c60cc7ca75
Some checks failed
CI / Run tests and lints (push) Failing after 29s
CI / Build CLI docs (push) Has been skipped
CI / Run Playwright end-to-end tests (mysql) (push) Failing after 3s
CI / Run Playwright end-to-end tests (postgres) (push) Failing after 2s
CI / Run Playwright end-to-end tests (sqlite) (push) Failing after 3s
CodeQL / Analyze (go) (push) Failing after 4s
CodeQL / Analyze (javascript) (push) Failing after 3s
Docker Image Scanners / scanners (push) Failing after 4s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Run end-to-end tests (postgres) (push) Failing after 19s
CI / Run end-to-end tests (sqlite) (push) Failing after 2s
CI / Run Playwright end-to-end tests (cockroach) (push) Failing after 2s
CI / Draft newsletter (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
306 lines
10 KiB
TypeScript
306 lines
10 KiB
TypeScript
// Copyright © 2023 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
import { appPrefix, gen, website } from "../../../helpers"
|
|
import { routes as express } from "../../../helpers/express"
|
|
import { routes as react } from "../../../helpers/react"
|
|
|
|
context("2FA lookup secrets", () => {
|
|
;[
|
|
{
|
|
login: react.login,
|
|
settings: react.settings,
|
|
base: react.base,
|
|
app: "react" as "react",
|
|
profile: "spa",
|
|
},
|
|
{
|
|
login: express.login,
|
|
settings: express.settings,
|
|
base: express.base,
|
|
app: "express" as "express",
|
|
profile: "mfa",
|
|
},
|
|
].forEach(({ settings, login, profile, app, base }) => {
|
|
describe(`for app ${app}`, () => {
|
|
before(() => {
|
|
cy.useConfigProfile(profile)
|
|
cy.proxy(app)
|
|
})
|
|
|
|
let email = gen.email()
|
|
let password = gen.password()
|
|
|
|
beforeEach(() => {
|
|
cy.visit(base)
|
|
cy.clearAllCookies()
|
|
cy.useConfig((builder) => builder.disableCodeMfa())
|
|
email = gen.email()
|
|
password = gen.password()
|
|
cy.registerApi({
|
|
email,
|
|
password,
|
|
fields: { "traits.website": website },
|
|
})
|
|
cy.login({ email, password, cookieUrl: base })
|
|
|
|
cy.longPrivilegedSessionTime()
|
|
cy.sessionRequiresNo2fa()
|
|
})
|
|
|
|
// playwright:migrated
|
|
it("should be able to remove lookup codes", () => {
|
|
cy.sessionRequires2fa()
|
|
cy.longPrivilegedSessionTime()
|
|
cy.visit(settings)
|
|
cy.get(
|
|
appPrefix(app) + 'button[name="lookup_secret_regenerate"]',
|
|
).click()
|
|
cy.get('button[name="lookup_secret_confirm"]').click()
|
|
cy.expectSettingsSaved()
|
|
cy.visit(settings)
|
|
|
|
cy.shortPrivilegedSessionTime()
|
|
cy.get('button[name="lookup_secret_disable"]').click()
|
|
cy.reauth({
|
|
expect: { email },
|
|
type: { email: email, password: password },
|
|
})
|
|
cy.expectSettingsSaved()
|
|
|
|
cy.clearAllCookies()
|
|
cy.login({ email: email, password: password, cookieUrl: base })
|
|
|
|
cy.visit(login + "?aal=aal2")
|
|
cy.get("h2")
|
|
.invoke("text")
|
|
.should(
|
|
"match",
|
|
/Second factor authentication|Two-Factor Authentication/,
|
|
)
|
|
cy.get('*[name="method"][value="totp"]').should("not.exist")
|
|
cy.get('*[name="method"][value="lookup_secret"]').should("not.exist")
|
|
cy.get('*[name="method"][value="password"]').should("not.exist")
|
|
})
|
|
|
|
// playwright:migrated
|
|
it("should go through several lookup secret lifecycles", () => {
|
|
cy.visit(settings)
|
|
|
|
cy.get('[data-testid="node/text/lookup_secret_codes/label"]').should(
|
|
"not.exist",
