snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

test/e2e/cypress/integration/profiles/mobile/mfa/backup.spec.ts

@@ -0,0 +1,123 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to lifecycle through lookup_secret flows", () => {
+        cy.get('[data-testid="field/lookup_secret_codes"]').should("not.exist")
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').click()
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes"]').should("exist")
+        let codes
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          codes = $e.text().trim().split(", ")
+        })
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').should(
+          "not.exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes/true"]').should(
+          "not.exist",
+        )
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').click()
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').should(
+          "exist",
+        )
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          const actualCodes = $e.text().trim().split(", ")
+          expect(actualCodes.join(", ")).to.eq(codes.join(", "))
+        })
+
+        let newCodes
+        cy.get('[data-testid="field/lookup_secret_regenerate/true"]').click()
+        cy.get(
+          '[data-testid="field/lookup_secret_regenerate/true"]:disabled',
+        ).should("not.exist")
+
+        cy.get('[data-testid="field/lookup_secret_codes/text"]')
+          .and(($e) => {
+            expect($e.text().trim().split(", ").join(", ")).to.not.eq(
+              codes.join(", "),
+            )
+          })
+          .then(($e) => {
+            newCodes = $e.text().trim().split(", ")
+          })
+
+        cy.get('[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        cy.get('[data-testid="field/lookup_secret_reveal/true"]').click()
+        cy.get('[data-testid="field/lookup_secret_codes/text"]').and(($e) => {
+          const actualCodes = $e.text().trim().split(", ")
+          expect(actualCodes.join(", ")).to.eq(newCodes.join(", "))
+        })
+
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+
+        // First use a wrong code
+        cy.get("[data-testid=lookup_secret]").then(($e) => {
+          console.log(codes)
+          cy.wrap($e).type("1234")
+        })
+        cy.get('[data-testid="field/method/lookup_secret"]').click()
+        cy.get('[data-testid="form-messages"]').should(
+          "contain.text",
+          "The backup recovery code is not valid.",
+        )
+        cy.get("[data-testid=lookup_secret]").then(($e) => {
+          cy.wrap($e).type(newCodes[0])
+        })
+        cy.get('[data-testid="field/method/lookup_secret"]').click()
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          "lookup_secret",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/mfa/mix.spec.ts

@@ -0,0 +1,91 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+import { TOTP } from "otpauth"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to use both TOTP and lookup", () => {
+        // set up totp
+        let totpSecret
+        cy.get('*[data-testid="field/totp_secret_key/text"]').then(($e) => {
+          totpSecret = $e.text().trim()
+        })
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret: totpSecret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.expectSettingsSaved()
+
+        // Set up backup code
+        cy.get('*[data-testid="field/lookup_secret_regenerate/true"]').click()
+        let recoveryCodes
+        cy.get('*[data-testid="field/lookup_secret_codes/text"]').then(($e) => {
+          recoveryCodes = $e.text().trim().split(", ")
+        })
+        cy.get('*[data-testid="field/lookup_secret_confirm/true"]').click()
+        cy.expectSettingsSaved()
+
+        // Lets sign in with TOTP
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret: totpSecret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+
+        // Lets sign in with lookup secret
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+        cy.get('*[data-testid="field/lookup_secret"]').then(($e) => {
+          cy.wrap($e).type(recoveryCodes[0])
+        })
+        cy.get('*[data-testid="field/method/lookup_secret"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+        cy.get('[data-testid="session-content"]').should(
+          "contain",
+          "lookup_secret",
+        )
+      })
+    })
+  })
+})

test/e2e/cypress/integration/profiles/mobile/mfa/totp.spec.ts

@@ -0,0 +1,103 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import { gen, MOBILE_URL, website } from "../../../../helpers"
+import { TOTP } from "otpauth"
+
+context("Mobile Profile", () => {
+  describe("TOTP 2FA Flow", () => {
+    before(() => {
+      cy.useConfigProfile("mobile")
+    })
+
+    describe("password", () => {
+      let email = gen.email()
+      let password = gen.password()
+
+      before(() => {
+        cy.clearAllCookies()
+      })
+
+      beforeEach(() => {
+        email = gen.email()
+        password = gen.password()
+
+        cy.registerApi({
+          email,
+          password,
+          fields: { "traits.website": website },
+        })
+        cy.loginMobile({ email, password })
+        cy.visit(MOBILE_URL + "/Settings")
+      })
+
+      it("should be able to lifecycle through TOTP flows", () => {
+        cy.get('*[data-testid="field/totp_qr"]').should("exist")
+        cy.get('*[data-testid="field/totp_code"]').should("exist")
+
+        // Set up TOTP with invalid key
+        cy.get('*[data-testid="field/totp_code"]').type("111111")
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.get('*[data-testid="field/totp_code"]').should(
+          "contain.text",
+          "The provided authentication code is invalid, please try again.",
+        )
+
+        // Set up TOTP with valid key
+        let secret
+        cy.get('*[data-testid="field/totp_secret_key/text"]').then(($e) => {
+          secret = $e.text().trim()
+        })
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.expectSettingsSaved()
+
+        // Form should look different now
+        cy.get('*[data-testid="field/totp_secret_key/text"]').should(
+          "not.exist",
+        )
+        cy.get('*[data-testid="field/totp_code"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_qr"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_unlink/true"]').should("exist")
+
+        // Lets sign in
+        cy.visit(MOBILE_URL + "/Login?aal=aal2&refresh=true")
+
+        // First use a wrong code
+        cy.get('*[data-testid="field/totp_code"]').type("111111")
+        cy.get('*[data-testid="field/method/totp"]').click()
+        cy.get('*[data-testid="form-messages"]').should(
+          "contain.text",
+          "The provided authentication code is invalid, please try again.",
+        )
+
+        // Use the correct code
+        cy.get('*[data-testid="field/totp_code"]').then(($e) => {
+          cy.wrap($e).type(
+            new TOTP({
+              secret,
+            }).generate(),
+          )
+        })
+        cy.get('*[data-testid="field/method/totp"]').click()
+
+        // We have AAL now
+        cy.get('[data-testid="session-content"]').should("contain", "aal2")
+        cy.get('[data-testid="session-content"]').should("contain", "totp")
+
+        // Go back to settings and unlink
+        cy.visit(MOBILE_URL + "/Settings")
+        cy.get('*[data-testid="field/totp_unlink/true"]').click()
+        cy.get('*[data-testid="field/totp_unlink/true"]').should("not.exist")
+        cy.get('*[data-testid="field/totp_qr"]').should("exist")
+        cy.get('*[data-testid="field/totp_code"]').should("exist")
+      })
+    })
+  })
+})