Flycro/laravel-nuxt-ui-inertia-template
Template
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(auth): harden authentication and add configurable two-factor support

Browse Source
This commit is contained in:
Flycro
2026-07-31 03:12:46 +02:00
parent 235d5f646c
commit e47243f7dc
51 changed files with 2904 additions and 1359 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
tests/Feature/Auth/TwoFactorAuthenticationTest.php
View File

@@ -1,8 +1,11 @@
<?php
use App\Models\User;
use App\Notifications\TwoFactorFailedNotification;
use App\Notifications\TwoFactorSecurityNotification;
use Database\Seeders\DatabaseSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Notification;
use Inertia\Testing\AssertableInertia as Assert;
use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
use Laravel\Fortify\Features;
@@ -18,7 +21,11 @@ beforeEach(function () {
'auth-ui.features.two_factor' => true,
'auth-ui.features.two_factor_required' => false,
'fortify.features' => [Features::twoFactorAuthentication()],
'fortify-options.two-factor-authentication' => ['confirm' => true],
'fortify-options.two-factor-authentication' => [
'confirm' => true,
'secret-length' => 32,
'window' => 0,
],
'auth-ui.providers.github' => [
'label' => 'GitHub',
'icon' => 'i-simple-icons-github',
@@ -81,12 +88,19 @@ it('redirects authenticated users to enrollment when two-factor setup is mandato
$this->actingAs($user)
->get('/dashboard')
->assertRedirect('/profile')
->assertRedirect('/two-factor-setup')
->assertSessionHas('error', 'Two-factor authentication is required before you can continue.');
$this->actingAs($user)
->get('/two-factor-setup')
->assertInertia(fn (Assert $page) => $page
->component('Auth/TwoFactorSetup')
->where('twoFactor.enabled', false)
->where('twoFactor.pending', false));
$this->actingAs($user)
->get('/profile')
->assertOk();
->assertRedirect('/two-factor-setup');
$this->actingAs($user)
->post('/logout')
@@ -94,20 +108,63 @@ it('redirects authenticated users to enrollment when two-factor setup is mandato
$this->assertGuest();
});
it('sends a password user directly to setup after login when enrollment is mandatory', function () {
config(['auth-ui.features.two_factor_required' => true]);
$user = User::factory()->create([
'email' => 'setup@example.com',
'password' => 'password123',
]);
$this->post('/login', [
'login' => 'setup@example.com',
'password' => 'password123',
])->assertRedirect('/two-factor-setup');
$this->assertAuthenticatedAs($user);
expect(session('url.intended'))->toEndWith('/dashboard');
});
it('keeps application access restricted while mandatory enrollment is pending', function () {
config(['auth-ui.features.two_factor_required' => true]);
$user = User::factory()->create(['password' => 'password123']);
$this->actingAs($user)
->post('/profile/two-factor', ['password' => 'password123'])
->assertRedirect('/profile');
->post('/two-factor-setup', ['password' => 'password123'])
->assertRedirect('/two-factor-setup');
expect($user->fresh()->two_factor_secret)->not->toBeNull()
->and($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
$this->actingAs($user)
->get('/dashboard')
->assertRedirect('/profile');
->assertRedirect('/two-factor-setup');
});
it('shows recovery codes before continuing after mandatory setup', function () {
config(['auth-ui.features.two_factor_required' => true]);
$user = User::factory()->create();
app(EnableTwoFactorAuthentication::class)($user);
$user->refresh();
$secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
$code = app(Google2FA::class)->getCurrentOtp($secret);
$this->actingAs($user)
->withSession(['url.intended' => '/dashboard'])
->post('/two-factor-setup/confirm', ['code' => $code])
->assertRedirect('/two-factor-setup')
->assertSessionHas('recoveryCodes', fn (array $codes) => count($codes) === 8);
$this->actingAs($user->fresh())
->get('/two-factor-setup')
->assertInertia(fn (Assert $page) => $page
->component('Auth/TwoFactorSetup')
->where('twoFactor.enabled', true));
$this->actingAs($user->fresh())
->withSession(['url.intended' => '/dashboard'])
->get('/two-factor-setup/complete')
->assertRedirect('/dashboard');
});
it('allows normal access after mandatory enrollment is complete', function () {
@@ -120,6 +177,21 @@ it('allows normal access after mandatory enrollment is complete', function () {
->assertOk();
});
it('does not allow mandatory two-factor authentication to be disabled', function () {
config(['auth-ui.features.two_factor_required' => true]);
$user = User::factory()->create(['password' => 'password123']);
$twoFactor = enableTwoFactorForTest($user);
$this->actingAs($user)
->delete('/profile/two-factor', [
'password' => 'password123',
'code' => $twoFactor['code'],
])
->assertForbidden();
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
