snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/mfa/lookup.spec.ts

@@ -0,0 +1,305 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { appPrefix, gen, website } from "../../../helpers"
+import { routes as express } from "../../../helpers/express"
+import { routes as react } from "../../../helpers/react"
+
+context("2FA lookup secrets", () => {
+  ;[
+    {
+      login: react.login,
+      settings: react.settings,
+      base: react.base,
+      app: "react" as "react",
+      profile: "spa",
+    },
+    {
+      login: express.login,
+      settings: express.settings,
+      base: express.base,
+      app: "express" as "express",
+      profile: "mfa",
+    },
+  ].forEach(({ settings, login, profile, app, base }) => {
+    describe(`for app ${app}`, () => {
+      before(() => {
+        cy.useConfigProfile(profile)
+        cy.proxy(app)
+      })
+
+      let email = gen.email()
+      let password = gen.password()
+
+      beforeEach(() => {
+        cy.visit(base)
+        cy.clearAllCookies()
+        cy.useConfig((builder) => builder.disableCodeMfa())
+        email = gen.email()
+        password = gen.password()
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.login({ email, password, cookieUrl: base })
+
+        cy.longPrivilegedSessionTime()
+        cy.sessionRequiresNo2fa()
+      })
+
+      // playwright:migrated
+      it("should be able to remove lookup codes", () => {
+        cy.sessionRequires2fa()
+        cy.longPrivilegedSessionTime()
+        cy.visit(settings)
+        cy.get(
+          appPrefix(app) + 'button[name="lookup_secret_regenerate"]',
+        ).click()
+        cy.get('button[name="lookup_secret_confirm"]').click()
+        cy.expectSettingsSaved()
+        cy.visit(settings)
+
+        cy.shortPrivilegedSessionTime()
+        cy.get('button[name="lookup_secret_disable"]').click()
+        cy.reauth({
+          expect: { email },
+          type: { email: email, password: password },
+        })
+        cy.expectSettingsSaved()
+
+        cy.clearAllCookies()
+        cy.login({ email: email, password: password, cookieUrl: base })
+
+        cy.visit(login + "?aal=aal2")
+        cy.get("h2")
+          .invoke("text")
+          .should(
+            "match",
+            /Second factor authentication|Two-Factor Authentication/,
+          )
+        cy.get('*[name="method"][value="totp"]').should("not.exist")
+        cy.get('*[name="method"][value="lookup_secret"]').should("not.exist")
+        cy.get('*[name="method"][value="password"]').should("not.exist")
+      })
+
+      // playwright:migrated
+      it("should go through several lookup secret lifecycles", () => {
+        cy.visit(settings)
+
+        cy.get('[data-testid="node/text/lookup_secret_codes/label"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
+          "not.exist",
+        )
+        cy.get('button[name="lookup_secret_confirm"]').should("not.exist")
+        cy.get('button[name="lookup_secret_regenerate"]').click()
+        cy.get('[data-testid="node/text/lookup_secret_codes/label"]').should(
+          "contain.text",
+          "These are your back up recovery codes.",
+        )
+        cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
+          "not.be.empty",
+        )
+
+        let codes: string[]
+        cy.getLookupSecrets().should((c) => {
+          codes = c
+        })
+
+        cy.get('button[name="lookup_secret_confirm"]').click()
+        cy.expectSettingsSaved()
+
+        cy.get('button[name="lookup_secret_reveal"]').should("exist")
+        cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
+          "not.exist",
+        )
+        cy.get('button[name="lookup_secret_confirm"]').should("not.exist")
+        cy.get('button[name="lookup_secret_regenerate"]').should("not.exist")
+
+        cy.get('button[name="lookup_secret_reveal"]').click()
+        cy.getLookupSecrets().should((c) => {
+          codes = c
+        })
+
+        cy.getSession({
+          expectAal: "aal2",
+          expectMethods: ["password", "lookup_secret"],
+        })
+
+        // Try to log in with a recovery code now
+        cy.visit(login + "?aal=aal2&refresh=true")
+        cy.location("pathname").should("contain", "login")
+
+        cy.get('*[name="method"][value="lookup_secret"]').should("exist")
+        cy.get('*[name="method"][value="password"]').should("not.exist")
+
+        // Type an invalid code
+        cy.get('input[name="lookup_secret"]').should("exist")
+        cy.get('input[name="lookup_secret"]').type("invalid-code")
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        cy.get('[data-testid="ui/message/4000016"]').should(
+          "contain.text",
+          "The backup recovery code is not valid.",
+        )
+
+        // Type a valid code
+        cy.get('input[name="lookup_secret"]').should("exist")
+        cy.get('input[name="lookup_secret"]').should("have.value", "")
+        cy.get('input[name="lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(codes[0])
+        })
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        cy.location("pathname").should("not.contain", "login")
+
+        let authenticatedAt
+        cy.getSession({
+          expectAal: "aal2",
