488 lines
16 KiB
PHP
488 lines
16 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
use App\Notifications\TwoFactorFailedNotification;
|
|
use App\Notifications\TwoFactorSecurityNotification;
|
|
use Database\Seeders\DatabaseSeeder;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Notification;
|
|
use Inertia\Testing\AssertableInertia as Assert;
|
|
use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
|
|
use Laravel\Fortify\Features;
|
|
use Laravel\Fortify\Fortify;
|
|
use Laravel\Socialite\Facades\Socialite;
|
|
use Laravel\Socialite\Two\User as SocialiteUser;
|
|
use PragmaRX\Google2FA\Google2FA;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
config([
|
|
'auth-ui.features.two_factor' => true,
|
|
'auth-ui.features.two_factor_required' => false,
|
|
'fortify.features' => [Features::twoFactorAuthentication()],
|
|
'fortify-options.two-factor-authentication' => [
|
|
'confirm' => true,
|
|
'secret-length' => 32,
|
|
'window' => 0,
|
|
],
|
|
'auth-ui.providers.github' => [
|
|
'label' => 'GitHub',
|
|
'icon' => 'i-simple-icons-github',
|
|
'enabled' => true,
|
|
],
|
|
]);
|
|
});
|
|
|
|
function enableTwoFactorForTest(User $user): array
|
|
{
|
|
app(EnableTwoFactorAuthentication::class)($user);
|
|
$user->forceFill(['two_factor_confirmed_at' => now()])->save();
|
|
$user->refresh();
|
|
|
|
$secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
|
|
|
|
return [
|
|
'code' => app(Google2FA::class)->getCurrentOtp($secret),
|
|
'recovery_codes' => $user->recoveryCodes(),
|
|
];
|
|
}
|
|
|
|
it('keeps profile security available while two-factor settings are disabled', function () {
|
|
config(['auth-ui.features.two_factor' => false]);
|
|
|
|
$this->actingAs(User::factory()->create())
|
|
->get('/profile/security')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Profile/Security')
|
|
->where('twoFactor.available', false)
|
|
->where('twoFactor.enabled', false)
|
|
->where('twoFactor.pending', false));
|
|
});
|
|
|
|
it('redirects the former security page to profile security', function () {
|
|
$this->actingAs(User::factory()->create())
|
|
->get('/security')
|
|
->assertRedirect('/profile/security');
|
|
});
|
|
|
|
it('bypasses stored two-factor configuration when the feature is disabled', function () {
|
|
$user = User::factory()->create([
|
|
'email' => 'test@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
enableTwoFactorForTest($user);
|
|
config(['auth-ui.features.two_factor' => false]);
|
|
|
|
$this->post('/login', [
|
|
'login' => 'test@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/dashboard');
|
|
|
|
$this->assertAuthenticatedAs($user);
|
|
});
|
|
|
|
it('redirects authenticated users to enrollment when two-factor setup is mandatory', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user)
|
|
->get('/dashboard')
|
|
->assertRedirect('/two-factor-setup')
|
|
->assertSessionHas('error', 'Two-factor authentication is required before you can continue.');
|
|
|
|
$this->actingAs($user)
|
|
->get('/two-factor-setup')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Auth/TwoFactorSetup')
|
|
->where('twoFactor.enabled', false)
|
|
->where('twoFactor.pending', false));
|
|
|
|
$this->actingAs($user)
|
|
->get('/profile')
|
|
->assertRedirect('/two-factor-setup');
|
|
|
|
$this->actingAs($user)
|
|
->post('/logout')
|
|
->assertRedirect('/');
|
|
$this->assertGuest();
|
|
});
|
|
|
|
it('sends a password user directly to setup after login when enrollment is mandatory', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create([
|
|
'email' => 'setup@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
|
|
$this->post('/login', [
|
|
'login' => 'setup@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/two-factor-setup');
|
|
|
|
$this->assertAuthenticatedAs($user);
|
|
expect(session('url.intended'))->toEndWith('/dashboard');
|
|