|
|
)
|
|
cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
|
|
"not.exist",
|
|
)
|
|
cy.get('button[name="lookup_secret_confirm"]').should("not.exist")
|
|
cy.get('button[name="lookup_secret_regenerate"]').click()
|
|
cy.get('[data-testid="node/text/lookup_secret_codes/label"]').should(
|
|
"contain.text",
|
|
"These are your back up recovery codes.",
|
|
)
|
|
cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
|
|
"not.be.empty",
|
|
)
|
|
|
|
let codes: string[]
|
|
cy.getLookupSecrets().should((c) => {
|
|
codes = c
|
|
})
|
|
|
|
cy.get('button[name="lookup_secret_confirm"]').click()
|
|
cy.expectSettingsSaved()
|
|
|
|
cy.get('button[name="lookup_secret_reveal"]').should("exist")
|
|
cy.get('[data-testid="text-lookup_secret_codes-content"] code').should(
|
|
"not.exist",
|
|
)
|
|
cy.get('button[name="lookup_secret_confirm"]').should("not.exist")
|
|
cy.get('button[name="lookup_secret_regenerate"]').should("not.exist")
|
|
|
|
cy.get('button[name="lookup_secret_reveal"]').click()
|
|
cy.getLookupSecrets().should((c) => {
|
|
codes = c
|
|
})
|
|
|
|
cy.getSession({
|
|
expectAal: "aal2",
|
|
expectMethods: ["password", "lookup_secret"],
|
|
})
|
|
|
|
// Try to log in with a recovery code now
|
|
cy.visit(login + "?aal=aal2&refresh=true")
|
|
cy.location("pathname").should("contain", "login")
|
|
|
|
cy.get('*[name="method"][value="lookup_secret"]').should("exist")
|
|
cy.get('*[name="method"][value="password"]').should("not.exist")
|
|
|
|
// Type an invalid code
|
|
cy.get('input[name="lookup_secret"]').should("exist")
|
|
cy.get('input[name="lookup_secret"]').type("invalid-code")
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
cy.get('[data-testid="ui/message/4000016"]').should(
|
|
"contain.text",
|
|
"The backup recovery code is not valid.",
|
|
)
|
|
|
|
// Type a valid code
|
|
cy.get('input[name="lookup_secret"]').should("exist")
|
|
cy.get('input[name="lookup_secret"]').should("have.value", "")
|
|
cy.get('input[name="lookup_secret"]').then(($e) => {
|
|
cy.wrap($e).type(codes[0])
|
|
})
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
cy.location("pathname").should("not.contain", "login")
|
|
|
|
let authenticatedAt
|
|
cy.getSession({
|
|
expectAal: "aal2",
|
|
expectMethods: ["password", "lookup_secret", "lookup_secret"],
|
|
}).then((session) => {
|
|
authenticatedAt = session.authenticated_at
|
|
expect(session.authenticator_assurance_level).to.equal("aal2")
|
|
})
|
|
|
|
// Retry auth with the used code
|
|
cy.visit(login + "?aal=aal2&refresh=true")
|
|
cy.location().should((loc) => {
|
|
expect(loc.href).to.include("/login")
|
|
})
|
|
cy.get('input[name="lookup_secret"]').then(($e) => {
|
|
cy.wrap($e).type(codes[0])
|
|
})
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
// Use a valid code
|
|
cy.get('[data-testid="ui/message/4000012"]').should(
|
|
"contain.text",
|
|
"This backup recovery code has already been used.",
|
|
)
|
|
|
|
cy.get('input[name="lookup_secret"]').then(($e) => {
|
|
cy.wrap($e).type(codes[1])
|
|
})
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
cy.location("pathname").should("not.contain", "login")
|
|
|
|
cy.getSession({
|
|
expectAal: "aal2",
|
|
expectMethods: [
|
|
"password",
|
|
"lookup_secret",
|
|
"lookup_secret",
|
|
"lookup_secret",
|
|
],
|
|
}).then((session) => {
|
|
expect(session.authenticated_at).to.not.equal(authenticatedAt)
|
|
})
|
|
|
|
