dd6ec65061
2FA support in Discourse was added and grown gradually over the years: we first added support for TOTP for logins, then we implemented backup codes, and last but not least, security keys. 2FA usage was initially limited to logging in, but it has been expanded and we now require 2FA for risky actions such as adding a new admin to the site. As a result of this gradual growth of the 2FA system, technical debt has accumulated to the point where it has become difficult to require 2FA for more actions. We now have 5 different 2FA UI implementations and each one has to support all 3 2FA methods (TOTP, backup codes, and security keys) which makes it difficult to maintain a consistent UX for these different implementations. Moreover, there is a lot of repeated logic in the server-side code behind these 5 UI implementations which hinders maintainability even more. This commit is the first step towards repaying the technical debt: it builds a system that centralizes as much as possible of the 2FA server-side logic and UI. The 2 main components of this system are: 1. A dedicated page for 2FA with support for all 3 methods. 2. A reusable server-side class that centralizes the 2FA logic (the `SecondFactor::AuthManager` class). From a top-level view, the 2FA flow in this new system looks like this: 1. User initiates an action that requires 2FA; 2. Server is aware that 2FA is required for this action, so it redirects the user to the 2FA page if the user has a 2FA method, otherwise the action is performed. 3. User submits the 2FA form on the page; 4. Server validates the 2FA and if it's successful, the action is performed and the user is redirected to the previous page. A more technically-detailed explanation/documentation of the new system is available as a comment at the top of the `lib/second_factor/auth_manager.rb` file. Please note that the details are not set in stone and will likely change in the future, so please don't use the system in your plugins yet. Since this is a new system that needs to be tested, we've decided to migrate only the 2FA for adding a new admin to the new system at this time (in this commit). Our plan is to gradually migrate the remaining 2FA implementations to the new system. For screenshots of the 2FA page, see PR #15377 on GitHub.
280 lines
8.3 KiB
JavaScript
280 lines
8.3 KiB
JavaScript
import {
|
|
acceptance,
|
|
exists,
|
|
query,
|
|
} from "discourse/tests/helpers/qunit-helpers";
|
|
import { click, currentURL, fillIn, visit } from "@ember/test-helpers";
|
|
import { SECOND_FACTOR_METHODS } from "discourse/models/user";
|
|
import { test } from "qunit";
|
|
|
|
const { TOTP, BACKUP_CODE, SECURITY_KEY } = SECOND_FACTOR_METHODS;
|
|
|
|
const RESPONSES = {
|
|
failed: {
|
|
status: 404,
|
|
error: "could not find an active challenge in your session",
|
|
},
|
|
ok111111: {
|
|
totp_enabled: true,
|
|
backup_enabled: true,
|
|
security_keys_enabled: true,
|
|
allowed_methods: [TOTP, BACKUP_CODE, SECURITY_KEY],
|
|
},
|
|
ok111110: {
|
|
totp_enabled: true,
|
|
backup_enabled: true,
|
|
security_keys_enabled: true,
|
|
allowed_methods: [TOTP, BACKUP_CODE],
|
|
},
|
|
ok110111: {
|
|
totp_enabled: true,
|
|
backup_enabled: true,
|
|
security_keys_enabled: false,
|
|
allowed_methods: [TOTP, BACKUP_CODE, SECURITY_KEY],
|
|
},
|
|
ok100111: {
|
|
totp_enabled: true,
|
|
backup_enabled: false,
|
|
security_keys_enabled: false,
|
|
allowed_methods: [TOTP, BACKUP_CODE, SECURITY_KEY],
|
|
},
|
|
ok111010: {
|
|
totp_enabled: true,
|
|
backup_enabled: true,
|
|
security_keys_enabled: true,
|
|
allowed_methods: [BACKUP_CODE],
|
|
},
|
|
};
|
|
|
|
const WRONG_TOTP = "124323";
|
|
let callbackCount = 0;
|
|
|
|
acceptance("Second Factor Auth Page", function (needs) {
|
|
needs.user();
|
|
needs.pretender((server, helpers) => {
|
|
server.get("/session/2fa.json", (request) => {
|
|
const response = { ...RESPONSES[request.queryParams.nonce] };
|
|
const status = response.status || 200;
|
|
delete response.status;
|
|
return [status, { "Content-Type": "application/json" }, response];
|
|
});
|
|
|
|
server.post("/session/2fa", (request) => {
|
|
const params = helpers.parsePostData(request.requestBody);
|
|
if (params.second_factor_token === WRONG_TOTP) {
|
|
return [
|
|
401,
|
|
{ "Content-Type": "application/json" },
|
|
{
|
|
error: "invalid token man",
|
|
ok: false,
|
|
},
|
|
];
|
|
} else {
|
|
return [
|
|
200,
|
|
{ "Content-Type": "application/json" },
|
|
{
|
|
ok: true,
|
|
callback_method: "PUT",
|
|
callback_path: "/callback-path",
|
|
redirect_path: "/",
|
|
},
|
|
];
|
|
}
|
|
});
|
|
|
|
server.put("/callback-path", () => {
|
|
callbackCount++;
|
|
return [
|
|
200,
|
|
{ "Content-Type": "application/json" },
|
|
{
|
|
whatever: true,
|
|
},
|
|
];
|
|
});
|
|
});
|
|
|
|
needs.hooks.beforeEach(() => (callbackCount = 0));
|
|
|
|
test("when challenge data fails to load", async function (assert) {
|
|
await visit("/session/2fa?nonce=failed");
|
|
assert.equal(
|
|
query(".alert-error").textContent,
|
|
"could not find an active challenge in your session",
|
|
"load error message is shown"
|
|
);
|
|
});
|
|
|
|
test("default 2FA method", async function (assert) {
|
|
await visit("/session/2fa?nonce=ok111111");
|
|
assert.ok(
|
|
exists("#security-key-authenticate-button"),
|
|
