70 lines
2.0 KiB
Go
70 lines
2.0 KiB
Go
|
package onboarding
|
||
|
|
|
||
|
|
import (
|
||
|
|
"github.com/google/uuid"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestSMSCaptchaRequiredBeforeDelivery(t *testing.T) {
|
||
|
|
f := newLoginFixture(t)
|
||
|
|
input := SMSSendInput{Phone: f.phone, Purpose: "LOGIN"}
|
||
|
|
send := func(id string) int {
|
||
|
|
w, _ := f.request("POST", "/api/v1/web/login/sms/send", input, f.cookie, f.csrf, id)
|
||
|
|
return w.Code
|
||
|
|
}
|
||
|
|
if send("") != 401 || f.sender.calls != 0 {
|
||
|
|
t.Fatal("missing image challenge sent SMS")
|
||
|
|
}
|
||
|
|
input = f.smsInput()
|
||
|
|
input.CaptchaCode = "000000"
|
||
|
|
if send("") != 401 || f.sender.calls != 0 {
|
||
|
|
t.Fatal("wrong image answer sent SMS")
|
||
|
|
}
|
||
|
|
input.CaptchaCode = "654321"
|
||
|
|
if send("") != 401 {
|
||
|
|
t.Fatal("failed image answer was reusable")
|
||
|
|
}
|
||
|
|
input.CaptchaID = f.knownCaptchaFor("another-browser")
|
||
|
|
if send("") != 401 {
|
||
|
|
t.Fatal("foreign browser image accepted")
|
||
|
|
}
|
||
|
|
input = f.smsInput()
|
||
|
|
must(t, f.s.redis.Expire(f.ctx, f.s.captchaKey(digest([]byte(f.cookie.Value))), -time.Second).Err())
|
||
|
|
if send("") != 401 {
|
||
|
|
t.Fatal("expired image accepted")
|
||
|
|
}
|
||
|
|
input = f.smsInput()
|
||
|
|
id := uuid.NewString()
|
||
|
|
if send(id) != 200 || f.sender.calls != 1 {
|
||
|
|
t.Fatal("valid image did not send SMS")
|
||
|
|
}
|
||
|
|
if send(id) != 200 || f.sender.calls != 1 {
|
||
|
|
t.Fatal("exact retry delivered twice")
|
||
|
|
}
|
||
|
|
if send("") != 401 || f.sender.calls != 1 {
|
||
|
|
t.Fatal("image replay delivered again")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestSetupSMSCaptchaIsBoundToSetupSession(t *testing.T) {
|
||
|
|
f := newLoginFixture(t)
|
||
|
|
image, err := f.s.webCaptcha(f.ctx, f.web)
|
||
|
|
must(t, err)
|
||
|
|
if image["image"] == nil {
|
||
|
|
t.Fatal("missing setup captcha")
|
||
|
|
}
|
||
|
|
in := SMSSendInput{Phone: f.phone, Purpose: "LOGIN"}
|
||
|
|
if _, err = f.s.SendSMS(f.ctx, f.web, uuid.NewString(), in); err == nil || f.sender.calls != 0 {
|
||
|
|
t.Fatal("setup SMS bypassed image")
|
||
|
|
}
|
||
|
|
in.CaptchaID, in.CaptchaCode = f.knownCaptcha(), "654321"
|
||
|
|
if _, err = f.s.SendSMS(f.ctx, f.web, uuid.NewString(), in); err == nil {
|
||
|
|
t.Fatal("login captcha crossed into setup")
|
||
|
|
}
|
||
|
|
in.CaptchaID = f.knownCaptchaFor(f.web.Hash)
|
||
|
|
if _, err = f.s.SendSMS(f.ctx, f.web, uuid.NewString(), in); err != nil || f.sender.calls != 1 {
|
||
|
|
t.Fatal("setup captcha rejected", err)
|
||
|
|
}
|
||
|
|
}
|