+        );
+
+        String fodUrl = FoDProductHelper.INSTANCE.getBrowserUrl(urlConfigOptions.getUrl());
+
+        ObjectNode result = com.fortify.cli.common.json.JsonHelper.getObjectMapper().createObjectNode();
+        result.put("fodUrl", fodUrl);
+        result.put("deliveryMode", deliveryMode.name());
+        return result;
+    }
+
+    @Override
+    public boolean isSingular() {
+        return true;
+    }
+
+    @Override
+    public String getActionCommandResult() {
+        return "REQUESTED";
+    }
+}

fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/session/helper/FoDMfaDeliveryType.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.fod._common.session.helper;
+
+import com.formkiq.graalvm.annotations.Reflectable;
+
+/**
+ * Enum representing the delivery types for Multi-Factor Authentication (MFA) codes in Fortify on Demand (FoD).
+ * @author Sangamesh Vijaykumar
+ */
+@Reflectable
+public enum FoDMfaDeliveryType {
+    Email("EmailDelivery"),
+    SMS("SMSDelivery");
+
+    private final String apiValue;
+
+    FoDMfaDeliveryType(String apiValue) {
+        this.apiValue = apiValue;
+    }
+
+    public String getApiValue() {
+        return apiValue;
+    }
+}

fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/session/helper/FoDMfaHelper.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.fod._common.session.helper;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fortify.cli.common.exception.FcliSimpleException;
+import com.fortify.cli.common.http.proxy.helper.ProxyHelper;
+import com.fortify.cli.common.json.JsonHelper;
+import com.fortify.cli.common.rest.unirest.HttpHeader;
+import com.fortify.cli.common.rest.unirest.UnexpectedHttpResponseException;
+import com.fortify.cli.common.rest.unirest.UnirestHelper;
+import com.fortify.cli.common.rest.unirest.config.IUrlConfig;
+import com.fortify.cli.common.rest.unirest.config.UnirestJsonHeaderConfigurer;
+import com.fortify.cli.common.rest.unirest.config.UnirestUnexpectedHttpResponseConfigurer;
+import com.fortify.cli.common.rest.unirest.config.UnirestUrlConfigConfigurer;
+
+import kong.unirest.UnirestInstance;
+
+/**
+ * Helper class for requesting Multi-Factor Authentication (MFA) codes in Fortify on Demand (FoD). 
+ * @author Sangamesh Vijaykumar
+ */
+public class FoDMfaHelper {
+
+    public static final void requestMfaCode(IUrlConfig urlConfig, String tenant, String user, char[] password, FoDMfaDeliveryType deliveryType) {
+        try ( var unirest = UnirestHelper.createUnirestInstance() ) {
+            configureUnirest(unirest, urlConfig);
+
+            ObjectNode requestBody = JsonHelper.getObjectMapper().createObjectNode();
+            requestBody.put("multiFactorAuthorizationType", deliveryType.getApiValue());
+            requestBody.put("username", String.format("%s\\%s", tenant, user));
+            requestBody.put("password", String.valueOf(password));
+
+            unirest.post("/api/v3/multi-factor-authorization-code")
+                    .headerReplace(HttpHeader.ACCEPT, "application/json")
+                    .headerReplace(HttpHeader.CONTENT_TYPE, "application/json")
+                    .body(requestBody)
+                    .asEmpty();
+
+            //security hardening
+            java.util.Arrays.fill(password, ' ');  // Clear original char array
+        } catch ( UnexpectedHttpResponseException e ) {
+            if ( e.getStatus() == 400 ) {
+                throw new FcliSimpleException(
+                    "MFA is not enabled for this tenant, or the provided credentials are invalid."
+                    + " Contact your FoD administrator, then try again."
+                );
+            } else if ( e.getStatus() == 401 || e.getStatus() == 403 ) {
+                throw new FcliSimpleException(
+                    "Authentication failed: invalid username, tenant, or password."
+                );
+            }
+            throw e;
+        }
+    }
+
+    private static void configureUnirest(UnirestInstance unirest, IUrlConfig urlConfig) {
+        UnirestUnexpectedHttpResponseConfigurer.configure(unirest);
+        UnirestUrlConfigConfigurer.configure(unirest, urlConfig);
+        ProxyHelper.configureProxy(unirest, "fod", urlConfig.getUrl());
+        UnirestJsonHeaderConfigurer.configure(unirest);
+    }
+}

fcli-core/fcli-fod/src/main/resources/com/fortify/cli/fod/i18n/FoDMessages.properties

@@ -137,6 +137,20 @@ fcli.fod.session.list.usage.description = This command lists all FoD sessions cr
   is shown based on locally cached token expiry data. Use '--validate' to verify the actual session \
   status against FoD.
 
+fcli.fod.session.request-mfa-code.usage.header = Request Multi-Factor Authentication code via Email or SMS.
+fcli.fod.session.request-mfa-code.usage.description = Triggers FoD to send a multi-factor authentication \
+  code to the specified delivery method for the given tenant and user. Use the received code with \
+  'fcli fod session login --code <code>' to complete authentication.
+fcli.fod.session.request-mfa-code.url = FoD URL, for example https://emea.fortify.com/.
+fcli.fod.session.request-mfa-code.tenant = FoD tenant name.
+fcli.fod.session.request-mfa-code.user = FoD username.
+fcli.fod.session.request-mfa-code.password = FoD password.
+fcli.fod.session.request-mfa-code.delivery-mode = Delivery method for the MFA code. Valid values: ${COMPLETION-CANDIDATES}.
+fcli.fod.session.request-mfa-code.header = Repeatable option to add custom HTTP headers in requests to FoD, in format `NAME: VALUE`.
+fcli.fod.session.request-mfa-code.output.table.args = fodUrl,deliveryMode
+fcli.fod.session.request-mfa-code.output.table.header.fodUrl = FoD URL
+fcli.fod.session.request-mfa-code.output.table.header.deliveryMode = Delivery Mode
+
 # fcli fod rest
 fcli.fod.rest.usage.header = Interact with FoD REST API endpoints.
 fcli.fod.rest.usage.description = These commands allow for direct interaction with FoD REST API endpoints, \