BookStack Code Mirror - bookstack/blob - tests/Auth/MfaConfigurationTest.php

   1 <?php
   2
   3 namespace Tests\Auth;
   4
   5 use BookStack\Actions\ActivityType;
   6 use BookStack\Auth\Access\Mfa\MfaValue;
   7 use BookStack\Auth\Role;
   8 use BookStack\Auth\User;
   9 use PragmaRX\Google2FA\Google2FA;
  10 use Tests\TestCase;
  11
  12 class MfaConfigurationTest extends TestCase
  13 {
  14     public function test_totp_setup()
  15     {
  16         $editor = $this->users->editor();
  17         $this->assertDatabaseMissing('mfa_values', ['user_id' => $editor->id]);
  18
  19         // Setup page state
  20         $resp = $this->actingAs($editor)->get('/mfa/setup');
  21         $this->withHtml($resp)->assertElementContains('a[href$="/mfa/totp/generate"]', 'Setup');
  22
  23         // Generate page access
  24         $resp = $this->get('/mfa/totp/generate');
  25         $resp->assertSee('Mobile App Setup');
  26         $resp->assertSee('Verify Setup');
  27         $this->withHtml($resp)->assertElementExists('form[action$="/mfa/totp/confirm"] button');
  28         $this->assertSessionHas('mfa-setup-totp-secret');
  29         $svg = $this->withHtml($resp)->getOuterHtml('#main-content .card svg');
  30
  31         // Validation error, code should remain the same
  32         $resp = $this->post('/mfa/totp/confirm', [
  33             'code' => 'abc123',
  34         ]);
  35         $resp->assertRedirect('/mfa/totp/generate');
  36         $resp = $this->followRedirects($resp);
  37         $resp->assertSee('The provided code is not valid or has expired.');
  38         $revisitSvg = $this->withHtml($resp)->getOuterHtml('#main-content .card svg');
  39         $this->assertTrue($svg === $revisitSvg);
  40         $secret = decrypt(session()->get('mfa-setup-totp-secret'));
  41
  42         $resp->assertSee("?secret={$secret}&issuer=BookStack&algorithm=SHA1&digits=6&period=30");
  43
  44         // Successful confirmation
  45         $google2fa = new Google2FA();
  46         $otp = $google2fa->getCurrentOtp($secret);
  47         $resp = $this->post('/mfa/totp/confirm', [
  48             'code' => $otp,
  49         ]);
  50         $resp->assertRedirect('/mfa/setup');
  51
  52         // Confirmation of setup
  53         $resp = $this->followRedirects($resp);
  54         $resp->assertSee('Multi-factor method successfully configured');
  55         $this->withHtml($resp)->assertElementContains('a[href$="/mfa/totp/generate"]', 'Reconfigure');
  56
  57         $this->assertDatabaseHas('mfa_values', [
  58             'user_id' => $editor->id,
  59             'method'  => 'totp',
  60         ]);
  61         $this->assertFalse(session()->has('mfa-setup-totp-secret'));
  62         $value = MfaValue::query()->where('user_id', '=', $editor->id)
  63             ->where('method', '=', 'totp')->first();
  64         $this->assertEquals($secret, decrypt($value->value));
  65     }
  66
  67     public function test_backup_codes_setup()
  68     {
  69         $editor = $this->users->editor();
  70         $this->assertDatabaseMissing('mfa_values', ['user_id' => $editor->id]);
  71
  72         // Setup page state
  73         $resp = $this->actingAs($editor)->get('/mfa/setup');
  74         $this->withHtml($resp)->assertElementContains('a[href$="/mfa/backup_codes/generate"]', 'Setup');
  75
  76         // Generate page access
  77         $resp = $this->get('/mfa/backup_codes/generate');
  78         $resp->assertSee('Backup Codes');
  79         $this->withHtml($resp)->assertElementContains('form[action$="/mfa/backup_codes/confirm"]', 'Confirm and Enable');
  80         $this->assertSessionHas('mfa-setup-backup-codes');
  81         $codes = decrypt(session()->get('mfa-setup-backup-codes'));
  82         // Check code format
  83         $this->assertCount(16, $codes);
  84         $this->assertEquals(16 * 11, strlen(implode('', $codes)));
  85         // Check download link
  86         $resp->assertSee(base64_encode(implode("\n\n", $codes)));
  87
  88         // Confirm submit
  89         $resp = $this->post('/mfa/backup_codes/confirm');
  90         $resp->assertRedirect('/mfa/setup');
  91
  92         // Confirmation of setup
  93         $resp = $this->followRedirects($resp);
