feat: expand companion platform, device controls, and memoir workflows
ci / verify (push) Canceled after 0s
ci / verify (push) Canceled after 0s
Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
This commit is contained in:
Codex Local
@@ -0,0 +1,168 @@
|
||||
package onboarding
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
// Existing password/role tests use an explicitly preverified device fixture.
|
||||
// End-to-end SMS issuance is exercised separately below.
|
||||
func (f *loginFixture) trustDeviceForTest() {
|
||||
f.t.Helper()
|
||||
tx, err := f.s.pool.Begin(f.ctx)
|
||||
must(f.t, err)
|
||||
defer tx.Rollback(f.ctx)
|
||||
token, err := f.s.rememberLoginDevice(f.ctx, tx, domainMAC(f.s.crypt.hashKey, "PHONE1\n"+f.phone))
|
||||
must(f.t, err)
|
||||
must(f.t, tx.Commit(f.ctx))
|
||||
f.trusted = &http.Cookie{Name: f.s.trustedLoginCookieName(), Value: token}
|
||||
}
|
||||
|
||||
func TestNewDeviceRequiresSMSForBothPortals(t *testing.T) {
|
||||
for _, operator := range []bool{false, true} {
|
||||
name := "customer"
|
||||
if operator {
|
||||
name = "operator"
|
||||
}
|
||||
t.Run(name, func(t *testing.T) {
|
||||
f := newLoginFixture(t)
|
||||
if operator {
|
||||
f.s = f.s.operatorView()
|
||||
f.newLoginSession()
|
||||
_, err := f.s.ProvisionOperatorPhone(f.ctx, f.operatorID, f.p.Issuer, f.p.Subject, f.phone, "abc123", uuid.NewString())
|
||||
must(t, err)
|
||||
} else {
|
||||
_, err := f.s.ProvisionCustomerPhone(f.ctx, f.web.UserID, f.user.Issuer, f.user.Subject, f.phone, "abc123", uuid.NewString())
|
||||
must(t, err)
|
||||
}
|
||||
login := func(password string) int {
|
||||
w, _ := f.request("POST", "/api/v1/web/login/password", PasswordLoginInput{Phone: f.phone, Password: password, CaptchaID: f.knownCaptcha(), CaptchaCode: "654321"}, f.cookie, f.csrf, "")
|
||||
if w.Code == 403 && !strings.Contains(w.Body.String(), "NEW_DEVICE_SMS_REQUIRED") {
|
||||
t.Fatal(w.Body.String())
|
||||
}
|
||||
if w.Code != 200 {
|
||||
for _, c := range w.Result().Cookies() {
|
||||
if c.Name == f.s.cookieName(true) {
|
||||
t.Fatal("account issued before device verification")
|
||||
}
|
||||
}
|
||||
}
|
||||
return w.Code
|
||||
}
|
||||
if got := login("wrong1"); got != 401 {
|
||||
t.Fatalf("wrong password: %d", got)
|
||||
}
|
||||
if got := login("abc123"); got != 403 {
|
||||
t.Fatalf("new device: %d", got)
|
||||
}
|
||||
var consumed bool
|
||||
must(t, f.s.pool.QueryRow(f.ctx, "SELECT consumed_at IS NOT NULL FROM "+f.s.loginSessionTable()+" WHERE token_hash=$1", digest([]byte(f.cookie.Value))).Scan(&consumed))
|
||||
if consumed {
|
||||
t.Fatal("step-up consumed login session")
|
||||
}
|
||||
id := f.send()
|
||||
w, _ := f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: id, Code: "wrong"}, f.cookie, f.csrf, "")
|
||||
if w.Code == 200 || f.trusted != nil {
|
||||
t.Fatal("failed SMS trusted device")
|
||||
}
|
||||
w, _ = f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: id, Code: f.sender.code}, f.cookie, f.csrf, "")
|
||||
if w.Code != 200 || f.trusted == nil {
|
||||
t.Fatal(w.Body.String())
|
||||
}
|
||||
if !f.trusted.HttpOnly || !f.trusted.Secure || f.trusted.MaxAge != 30*86400 || f.trusted.SameSite != http.SameSiteLaxMode {
|
||||
t.Fatal("unsafe trust cookie")
|
||||
}
|
||||
if strings.Contains(w.Body.String(), f.trusted.Value) {
|
||||
t.Fatal("browser trust token leaked in JSON")
|
||||
}
|
||||
trusted := f.trusted
|
||||
f.newLoginSession()
|
||||
if got := login("abc123"); got != 200 {
|
||||
t.Fatalf("verified device: %d", got)
|
||||
}
|
||||
f.newLoginSession()
|
||||
f.trusted = nil
|
||||
if got := login("abc123"); got != 403 {
|
||||
t.Fatalf("new browser: %d", got)
|
||||
}
|
||||