});
|
|
|
|
it('keeps application access restricted while mandatory enrollment is pending', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
|
|
$this->actingAs($user)
|
|
->post('/two-factor-setup', ['password' => 'password123'])
|
|
->assertRedirect('/two-factor-setup');
|
|
|
|
expect($user->fresh()->two_factor_secret)->not->toBeNull()
|
|
->and($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
|
|
|
|
$this->actingAs($user)
|
|
->get('/dashboard')
|
|
->assertRedirect('/two-factor-setup');
|
|
});
|
|
|
|
it('shows recovery codes before continuing after mandatory setup', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create();
|
|
app(EnableTwoFactorAuthentication::class)($user);
|
|
$user->refresh();
|
|
|
|
$secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
|
|
$code = app(Google2FA::class)->getCurrentOtp($secret);
|
|
|
|
$this->actingAs($user)
|
|
->withSession(['url.intended' => '/dashboard'])
|
|
->post('/two-factor-setup/confirm', ['code' => $code])
|
|
->assertRedirect('/two-factor-setup')
|
|
->assertSessionHas('recoveryCodes', fn (array $codes) => count($codes) === 8);
|
|
|
|
$this->actingAs($user->fresh())
|
|
->get('/two-factor-setup')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Auth/TwoFactorSetup')
|
|
->where('twoFactor.enabled', true));
|
|
|
|
$this->actingAs($user->fresh())
|
|
->withSession(['url.intended' => '/dashboard'])
|
|
->get('/two-factor-setup/complete')
|
|
->assertRedirect('/dashboard');
|
|
});
|
|
|
|
it('allows normal access after mandatory enrollment is complete', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create();
|
|
enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user)
|
|
->get('/dashboard')
|
|
->assertOk();
|
|
});
|
|
|
|
it('does not allow mandatory two-factor authentication to be disabled', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user)
|
|
->delete('/profile/two-factor', [
|
|
'password' => 'password123',
|
|
'code' => $twoFactor['code'],
|
|
])
|
|
->assertForbidden();
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
|
|
});
|
|
|
|
it('does not enforce the mandatory flag while the main two-factor feature is disabled', function () {
|
|
config([
|
|
'auth-ui.features.two_factor' => false,
|
|
'auth-ui.features.two_factor_required' => true,
|
|
]);
|
|
|
|
$this->actingAs(User::factory()->create())
|
|
->get('/dashboard')
|
|
->assertOk();
|
|
});
|
|
|
|
it('does not expose mandatory setup endpoints when enrollment is optional', function () {
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
|
|
$this->actingAs($user)
|
|
->get('/two-factor-setup')
|
|
->assertNotFound();
|
|
|
|
$this->actingAs($user)
|
|
->post('/two-factor-setup', ['password' => 'password123'])
|
|
->assertNotFound();
|
|
|
|
expect($user->fresh()->two_factor_secret)->toBeNull();
|
|
});
|
|
|
|
it('blocks authenticated API requests until mandatory enrollment is complete', function () {
|
|
config(['auth-ui.features.two_factor_required' => true]);
|
|
$user = User::factory()->create();
|
|
|
|
$this->actingAs($user)
|
|
->getJson('/api/user')
|
|
->assertForbidden()
|
|
->assertJson([
|
|
'message' => 'Two-factor authentication setup is required.',
|
|
'setup_url' => route('two-factor.setup'),
|
|
]);
|
|
|
|
enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user->fresh())
|
|
->getJson('/api/user')
|
|
->assertOk()
|
|
->assertJsonPath('id', $user->id);
|
|
});
|
|
|
|
it('requires the current password before a password user can enroll', function () {
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor', ['password' => 'wrong-password'])
|
|
->assertSessionHasErrors('password');
|
|
|
|
expect($user->fresh()->two_factor_secret)->toBeNull();
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor', ['password' => 'password123'])
|
|
->assertRedirect('/profile/security');
|
|
|
|