  94         $resp->assertSee('Multi-factor method successfully configured');
  95         $this->withHtml($resp)->assertElementContains('a[href$="/mfa/backup_codes/generate"]', 'Reconfigure');
  96
  97         $this->assertDatabaseHas('mfa_values', [
  98             'user_id' => $editor->id,
  99             'method'  => 'backup_codes',
 100         ]);
 101         $this->assertFalse(session()->has('mfa-setup-backup-codes'));
 102         $value = MfaValue::query()->where('user_id', '=', $editor->id)
 103             ->where('method', '=', 'backup_codes')->first();
 104         $this->assertEquals($codes, json_decode(decrypt($value->value)));
 105     }
 106
 107     public function test_backup_codes_cannot_be_confirmed_if_not_previously_generated()
 108     {
 109         $resp = $this->asEditor()->post('/mfa/backup_codes/confirm');
 110         $resp->assertStatus(500);
 111     }
 112
 113     public function test_mfa_method_count_is_visible_on_user_edit_page()
 114     {
 115         $user = $this->users->editor();
 116         $resp = $this->actingAs($this->users->admin())->get($user->getEditUrl());
 117         $resp->assertSee('0 methods configured');
 118
 119         MfaValue::upsertWithValue($user, MfaValue::METHOD_TOTP, 'test');
 120         $resp = $this->get($user->getEditUrl());
 121         $resp->assertSee('1 method configured');
 122
 123         MfaValue::upsertWithValue($user, MfaValue::METHOD_BACKUP_CODES, 'test');
 124         $resp = $this->get($user->getEditUrl());
 125         $resp->assertSee('2 methods configured');
 126     }
 127
 128     public function test_mfa_setup_link_only_shown_when_viewing_own_user_edit_page()
 129     {
 130         $admin = $this->users->admin();
 131         $resp = $this->actingAs($admin)->get($admin->getEditUrl());
 132         $this->withHtml($resp)->assertElementExists('a[href$="/mfa/setup"]');
 133
 134         $resp = $this->actingAs($admin)->get($this->users->editor()->getEditUrl());
 135         $this->withHtml($resp)->assertElementNotExists('a[href$="/mfa/setup"]');
 136     }
 137
 138     public function test_mfa_indicator_shows_in_user_list()
 139     {
 140         $admin = $this->users->admin();
 141         User::query()->where('id', '!=', $admin->id)->delete();
 142
 143         $resp = $this->actingAs($admin)->get('/settings/users');
 144         $this->withHtml($resp)->assertElementNotExists('[title="MFA Configured"] svg');
 145
 146         MfaValue::upsertWithValue($admin, MfaValue::METHOD_TOTP, 'test');
 147         $resp = $this->actingAs($admin)->get('/settings/users');
 148         $this->withHtml($resp)->assertElementExists('[title="MFA Configured"] svg');
 149     }
 150
 151     public function test_remove_mfa_method()
 152     {
 153         $admin = $this->users->admin();
 154
 155         MfaValue::upsertWithValue($admin, MfaValue::METHOD_TOTP, 'test');
 156         $this->assertEquals(1, $admin->mfaValues()->count());
 157         $resp = $this->actingAs($admin)->get('/mfa/setup');
 158         $this->withHtml($resp)->assertElementExists('form[action$="/mfa/totp/remove"]');
 159
 160         $resp = $this->delete('/mfa/totp/remove');
 161         $resp->assertRedirect('/mfa/setup');
 162         $resp = $this->followRedirects($resp);
 163         $resp->assertSee('Multi-factor method successfully removed');
 164
 165         $this->assertActivityExists(ActivityType::MFA_REMOVE_METHOD);
 166         $this->assertEquals(0, $admin->mfaValues()->count());
 167     }
 168
 169     public function test_totp_setup_url_shows_correct_user_when_setup_forced_upon_login()
 170     {
 171         $admin = $this->users->admin();
 172         /** @var Role $role */
 173         $role = $admin->roles()->first();
 174         $role->mfa_enforced = true;
 175         $role->save();
 176
 177         $resp = $this->post('/login', ['email' => $admin->email, 'password' => 'password']);
 178         $this->assertFalse(auth()->check());
 179         $resp->assertRedirect('/mfa/verify');
 180
 181         $resp = $this->get('/mfa/totp/generate');
 182         $resp->assertSeeText('Mobile App Setup');
 183         $resp->assertDontSee('otpauth://totp/BookStack:guest%40example.com', false);
 184         $resp->assertSee('otpauth://totp/BookStack:admin%40admin.com', false);
 185     }
 186 }