snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

e2e-tests/cypress/tests/integration/channels/enterprise/auth_sso/authentication_spec.ts

@@ -0,0 +1,104 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+// ***************************************************************
+// - [#] indicates a test step (e.g. # Go to a page)
+// - [*] indicates an assertion (e.g. * Check the title)
+// - Use element ID when selecting an element. Create one if none.
+// ***************************************************************
+
+// Stage: @prod
+// Group: @channels @enterprise @system_console @authentication
+
+import type {Team} from '@mattermost/types/teams';
+
+import * as TIMEOUTS from '@/fixtures/timeouts';
+import {getRandomId, newTestPassword} from '@/utils';
+
+describe('Authentication', () => {
+    const restrictCreationToDomains = 'mattermost.com, test.com';
+    let testTeam: Team;
+
+    before(() => {
+        cy.apiRequireLicense();
+
+        cy.apiInitSetup().then(({team}) => {
+            testTeam = team;
+        });
+    });
+
+    beforeEach(() => {
+        // # Log in as a admin.
+        cy.apiAdminLogin();
+    });
+
+    it('MM-T1759 - Restrict Domains - Team invite open team', () => {
+        // # Set restricted domain
+        cy.apiUpdateConfig({
+            TeamSettings: {
+                RestrictCreationToDomains: restrictCreationToDomains,
+            },
+        });
+
+        cy.visit(`/admin_console/user_management/teams/${testTeam.id}`);
+
+        cy.findByTestId('allowAllToggleSwitch', {timeout: TIMEOUTS.ONE_MIN}).click();
+
+        // # Click "Save"
+        cy.findByText('Save').scrollIntoView().click();
+
+        // # Wait until we are at the Mattermost Teams page
+        cy.findByText('Mattermost Teams', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible');
+
+        cy.apiLogout().visit(`/signup_user_complete/?id=${testTeam.invite_id}`);
+
+        cy.get('#input_email', {timeout: TIMEOUTS.ONE_MIN}).type(`test-${getRandomId()}@example.com`);
+
+        cy.get('#input_password-input').type(newTestPassword());
+
+        cy.get('#input_name').clear().type(`Test${getRandomId()}`);
+
+        cy.get('#signup-body-card-form-check-terms-and-privacy').check();
+
+        cy.findByText('Create account').click();
+
+        // * Make sure account was not created successfully
+        cy.get('.AlertBanner__title').scrollIntoView().should('be.visible');
+        cy.findByText('The email you provided does not belong to an accepted domain. Please contact your administrator or sign up with a different email.').should('be.visible').and('exist');
+    });
+
+    it('MM-T1761 - Enable Open Server - Create link appears if email account creation is false and other signin methods are true', () => {
+        // # Disable sign up with email but enable LDAP
+        cy.apiUpdateConfig({
+            EmailSettings: {
+                EnableSignUpWithEmail: false,
+            },
+            LdapSettings: {
+                Enable: true,
+            },
+        });
+
+        cy.apiLogout().visit('/');
+
+        // * Assert that create account button is visible
+        cy.findByText('Don\'t have an account?', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible');
+    });
+
+    it('MM-T1766 - Authentication - Email - Creation with email = true', () => {
+        // # Enable user account creation and set restricted domain
+        cy.apiUpdateConfig({
+            EmailSettings: {
+                EnableSignUpWithEmail: true,
+            },
+            TeamSettings: {
+                RestrictCreationToDomains: restrictCreationToDomains,
+            },
+        });
+
+        cy.apiLogout().visit(`/signup_user_complete/?id=${testTeam.invite_id}`);
+
+        // * Email and Password option exist
+        cy.findByText('Email address').should('exist').and('be.visible');
+        cy.findByPlaceholderText('Choose a Password').should('exist').and('be.visible');
+    });
+});

e2e-tests/cypress/tests/integration/channels/enterprise/auth_sso/mfa_authentication_spec.ts