"security key is the default method"
|
|
);
|
|
assert.ok(
|
|
!exists("form.totp-token"),
|
|
"totp is not shown by default when security key is allowed"
|
|
);
|
|
assert.ok(
|
|
!exists("form.backup-code-token"),
|
|
"backup code form is not shown by default when security key is allowed"
|
|
);
|
|
|
|
await visit("/");
|
|
await visit("/session/2fa?nonce=ok111110");
|
|
assert.ok(
|
|
!exists("#security-key-authenticate-button"),
|
|
"security key method is not shown when it's not allowed"
|
|
);
|
|
assert.ok(
|
|
exists("form.totp-token"),
|
|
"totp is the default method when security key is not allowed"
|
|
);
|
|
assert.ok(
|
|
!exists("form.backup-code-token"),
|
|
"backup code form is not shown by default when TOTP is allowed"
|
|
);
|
|
|
|
await visit("/");
|
|
await visit("/session/2fa?nonce=ok110111");
|
|
assert.ok(
|
|
!exists("#security-key-authenticate-button"),
|
|
"security key method is not shown when it's not enabled"
|
|
);
|
|
assert.ok(
|
|
exists("form.totp-token"),
|
|
"totp is the default method when security key is not enabled"
|
|
);
|
|
assert.ok(
|
|
!exists("form.backup-code-token"),
|
|
"backup code form is not shown by default when TOTP is enabled"
|
|
);
|
|
});
|
|
|
|
test("alternative 2FA methods", async function (assert) {
|
|
await visit("/session/2fa?nonce=ok111111");
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.totp"),
|
|
"TOTP is shown as an alternative method if it's enabled and allowed"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.backup-code"),
|
|
"backup code is shown as an alternative method if it's enabled and allowed"
|
|
);
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method.security-key"),
|
|
"security key is not shown as an alternative method when it's selected"
|
|
);
|
|
|
|
await visit("/");
|
|
await visit("/session/2fa?nonce=ok100111");
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method"),
|
|
"no alternative methods are shown if only 1 method is enabled"
|
|
);
|
|
|
|
await visit("/");
|
|
await visit("/session/2fa?nonce=ok111010");
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method"),
|
|
"no alternative methods are shown if only 1 method is allowed"
|
|
);
|
|
});
|
|
|
|
test("switching 2FA methods", async function (assert) {
|
|
await visit("/session/2fa?nonce=ok111111");
|
|
assert.ok(
|
|
exists("#security-key-authenticate-button"),
|
|
"security key form is shown because it's the default"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.totp"),
|
|
"TOTP is shown as an alternative method"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.backup-code"),
|
|
"backup code is shown as an alternative method"
|
|
);
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method.security-key"),
|
|
"security key is not shown as an alternative method because it's selected"
|
|
);
|
|
|
|
await click(".toggle-second-factor-method.totp");
|
|
assert.ok(exists("form.totp-token"), "TOTP form is now shown");
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.security-key"),
|
|
"security key is now shown as alternative method"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.backup-code"),
|
|
"backup code is still shown as an alternative method"
|
|
);
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method.totp"),
|
|
"TOTP is no longer shown as an alternative method"
|
|
);
|
|
|
|
await click(".toggle-second-factor-method.backup-code");
|
|
assert.ok(
|
|
exists("form.backup-code-token"),
|
|
"backup code form is now shown"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.security-key"),
|
|
"security key is still shown as alternative method"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.totp"),
|
|
"TOTP is now shown as an alternative method"
|
|
);
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method.backup-code"),
|
|
"backup code is no longer shown as an alternative method"
|
|
);
|
|
|
|
await click(".toggle-second-factor-method.security-key");
|
|
assert.ok(
|
|
exists("#security-key-authenticate-button"),
|
|
"security key form is back"
|
|
);
|
|
assert.ok(
|
|
!exists(".toggle-second-factor-method.security-key"),
|
|
"security key is no longer shown as alternative method"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.totp"),
|
|
"TOTP is now shown as an alternative method"
|
|
);
|
|
assert.ok(
|
|
exists(".toggle-second-factor-method.backup-code"),
|
|
"backup code is now shown as an alternative method"
|
|
);
|
|
});
|
|
|
|
test("error when submitting 2FA form", async function (assert) {
|
|
await visit("/session/2fa?nonce=ok110111");
|
|
await fillIn("form.totp-token .second-factor-token-input", WRONG_TOTP);
|
|
await click('form.totp-token .btn-primary[type="submit"]');
|
|
assert.equal(
|
|
query(".alert-error").textContent.trim(),
|
|
"invalid token man",
|
|
"error message from the server is displayed"
|
|
);
|
|
});
|
|
|
|
test("successful 2FA form submit", async function (assert) {
|
|
await visit("/session/2fa?nonce=ok110111");
|
|
await fillIn("form.totp-token .second-factor-token-input", "323421");
|
|
await click('form.totp-token .btn-primary[type="submit"]');
|
|
assert.equal(
|
|
currentURL(),
|
|
"/",
|
|
"user has been redirected to the redirect_path"
|
|
);
|
|
assert.equal(callbackCount, 1, "callback request has been performed");
|
|
});
|
|
});
|