expect($user->fresh()->two_factor_secret)->not->toBeNull()
|
|
->and($user->fresh()->two_factor_confirmed_at)->toBeNull();
|
|
|
|
$this->actingAs($user)
|
|
->get('/profile/security')
|
|
->assertInertia(fn (Assert $page) => $page
|
|
->component('Profile/Security')
|
|
->where('twoFactor.pending', true)
|
|
->where('twoFactor.enabled', false)
|
|
->where('twoFactor.requiresPassword', true)
|
|
->where('twoFactor.qrCodeDataUri', fn ($value) => str_starts_with($value, 'data:image/svg+xml;base64,'))
|
|
->where('twoFactor.secretKey', fn ($value) => filled($value)));
|
|
});
|
|
|
|
it('confirms enrollment and returns recovery codes once', function () {
|
|
$user = User::factory()->create();
|
|
app(EnableTwoFactorAuthentication::class)($user);
|
|
$user->refresh();
|
|
|
|
$secret = Fortify::currentEncrypter()->decrypt($user->two_factor_secret);
|
|
$code = app(Google2FA::class)->getCurrentOtp($secret);
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor/confirm', ['code' => $code])
|
|
->assertRedirect('/profile/security')
|
|
->assertSessionHas('recoveryCodes', fn (array $codes) => count($codes) === 8);
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
|
|
});
|
|
|
|
it('holds password login until a valid authenticator code is supplied', function () {
|
|
Notification::fake();
|
|
$user = User::factory()->create([
|
|
'email' => 'test@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$loginResponse = $this->post('/login', [
|
|
'login' => 'test@example.com',
|
|
'password' => 'password123',
|
|
'remember' => true,
|
|
]);
|
|
$loginResponse->assertRedirect('/two-factor-challenge');
|
|
|
|
$this->assertGuest();
|
|
$loginResponse->assertSessionHas('login.id', $user->id);
|
|
$this->get('/two-factor-challenge')
|
|
->assertInertia(fn (Assert $page) => $page->component('Auth/TwoFactorChallenge'));
|
|
|
|
$this->post('/two-factor-challenge', ['code' => '000000'])
|
|
->assertSessionHasErrors('code');
|
|
$this->assertGuest();
|
|
Notification::assertSentTo($user, TwoFactorFailedNotification::class);
|
|
|
|
$challengeResponse = $this->post('/two-factor-challenge', ['code' => $twoFactor['code']]);
|
|
$challengeResponse->assertRedirect('/dashboard');
|
|
|
|
$this->assertAuthenticatedAs($user);
|
|
$challengeResponse->assertSessionMissing('login.id');
|
|
});
|
|
|
|
it('accepts a recovery code once and replaces it after login', function () {
|
|
$user = User::factory()->create([
|
|
'email' => 'test@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
$recoveryCode = $twoFactor['recovery_codes'][0];
|
|
|
|
$this->post('/login', [
|
|
'login' => 'test@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/two-factor-challenge');
|
|
|
|
$this->post('/two-factor-challenge', ['recovery_code' => $recoveryCode])
|
|
->assertRedirect('/dashboard');
|
|
|
|
$this->assertAuthenticatedAs($user);
|
|
expect($user->fresh()->recoveryCodes())->not->toContain($recoveryCode);
|
|
});
|
|
|
|
it('holds an existing social login at the same two-factor challenge', function () {
|
|
$user = User::factory()->social()->create();
|
|
$user->socialAccounts()->create([
|
|
'provider' => 'github',
|
|
'provider_id' => 'github-2fa',
|
|
]);
|
|
enableTwoFactorForTest($user);
|
|
|
|
Socialite::fake('github', (new SocialiteUser)->map([
|
|
'id' => 'github-2fa',
|
|
'name' => 'Social User',
|
|
'email' => $user->email,
|
|
'nickname' => $user->username,
|
|
]));
|
|
|
|
$response = $this->get('/auth/github/callback');
|
|
$response->assertRedirect('/two-factor-challenge');
|
|
|
|
$this->assertGuest();
|
|
$response->assertSessionHas('login.id', $user->id);
|
|
});
|
|
|
|
it('requires a valid second factor for social-only users to disable protection', function () {
|
|
$user = User::factory()->social()->create();
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user)
|
|
->delete('/profile/two-factor', ['code' => 'invalid'])
