52ae0c5802
Some checks failed
cache-seeder / prune (push) Has been skipped
cache-seeder / frontend (push) Failing after 3s
cache-seeder / python (push) Failing after 3s
cache-seeder / gobuild (push) Failing after 4s
cache-seeder / lint (bindata, lint-backend) (push) Failing after 3s
giteabot backport / giteabot (push) Has been skipped
giteabot / giteabot (push) Has been skipped
cache-prune / prune (push) Has been skipped
release-nightly-snapcraft / build-and-publish (ubuntu-24.04) (push) Has been cancelled
release-nightly-snapcraft / build-and-publish (ubuntu-24.04-arm) (push) Has been cancelled
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-renovate / cron-renovate (push) Has been skipped
83 lines
2.5 KiB
Go
83 lines
2.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth_test
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
"github.com/pquerna/otp/totp"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
key, err := totp.Generate(totp.GenerateOpts{SecretSize: 40, Issuer: "gitea-test", AccountName: "consume"})
|
|
require.NoError(t, err)
|
|
|
|
tfa := &auth_model.TwoFactor{UID: 1}
|
|
require.NoError(t, tfa.SetSecret(key.Secret()))
|
|
require.NoError(t, auth_model.NewTwoFactor(t.Context(), tfa))
|
|
|
|
passcode, err := totp.GenerateCode(key.Secret(), time.Now())
|
|
require.NoError(t, err)
|
|
|
|
// first use of a valid passcode succeeds
|
|
ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
|
|
require.NoError(t, err)
|
|
assert.True(t, ok)
|
|
|
|
// replaying the same passcode is refused, even when still inside the TOTP validity window
|
|
reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
|
|
require.NoError(t, err)
|
|
ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
|
|
require.NoError(t, err)
|
|
assert.False(t, ok)
|
|
|
|
// an invalid passcode is rejected without consuming anything
|
|
ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
|
|
require.NoError(t, err)
|
|
assert.False(t, ok)
|
|
}
|
|
|
|
func TestDisableTwoFactor(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
ctx := t.Context()
|
|
|
|
const uid = 1000 // a uid with no user/2FA fixtures
|
|
|
|
// Enroll TOTP and register a WebAuthn credential.
|
|
tfa := &auth_model.TwoFactor{UID: uid}
|
|
require.NoError(t, tfa.SetSecret("test-secret"))
|
|
require.NoError(t, auth_model.NewTwoFactor(ctx, tfa))
|
|
_, err := auth_model.CreateCredential(ctx, uid, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
|
|
require.NoError(t, err)
|
|
|
|
has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
|
|
require.NoError(t, err)
|
|
require.True(t, has)
|
|
|
|
// Both records are removed and counted separately.
|
|
totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, uid)
|
|
require.NoError(t, err)
|
|
assert.EqualValues(t, 1, totp)
|
|
assert.EqualValues(t, 1, webAuthn)
|
|
|
|
has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
|
|
require.NoError(t, err)
|
|
assert.False(t, has)
|
|
|
|
// A second call on a user without 2FA is a no-op.
|
|
totp, webAuthn, err = auth_model.DisableTwoFactor(ctx, uid)
|
|
require.NoError(t, err)
|
|
assert.EqualValues(t, 0, totp)
|
|
assert.EqualValues(t, 0, webAuthn)
|
|
}
|