111 lines
4.0 KiB
PHP
111 lines
4.0 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Livewire\Modals\RecoveryCodes;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
|
|
use Livewire\Livewire;
|
|
use Tests\TestCase;
|
|
|
|
class RecoveryCodesModalTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_manage_view_without_fresh_flag_hides_the_codes(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$codes = $user->replaceRecoveryCodes();
|
|
|
|
// Opened from "Backup-Codes verwalten" with no fresh-generation flag: never reveal.
|
|
Livewire::actingAs($user)->test(RecoveryCodes::class)
|
|
->assertSet('revealed', false)
|
|
->assertDontSee($codes[0])
|
|
->assertDontSee($codes[7])
|
|
->assertSee(__('auth.recovery_hidden_notice'));
|
|
}
|
|
|
|
public function test_fresh_flag_reveals_the_codes_once(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$codes = $user->replaceRecoveryCodes();
|
|
session(['2fa.codes_fresh' => true]);
|
|
|
|
Livewire::actingAs($user)->test(RecoveryCodes::class)
|
|
->assertSet('revealed', true)
|
|
->assertSee($codes[0])
|
|
->assertSee($codes[7]);
|
|
|
|
// pull() forgets the flag — it is single-use.
|
|
$this->assertFalse(session()->has('2fa.codes_fresh'));
|
|
}
|
|
|
|
public function test_regenerate_from_manage_view_reveals_the_new_codes(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$old = $user->replaceRecoveryCodes();
|
|
|
|
// Manage view (no flag) → not revealed → regenerate → the NEW set is revealed once.
|
|
Livewire::actingAs($user)->test(RecoveryCodes::class)
|
|
->assertSet('revealed', false)
|
|
->call('regenerate')
|
|
->assertSet('revealed', true)
|
|
->assertDontSee($old[0]);
|
|
|
|
$new = $user->fresh()->recoveryCodes();
|
|
$this->assertNotEquals($old, $new);
|
|
|
|
Livewire::actingAs($user)->test(RecoveryCodes::class)
|
|
->call('regenerate')
|
|
->assertSee($user->fresh()->recoveryCodes()[0]);
|
|
}
|
|
|
|
public function test_revealed_property_is_locked_against_client_tampering(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$codes = $user->replaceRecoveryCodes();
|
|
|
|
// Manage view (no fresh flag): codes stay hidden. A crafted client update that flips
|
|
// the #[Locked] $revealed prop must be rejected — Livewire throws on a locked set.
|
|
$component = Livewire::actingAs($user)->test(RecoveryCodes::class)
|
|
->assertSet('revealed', false)
|
|
->assertDontSee($codes[0]);
|
|
|
|
$this->expectException(CannotUpdateLockedPropertyException::class);
|
|
$component->set('revealed', true);
|
|
}
|
|
|
|
public function test_download_requires_a_fresh_grant(): void
|
|
{
|
|
$user = User::factory()->create();
|
|
$user->replaceRecoveryCodes();
|
|
|
|
// Without a fresh-generation grant, a direct hit of the download route is forbidden,
|
|
// so stored codes can never be re-downloaded by an authed user at will.
|
|
$this->actingAs($user)
|
|
->get(route('two-factor.recovery.download'))
|
|
->assertForbidden();
|
|
|
|
// With the one-time grant (set when codes are freshly generated/regenerated) the
|
|
// download succeeds exactly once.
|
|
session(['2fa.download_grant' => true]);
|
|
$this->actingAs($user)
|
|
->get(route('two-factor.recovery.download'))
|
|
->assertOk()
|
|
->assertDownload('clusev-recovery-codes.txt');
|
|
|
|
// The grant is single-use: pull() consumed it, so an immediate re-download 403s.
|
|
$this->actingAs($user)
|
|
->get(route('two-factor.recovery.download'))
|
|
->assertForbidden();
|
|
}
|
|
|
|
public function test_old_recovery_route_is_gone(): void
|
|
{
|
|
$this->assertFalse(Route::has('two-factor.recovery'));
|
|
$this->assertTrue(Route::has('two-factor.recovery.download'));
|
|
}
|
|
}
|