|
|
->assertSessionHasErrors('code');
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
|
|
|
|
$this->actingAs($user)
|
|
->delete('/profile/two-factor', ['code' => $twoFactor['code']])
|
|
->assertRedirect('/profile/security');
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
|
|
});
|
|
|
|
it('requires both password and second factor for password users to disable protection', function () {
|
|
Notification::fake();
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user)
|
|
->delete('/profile/two-factor', ['password' => 'password123'])
|
|
->assertSessionHasErrors('code');
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
|
|
|
|
$this->actingAs($user)
|
|
->delete('/profile/two-factor', [
|
|
'password' => 'password123',
|
|
'code' => $twoFactor['code'],
|
|
])
|
|
->assertRedirect('/profile/security');
|
|
|
|
expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
|
|
Notification::assertSentTo($user, TwoFactorSecurityNotification::class);
|
|
});
|
|
|
|
it('requires both password and second factor to reveal recovery codes', function () {
|
|
$user = User::factory()->create(['password' => 'password123']);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor/recovery-codes', [
|
|
'password' => 'password123',
|
|
'regenerate' => false,
|
|
])
|
|
->assertSessionHasErrors('code');
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor/recovery-codes', [
|
|
'password' => 'password123',
|
|
'code' => $twoFactor['code'],
|
|
'regenerate' => false,
|
|
])
|
|
->assertRedirect('/profile/security')
|
|
->assertSessionHas('recoveryCodes');
|
|
});
|
|
|
|
it('expires an unfinished second-factor login after five minutes', function () {
|
|
$user = User::factory()->create([
|
|
'email' => 'expires@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
enableTwoFactorForTest($user);
|
|
|
|
$this->post('/login', [
|
|
'login' => 'expires@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/two-factor-challenge');
|
|
|
|
$this->travel(301)->seconds();
|
|
|
|
$this->get('/two-factor-challenge')
|
|
->assertRedirect('/login')
|
|
->assertSessionMissing('login.id')
|
|
->assertSessionMissing('login.started_at');
|
|
});
|
|
|
|
it('does not accept the same TOTP twice', function () {
|
|
$user = User::factory()->create([
|
|
'email' => 'replay@example.com',
|
|
'password' => 'password123',
|
|
]);
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
|
|
$this->post('/login', [
|
|
'login' => 'replay@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/two-factor-challenge');
|
|
$this->post('/two-factor-challenge', ['code' => $twoFactor['code']])
|
|
->assertRedirect('/dashboard');
|
|
|
|
$this->post('/logout');
|
|
$this->post('/login', [
|
|
'login' => 'replay@example.com',
|
|
'password' => 'password123',
|
|
])->assertRedirect('/two-factor-challenge');
|
|
$this->post('/two-factor-challenge', ['code' => $twoFactor['code']])
|
|
->assertSessionHasErrors('code');
|
|
|
|
$this->assertGuest();
|
|
});
|
|
|
|
it('consumes recovery codes used to authorize a sensitive settings action', function () {
|
|
$user = User::factory()->social()->create();
|
|
$twoFactor = enableTwoFactorForTest($user);
|
|
$recoveryCode = $twoFactor['recovery_codes'][0];
|
|
|
|
$this->actingAs($user)
|
|
->post('/profile/two-factor/recovery-codes', [
|
|
'code' => $recoveryCode,
|
|
'regenerate' => false,
|
|
])
|
|
->assertRedirect('/profile/security')
|
|
->assertSessionHas('recoveryCodes');
|
|
|
|
expect($user->fresh()->recoveryCodes())->not->toContain($recoveryCode);
|
|
});
|
|
|
|
it('seeds a user matching the current user table structure', function () {
|
|
$this->seed(DatabaseSeeder::class);
|
|
|
|
$this->assertDatabaseHas('users', [
|
|
'username' => 'testuser',
|
|
'first_name' => 'Test',
|
|
'last_name' => 'User',
|
|
'email' => 'test@example.com',
|
|
]);
|
|
});
|