f.trusted = &http.Cookie{Name: trusted.Name, Value: randomToken(32)}
|
||||
if got := login("abc123"); got != 403 {
|
||||
t.Fatalf("forged token: %d", got)
|
||||
}
|
||||
f.trusted = trusted
|
||||
_, err := f.s.pool.Exec(f.ctx, `UPDATE trusted_login_device SET expires_at=$2 WHERE token_hash=$1`, digest([]byte(trusted.Value)), time.Now().Add(-time.Minute))
|
||||
must(t, err)
|
||||
if got := login("abc123"); got != 403 {
|
||||
t.Fatalf("expired trust: %d", got)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTrustedDeviceBoundToPhoneRealmAndPassword(t *testing.T) {
|
||||
f := newLoginFixture(t)
|
||||
account, csrf := f.smsAccount()
|
||||
w, _ := f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "abc123"}, account, csrf, "")
|
||||
if w.Code != 200 {
|
||||
t.Fatal(w.Body.String())
|
||||
}
|
||||
oldDevice := f.trusted
|
||||
f.trustDeviceForTest()
|
||||
secondDevice := f.trusted
|
||||
f.trusted = oldDevice
|
||||
w, _ = f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "abc456", CurrentPassword: "abc123"}, account, csrf, "")
|
||||
if w.Code != 200 {
|
||||
t.Fatal(w.Body.String())
|
||||
}
|
||||
phoneHash := domainMAC(f.s.crypt.hashKey, "PHONE1\n"+f.phone)
|
||||
var encoded string
|
||||
must(t, f.s.pool.QueryRow(f.ctx, `SELECT password_hash FROM customer_phone_credential WHERE phone_digest=$1`, phoneHash).Scan(&encoded))
|
||||
tx, err := f.s.pool.Begin(f.ctx)
|
||||
must(t, err)
|
||||
defer tx.Rollback(f.ctx)
|
||||
must(t, f.s.requireTrustedLoginDevice(f.ctx, tx, phoneHash, encoded, oldDevice.Value))
|
||||
for _, test := range []struct {
|
||||
phone, hash, token string
|
||||
operator bool
|
||||
}{
|
||||
{phoneHash, encoded, secondDevice.Value, false},
|
||||
{phoneHash, encoded, oldDevice.Value, true},
|
||||
{strings.Repeat("0", 64), encoded, oldDevice.Value, false},
|
||||
{phoneHash, "administrative-reset", oldDevice.Value, false},
|
||||
} {
|
||||
view := *f.s
|
||||
view.operatorLogin = test.operator
|
||||
if view.requireTrustedLoginDevice(f.ctx, tx, test.phone, test.hash, test.token) == nil {
|
||||
t.Fatal("unrelated/revoked device accepted")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestMiniPasswordCannotBypassDeviceVerification(t *testing.T) {
|
||||
f := newLoginFixture(t)
|
||||
_, err := f.s.ProvisionCustomerPhone(f.ctx, f.web.UserID, f.user.Issuer, f.user.Subject, f.phone, "abc123", uuid.NewString())
|
||||
must(t, err)
|
||||
status, start := miniRequest(t, f.s, "POST", "/api/v1/mini/login/session", "", map[string]string{"portal": "customer"})
|
||||
if status != 200 {
|
||||
t.Fatal(status)
|
||||
}
|
||||
login := start["login_token"].(string)
|
||||
_, token, _ := miniCredential("MiniLogin "+login, "MiniLogin")
|
||||
hash := digest([]byte(token))
|
||||
status, _ = miniRequest(t, f.s, "POST", "/api/v1/mini/login/password", "MiniLogin "+login, PasswordLoginInput{Phone: f.phone, Password: "abc123", CaptchaID: f.knownCaptchaFor(hash), CaptchaCode: "654321"})
|
||||
if status != 403 {
|
||||
t.Fatal("native endpoint bypassed device verification", status)
|
||||
}
|
||||
status, challenge := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/send", "MiniLogin "+login, SMSSendInput{Phone: f.phone, Purpose: "LOGIN", CaptchaID: f.knownCaptchaFor(hash), CaptchaCode: "654321"})
|
||||
if status != 200 {
|
||||
t.Fatal(status)
|
||||
}
|
||||
status, result := miniRequest(t, f.s, "POST", "/api/v1/mini/login/sms/verify", "MiniLogin "+login, SMSVerifyInput{ChallengeID: challenge["sms_challenge_id"].(string), Code: f.sender.code})
|
||||
if status != 200 || result["trusted_device_token"] == nil {
|
||||
t.Fatal("native SMS trust missing", status)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user