81 lines
2.9 KiB
Go
81 lines
2.9 KiB
Go
|
package onboarding
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestSaaSCaptchaDisabledScope(t *testing.T) {
|
||
|
|
s := &Service{options: Options{SaaSCaptchaDisabled: true}}
|
||
|
|
if !s.saasCaptchaDisabled(context.Background()) {
|
||
|
|
t.Fatal("web not disabled")
|
||
|
|
}
|
||
|
|
mini := context.WithValue(context.Background(), captchaRequestKey{}, captchaRequestInfo{client: "mini_program"})
|
||
|
|
if s.saasCaptchaDisabled(mini) {
|
||
|
|
t.Fatal("mini affected")
|
||
|
|
}
|
||
|
|
s.options.SaaSCaptchaDisabled = false
|
||
|
|
if s.saasCaptchaDisabled(context.Background()) {
|
||
|
|
t.Fatal("default bypass")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestSaaSCaptchaDisabledSMSAndGuards(t *testing.T) {
|
||
|
|
f := newLoginFixture(t)
|
||
|
|
f.s.options.SaaSCaptchaDisabled = true
|
||
|
|
setCaptchaTestPolicy(t, f.fixture, "slide", "image")
|
||
|
|
w, ch := f.request("POST", "/api/v1/web/login/captcha", struct{}{}, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 200 || ch["mode"] != "none" || ch["image"] != nil {
|
||
|
|
t.Fatal(w.Body.String())
|
||
|
|
}
|
||
|
|
in := SMSSendInput{Phone: f.phone, Purpose: "LOGIN"}
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, "wrong", "")
|
||
|
|
if w.Code != 403 || f.sender.calls != 0 {
|
||
|
|
t.Fatal("CSRF bypass")
|
||
|
|
}
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, nil, f.csrf, "")
|
||
|
|
if w.Code != 401 || f.sender.calls != 0 {
|
||
|
|
t.Fatal("session bypass")
|
||
|
|
}
|
||
|
|
w, sms := f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 200 || f.sender.calls != 1 {
|
||
|
|
t.Fatal(w.Body.String())
|
||
|
|
}
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 429 || f.sender.calls != 1 {
|
||
|
|
t.Fatal("SMS cooldown bypass")
|
||
|
|
}
|
||
|
|
mini := context.WithValue(f.ctx, captchaRequestKey{}, captchaRequestInfo{client: "mini_program"})
|
||
|
|
if f.s.verifyLoginCaptcha(mini, digest([]byte(f.cookie.Value)), "", "") == nil {
|
||
|
|
t.Fatal("mini captcha bypass")
|
||
|
|
}
|
||
|
|
f.s.options.SaaSCaptchaDisabled = false
|
||
|
|
if f.s.verifyLoginCaptcha(f.ctx, digest([]byte(f.cookie.Value)), "", "") == nil {
|
||
|
|
t.Fatal("reenabling did not enforce proof")
|
||
|
|
}
|
||
|
|
f.s.options.SaaSCaptchaDisabled = true
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: sms["sms_challenge_id"].(string), Code: f.sender.code}, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 200 {
|
||
|
|
t.Fatal(w.Body.String())
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestSaaSCaptchaDisabledPassword(t *testing.T) {
|
||
|
|
f := newLoginFixture(t)
|
||
|
|
account, csrf := f.smsAccount()
|
||
|
|
w, _ := f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "LocalOnly123!"}, account, csrf, "")
|
||
|
|
if w.Code != 200 {
|
||
|
|
t.Fatal(w.Body.String())
|
||
|
|
}
|
||
|
|
f.s.options.SaaSCaptchaDisabled = true
|
||
|
|
f.newLoginSession()
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/password", PasswordLoginInput{Phone: f.phone, Password: "WrongPassword!"}, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 401 {
|
||
|
|
t.Fatal("wrong password accepted")
|
||
|
|
}
|
||
|
|
w, _ = f.request("POST", "/api/v1/web/login/password", PasswordLoginInput{Phone: f.phone, Password: "LocalOnly123!"}, f.cookie, f.csrf, "")
|
||
|
|
if w.Code != 200 {
|
||
|
|
t.Fatal(w.Body.String())
|
||
|
|
}
|
||
|
|
}
|