// Going back to the settings UI we should see that the codes have been "used"
|
|
cy.visit(settings)
|
|
cy.get('button[name="lookup_secret_reveal"]').click()
|
|
cy.getLookupSecrets().should((c) => {
|
|
expect(c.slice(2)).to.eql(codes.slice(2))
|
|
expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
|
|
expect(c[1]).to.match(/(Secret was used at )|(Used)/g)
|
|
})
|
|
|
|
// Regenerating the codes means the old one become invalid
|
|
cy.get("*[name=lookup_secret_regenerate]").click()
|
|
cy.get("*[name=lookup_secret_confirm]").should("exist")
|
|
let regenCodes
|
|
cy.getLookupSecrets().should((c) => {
|
|
regenCodes = c
|
|
})
|
|
|
|
// Confirm it
|
|
cy.get("*[name=lookup_secret_confirm]").click()
|
|
cy.get('*[name="lookup_secret_reveal"]').click()
|
|
cy.getLookupSecrets().should((c) => {
|
|
expect(c).to.eql(regenCodes)
|
|
})
|
|
|
|
// Log in and see if we can use the old / new keys
|
|
cy.visit(login + "?aal=aal2&refresh=true")
|
|
cy.location("pathname").should("contain", "login")
|
|
|
|
// Using an old code fails
|
|
cy.get('input[name="lookup_secret"]').then(($e) => {
|
|
cy.wrap($e).type(codes[3])
|
|
})
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
cy.get('[data-testid="ui/message/4000016"]').should("exist")
|
|
|
|
// Using a new code succeeds
|
|
cy.get('input[name="lookup_secret"]').then(($e) => {
|
|
cy.wrap($e).type(regenCodes[0])
|
|
})
|
|
cy.get('*[name="method"][value="lookup_secret"]').click()
|
|
cy.location("pathname").should("not.contain", "login")
|
|
|
|
// Going back to the settings UI we should see that the codes have been "used"
|
|
cy.visit(settings)
|
|
cy.get('button[name="lookup_secret_reveal"]').click()
|
|
cy.getLookupSecrets().should((c) => {
|
|
expect(c.slice(1)).to.eql(regenCodes.slice(1))
|
|
expect(c[0]).to.match(/(Secret was used at )|(Used)/g)
|
|
})
|
|
})
|
|
|
|
it("should end up at login screen if trying to reveal without privileged session", () => {
|
|
cy.shortPrivilegedSessionTime()
|
|
cy.visit(settings)
|
|
cy.get('button[name="lookup_secret_regenerate"]').click()
|
|
cy.reauth({
|
|
expect: { email },
|
|
type: { email: email, password: password },
|
|
})
|
|
|
|
let codes
|
|
cy.getLookupSecrets().should((c) => {
|
|
codes = c
|
|
})
|
|
|
|
cy.shortPrivilegedSessionTime()
|
|
cy.get('button[name="lookup_secret_confirm"]').click()
|
|
cy.reauth({
|
|
expect: { email },
|
|
type: { email: email, password: password },
|
|
})
|
|
if (app === "react") {
|
|
cy.get('button[value="profile"]').click()
|
|
}
|
|
cy.expectSettingsSaved()
|
|
|
|
if (app !== "react") {
|
|
cy.shortPrivilegedSessionTime()
|
|
cy.get('button[name="lookup_secret_reveal"]').click()
|
|
cy.reauth({
|
|
expect: { email },
|
|
type: { email: email, password: password },
|
|
})
|
|
cy.getLookupSecrets().should((c) => {
|
|
expect(c).to.not.be.empty
|
|
})
|
|
cy.getSession({
|
|
expectAal: "aal2",
|
|
})
|
|
}
|
|
})
|
|
|
|
// playwright:migrated
|
|
it("should not show lookup as an option if not configured", () => {
|
|
cy.visit(login + "?aal=aal2")
|
|
cy.get('*[name="method"][value="totp"]').should("not.exist")
|
|
cy.get('*[name="method"][value="lookup_secret"]').should("not.exist")
|
|
cy.get('*[name="method"][value="password"]').should("not.exist")
|
|
cy.get("h2")
|
|
.invoke("text")
|
|
.should(
|
|
"match",
|
|
/Second factor authentication|Two-Factor Authentication/,
|
|
)
|
|
})
|
|
})
|
|
})
|
|
})
|