145 lines
6.3 KiB
Go
145 lines
6.3 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package webtests
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"code.vikunja.io/api/pkg/user"
|
|
|
|
"github.com/pquerna/otp/totp"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// testuser14 is a non-local (OIDC) account; totp is local-only, so every totp
|
|
// route must refuse it. See pkg/db/fixtures/users.yml.
|
|
var testuser14 = user.User{ID: 14, Username: "user14", Issuer: "https://some.service.com"}
|
|
|
|
// TestHumaTOTP mirrors v1's TestUserTOTPLocalUser and adds the enable/disable
|
|
// flows, the qr-code blob endpoint, and the local-account-only guard.
|
|
//
|
|
// Fixture topology (pkg/db/fixtures/totp.yml + users.yml):
|
|
// - user1: totp enrolled, not enabled (secret HXDMVJEC…).
|
|
// - user10: totp enabled (secret JBSWY3DP…), local, password 12345678.
|
|
// - user15: local, no totp enrollment.
|
|
// - user14: non-local (OIDC) account.
|
|
func TestHumaTOTP(t *testing.T) {
|
|
t.Run("Get status for enrolled user", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user/settings/totp", "", humaTokenFor(t, &testuser1), "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"secret"`)
|
|
assert.Contains(t, rec.Body.String(), `"enabled":false`)
|
|
})
|
|
|
|
t.Run("Get status without enrollment returns 412", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user/settings/totp", "", humaTokenFor(t, &testuser15), "")
|
|
require.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
|
|
t.Run("Get qr code for enrolled user", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user/settings/totp/qrcode", "", humaTokenFor(t, &testuser1), "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Equal(t, "image/jpeg", rec.Header().Get("Content-Type"))
|
|
assert.NotEmpty(t, rec.Body.Bytes(), "the qr code jpeg must have bytes")
|
|
})
|
|
|
|
t.Run("Enroll a fresh user", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
// user15 has no totp enrollment in the fixtures.
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/enroll", "", humaTokenFor(t, &testuser15), "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"secret"`)
|
|
assert.Contains(t, rec.Body.String(), `"url"`)
|
|
assert.Contains(t, rec.Body.String(), `"enabled":false`)
|
|
})
|
|
|
|
t.Run("Enroll when already enrolled returns 412", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/enroll", "", humaTokenFor(t, &testuser1), "")
|
|
require.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
|
|
t.Run("Enable with a valid passcode", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
// user1's fixture secret; generate a passcode that is valid right now.
|
|
passcode, err := totp.GenerateCode("HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ", time.Now())
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/enable",
|
|
fmt.Sprintf(`{"passcode":%q}`, passcode), humaTokenFor(t, &testuser1), "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), "enabled successfully")
|
|
})
|
|
|
|
t.Run("Enable with an invalid passcode returns 412", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/enable",
|
|
`{"passcode":"000000"}`, humaTokenFor(t, &testuser1), "")
|
|
require.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
|
|
t.Run("Disable with the correct password", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
// user10 has totp enabled; 12345678 is their fixture password.
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/disable",
|
|
`{"password":"12345678"}`, humaTokenFor(t, &testuser10), "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), "disabled successfully")
|
|
})
|
|
|
|
t.Run("Disable with a wrong password is refused", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/settings/totp/disable",
|
|
`{"password":"wrong-password"}`, humaTokenFor(t, &testuser10), "")
|
|
require.NotEqual(t, http.StatusOK, rec.Code, "wrong password must not disable totp; body: %s", rec.Body.String())
|
|
})
|
|
|
|
t.Run("Non-local user is refused on every route", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser14)
|
|
for _, tc := range []struct {
|
|
method, path, body string
|
|
}{
|
|
{http.MethodGet, "/api/v2/user/settings/totp", ""},
|
|
{http.MethodGet, "/api/v2/user/settings/totp/qrcode", ""},
|
|
{http.MethodPost, "/api/v2/user/settings/totp/enroll", ""},
|
|
{http.MethodPost, "/api/v2/user/settings/totp/enable", `{"passcode":"000000"}`},
|
|
{http.MethodPost, "/api/v2/user/settings/totp/disable", `{"password":"12345678"}`},
|
|
} {
|
|
rec := humaRequest(t, e, tc.method, tc.path, tc.body, token, "")
|
|
assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
|
|
"%s %s must refuse a non-local account; body: %s", tc.method, tc.path, rec.Body.String())
|
|
}
|
|
})
|
|
}
|