});
it('does not enforce the mandatory flag while the main two-factor feature is disabled', function () {
config([
'auth-ui.features.two_factor' => false,
@@ -131,6 +203,20 @@ it('does not enforce the mandatory flag while the main two-factor feature is dis
->assertOk();
});
it('does not expose mandatory setup endpoints when enrollment is optional', function () {
$user = User::factory()->create(['password' => 'password123']);
$this->actingAs($user)
->get('/two-factor-setup')
->assertNotFound();
$this->actingAs($user)
->post('/two-factor-setup', ['password' => 'password123'])
->assertNotFound();
expect($user->fresh()->two_factor_secret)->toBeNull();
});
it('blocks authenticated API requests until mandatory enrollment is complete', function () {
config(['auth-ui.features.two_factor_required' => true]);
$user = User::factory()->create();
@@ -140,7 +226,7 @@ it('blocks authenticated API requests until mandatory enrollment is complete', f
->assertForbidden()
->assertJson([
'message' => 'Two-factor authentication setup is required.',
'setup_url' => route('profile.show'),
'setup_url' => route('two-factor.setup'),
]);
enableTwoFactorForTest($user);
@@ -195,6 +281,7 @@ it('confirms enrollment and returns recovery codes once', function () {
});
it('holds password login until a valid authenticator code is supplied', function () {
Notification::fake();
$user = User::factory()->create([
'email' => 'test@example.com',
'password' => 'password123',
@@ -216,6 +303,7 @@ it('holds password login until a valid authenticator code is supplied', function
$this->post('/two-factor-challenge', ['code' => '000000'])
->assertSessionHasErrors('code');
$this->assertGuest();
Notification::assertSentTo($user, TwoFactorFailedNotification::class);
$challengeResponse = $this->post('/two-factor-challenge', ['code' => $twoFactor['code']]);
$challengeResponse->assertRedirect('/dashboard');
@@ -283,6 +371,94 @@ it('requires a valid second factor for social-only users to disable protection',
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
});
it('requires both password and second factor for password users to disable protection', function () {
Notification::fake();
$user = User::factory()->create(['password' => 'password123']);
$twoFactor = enableTwoFactorForTest($user);
$this->actingAs($user)
->delete('/profile/two-factor', ['password' => 'password123'])
->assertSessionHasErrors('code');
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
$this->actingAs($user)
->delete('/profile/two-factor', [
'password' => 'password123',
'code' => $twoFactor['code'],
])
->assertRedirect('/profile');
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
Notification::assertSentTo($user, TwoFactorSecurityNotification::class);
});
it('requires both password and second factor to reveal recovery codes', function () {
$user = User::factory()->create(['password' => 'password123']);
$twoFactor = enableTwoFactorForTest($user);
$this->actingAs($user)
->post('/profile/two-factor/recovery-codes', [
'password' => 'password123',
'regenerate' => false,
])
->assertSessionHasErrors('code');
$this->actingAs($user)
->post('/profile/two-factor/recovery-codes', [
'password' => 'password123',
'code' => $twoFactor['code'],
'regenerate' => false,
])
->assertRedirect('/profile')
->assertSessionHas('recoveryCodes');
});
it('expires an unfinished second-factor login after five minutes', function () {
$user = User::factory()->create([
'email' => 'expires@example.com',
'password' => 'password123',
]);
enableTwoFactorForTest($user);
$this->post('/login', [
'login' => 'expires@example.com',
'password' => 'password123',
])->assertRedirect('/two-factor-challenge');
$this->travel(301)->seconds();
$this->get('/two-factor-challenge')
->assertRedirect('/login')
->assertSessionMissing('login.id')
->assertSessionMissing('login.started_at');
});
it('does not accept the same TOTP twice', function () {
$user = User::factory()->create([
'email' => 'replay@example.com',
'password' => 'password123',
]);
$twoFactor = enableTwoFactorForTest($user);
$this->post('/login', [
'login' => 'replay@example.com',
'password' => 'password123',
])->assertRedirect('/two-factor-challenge');
$this->post('/two-factor-challenge', ['code' => $twoFactor['code']])
->assertRedirect('/dashboard');
$this->post('/logout');
$this->post('/login', [
'login' => 'replay@example.com',
'password' => 'password123',
])->assertRedirect('/two-factor-challenge');
$this->post('/two-factor-challenge', ['code' => $twoFactor['code']])
->assertSessionHasErrors('code');
$this->assertGuest();
});
it('consumes recovery codes used to authorize a sensitive settings action', function () {
$user = User::factory()->social()->create();
$twoFactor = enableTwoFactorForTest($user);