+          expectMethods: ["password", "lookup_secret", "lookup_secret"],
+        }).then((session) => {
+          authenticatedAt = session.authenticated_at
+          expect(session.authenticator_assurance_level).to.equal("aal2")
+        })
+
+        // Retry auth with the used code
+        cy.visit(login + "?aal=aal2&refresh=true")
+        cy.location().should((loc) => {
+          expect(loc.href).to.include("/login")
+        })
+        cy.get('input[name="lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(codes[0])
+        })
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        // Use a valid code
+        cy.get('[data-testid="ui/message/4000012"]').should(
+          "contain.text",
+          "This backup recovery code has already been used.",
+        )
+
+        cy.get('input[name="lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(codes[1])
+        })
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        cy.location("pathname").should("not.contain", "login")
+
+        cy.getSession({
+          expectAal: "aal2",
+          expectMethods: [
+            "password",
+            "lookup_secret",
+            "lookup_secret",
+            "lookup_secret",
+          ],
+        }).then((session) => {
+          expect(session.authenticated_at).to.not.equal(authenticatedAt)
+        })
+
+        // Going back to the settings UI we should see that the codes have been "used"
+        cy.visit(settings)
+        cy.get('button[name="lookup_secret_reveal"]').click()
+        cy.getLookupSecrets().should((c) => {
+          expect(c.slice(2)).to.eql(codes.slice(2))
+          expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
+          expect(c[1]).to.match(/(Secret was used at )|(Used)/g)
+        })
+
+        // Regenerating the codes means the old one become invalid
+        cy.get("*[name=lookup_secret_regenerate]").click()
+        cy.get("*[name=lookup_secret_confirm]").should("exist")
+        let regenCodes
+        cy.getLookupSecrets().should((c) => {
+          regenCodes = c
+        })
+
+        // Confirm it
+        cy.get("*[name=lookup_secret_confirm]").click()
+        cy.get('*[name="lookup_secret_reveal"]').click()
+        cy.getLookupSecrets().should((c) => {
+          expect(c).to.eql(regenCodes)
+        })
+
+        // Log in and see if we can use the old / new keys
+        cy.visit(login + "?aal=aal2&refresh=true")
+        cy.location("pathname").should("contain", "login")
+
+        // Using an old code fails
+        cy.get('input[name="lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(codes[3])
+        })
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        cy.get('[data-testid="ui/message/4000016"]').should("exist")
+
+        // Using a new code succeeds
+        cy.get('input[name="lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(regenCodes[0])
+        })
+        cy.get('*[name="method"][value="lookup_secret"]').click()
+        cy.location("pathname").should("not.contain", "login")
+
+        // Going back to the settings UI we should see that the codes have been "used"
+        cy.visit(settings)
+        cy.get('button[name="lookup_secret_reveal"]').click()
+        cy.getLookupSecrets().should((c) => {
+          expect(c.slice(1)).to.eql(regenCodes.slice(1))
+          expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
+        })
+      })
+
+      it("should end up at login screen if trying to reveal without privileged session", () => {
+        cy.shortPrivilegedSessionTime()
+        cy.visit(settings)
+        cy.get('button[name="lookup_secret_regenerate"]').click()
+        cy.reauth({
+          expect: { email },
+          type: { email: email, password: password },
+        })
+
+        let codes
+        cy.getLookupSecrets().should((c) => {
+          codes = c
+        })
+
+        cy.shortPrivilegedSessionTime()
+        cy.get('button[name="lookup_secret_confirm"]').click()
+        cy.reauth({
+          expect: { email },
+          type: { email: email, password: password },
+        })
+        if (app === "react") {
+          cy.get('button[value="profile"]').click()
+        }
+        cy.expectSettingsSaved()
+
+        if (app !== "react") {
+          cy.shortPrivilegedSessionTime()
+          cy.get('button[name="lookup_secret_reveal"]').click()
+          cy.reauth({
+            expect: { email },
+            type: { email: email, password: password },
+          })
+          cy.getLookupSecrets().should((c) => {
+            expect(c).to.not.be.empty
+          })
+          cy.getSession({
+            expectAal: "aal2",
+          })
+        }
+      })
+
+      // playwright:migrated
+      it("should not show lookup as an option if not configured", () => {
+        cy.visit(login + "?aal=aal2")
+        cy.get('*[name="method"][value="totp"]').should("not.exist")
+        cy.get('*[name="method"][value="lookup_secret"]').should("not.exist")
+        cy.get('*[name="method"][value="password"]').should("not.exist")
+        cy.get("h2")
+          .invoke("text")
+          .should(
+            "match",
+            /Second factor authentication|Two-Factor Authentication/,
+          )
+      })
+    })
+  })
+})