@@ -0,0 +1,155 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+// ***************************************************************
+// - [#] indicates a test step (e.g. # Go to a page)
+// - [*] indicates an assertion (e.g. * Check the title)
+// - Use element ID when selecting an element. Create one if none.
+// ***************************************************************
+
+// Group: @channels @enterprise @system_console @authentication @mfa
+
+import type {UserProfile} from '@mattermost/types/users';
+import * as authenticator from 'authenticator';
+
+import * as TIMEOUTS from '@/fixtures/timeouts';
+
+describe('Authentication', () => {
+    let mfaSysAdmin: UserProfile;
+    let testUser: UserProfile;
+    let adminMFASecret: string;
+
+    before(() => {
+        cy.apiRequireLicenseForFeature('MFA');
+
+        // # Do email test if setup properly
+        cy.shouldHaveEmailEnabled();
+
+        cy.apiInitSetup().then(({user}) => {
+            testUser = user;
+        });
+
+        // # Create and login a newly created user as sysadmin
+        cy.apiCreateCustomAdmin().then(({sysadmin}) => {
+            mfaSysAdmin = sysadmin;
+        });
+    });
+
+    it('MM-T1778 - MFA - Enforced', () => {
+        // # Log in as a admin.
+        cy.apiLogin(mfaSysAdmin);
+
+        // # Navigate to System Console -> Authentication -> MFA Page.
+        cy.visit('/admin_console/authentication/mfa');
+        cy.findByText('Multi-factor Authentication', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible').and('exist');
+
+        // # Ensure the setting 'Enable Multi factor authentication' is set to true in the MFA page.
+        cy.findByTestId('ServiceSettings.EnableMultifactorAuthenticationtrue').check();
+
+        // # Also ensure that this MFA setting is enforced.
+        cy.findByTestId('ServiceSettings.EnforceMultifactorAuthenticationtrue').check();
+
+        // # Click "Save".
+        cy.findByText('Save').click().wait(TIMEOUTS.ONE_SEC);
+
+        // # Get MFA secret
+        cy.uiGetMFASecret(mfaSysAdmin.id).then((secret) => {
+            adminMFASecret = secret;
+
+            // # Navigate to System Console -> User Management -> Users
+            cy.visit('/admin_console/user_management/users');
+            cy.findByPlaceholderText('Search users').type(testUser.username).wait(TIMEOUTS.HALF_SEC);
+
+            // * Remove MFA option not available for the user
+            cy.get('#systemUsersTable-cell-0_actionsColumn').click().wait(TIMEOUTS.HALF_SEC);
+            cy.findByText('Remove MFA').should('not.exist');
+
+            cy.apiLogout();
+        });
+
+        // # Login as test user
+        cy.uiLogin(testUser);
+        cy.wait(TIMEOUTS.THREE_SEC);
+
+        // * MFA page is shown
+        cy.findByText('Multi-factor Authentication Setup', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible').and('exist');
+    });
+
+    // This test relies on the previous test for having MFA enabled (MM-T1778)
+    it('MM-T1781 - MFA - Admin removes another users MFA', () => {
+        // # Login as test user
+        cy.apiLogin(testUser);
+        cy.wait(TIMEOUTS.THREE_SEC);
+
+        // # Complete MFA setup which we didnt do for the test user
+        cy.get('#mfa').wait(TIMEOUTS.HALF_SEC).find('.col-sm-12').then((p) => {
+            const secretp = p.text();
+            const testUserMFASecret = secretp.split(' ')[1];
+
+            const token = authenticator.generateToken(testUserMFASecret);
+            cy.findByPlaceholderText('MFA Code').type(token);
+            cy.findByText('Save').click();
+
+            cy.wait(TIMEOUTS.HALF_SEC);
+            cy.findByText('Okay').click();
+
+            cy.apiLogout();
+        });
+
+        cy.wait(TIMEOUTS.THREE_SEC);
+
+        // # Login back as admin.
+        const adminMFAToken = authenticator.generateToken(adminMFASecret);
+        cy.apiLoginWithMFA(mfaSysAdmin, adminMFAToken);
+
+        // # Navigate to System Console -> User Management -> Users
+        cy.visit('/admin_console/user_management/users');
+        cy.findByPlaceholderText('Search users').type(testUser.username).wait(TIMEOUTS.HALF_SEC);
+
+        // * Remove MFA option available for the user and click it
+        cy.get('#systemUsersTable-cell-0_actionsColumn').click().wait(TIMEOUTS.HALF_SEC);
+        cy.findByText('Remove MFA').should('be.visible').click();
+
+        // # Navigate to System Console -> Authentication -> MFA Page.
+        cy.visit('/admin_console/authentication/mfa');
+        cy.findByText('Multi-factor Authentication', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible').and('exist');
+
+        // # Also ensure that this MFA setting is enforced.
+        cy.findByTestId('ServiceSettings.EnforceMultifactorAuthenticationfalse').check();
+
+        // # Click "Save".
+        cy.findByText('Save').click().wait(TIMEOUTS.ONE_SEC);
+        cy.apiLogout();
+
+        // # Login as test user
+        cy.apiLogin(testUser);
+        cy.visit('/');
+
+        // * No MFA page is shown
+        cy.findByText('Multi-factor Authentication Setup', {timeout: TIMEOUTS.ONE_MIN}).should('not.exist').and('not.exist');
+    });
+
+    // This test relies on the previous test for having MFA enabled (MM-T1781)
+    it('MM-T1782 - MFA - Removing MFA option hidden for users without MFA set up', () => {
+        // # Login back as admin.
+        const token = authenticator.generateToken(adminMFASecret);
+        cy.apiLoginWithMFA(mfaSysAdmin, token);
+
+        // # Navigate to System Console -> User Management -> Users
+        cy.visit('/admin_console/user_management/users');
+        cy.findByPlaceholderText('Search users').type(testUser.username).wait(TIMEOUTS.HALF_SEC);
+
+        // * Remove MFA option available for the user and click it
+        cy.wait(TIMEOUTS.HALF_SEC);
+        cy.get('#systemUsersTable-cell-0_actionsColumn').click().wait(TIMEOUTS.HALF_SEC);
+        cy.findByText('Remove MFA').should('not.exist');
+
+        // # Done with that MFA stuff so we disable it all
+        cy.apiUpdateConfig({
+            ServiceSettings: {
+                EnableMultifactorAuthentication: false,
+                EnforceMultifactorAuthentication: false,
+            },
+        });
+    });
+});