Codex Local
bf1233d5df
ci / verify (push) Canceled after 0s
Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
70 lines
2.2 KiB
Go
70 lines
2.2 KiB
Go
package onboarding
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
func TestSMSLoginSelectsRegistrationOrExistingAccountTemplate(t *testing.T) {
|
|
for _, registered := range []bool{false, true} {
|
|
name := "register"
|
|
if registered {
|
|
name = "login"
|
|
}
|
|
t.Run(name, func(t *testing.T) {
|
|
f := newLoginFixture(t)
|
|
if registered {
|
|
_, err := f.s.pool.Exec(f.ctx, `INSERT INTO customer_phone_credential(phone_digest,phone_masked,issuer,subject) VALUES($1,$2,$3,$4)`, domainMAC(f.s.crypt.hashKey, "PHONE1\n"+f.phone), "+86138****0000", f.user.Issuer, f.user.Subject)
|
|
must(t, err)
|
|
}
|
|
f.send()
|
|
want := SMSPurposeRegister
|
|
if registered {
|
|
want = SMSPurposeLogin
|
|
}
|
|
if f.sender.purpose != want {
|
|
t.Fatalf("expected %s, got %s", want, f.sender.purpose)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSMSPasswordPurposeAndIdempotencyAreBoundTogether(t *testing.T) {
|
|
f := newLoginFixture(t)
|
|
in := f.smsInput()
|
|
in.Purpose = SMSPurposeChangePassword
|
|
id := uuid.NewString()
|
|
w, first := f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, id)
|
|
if w.Code != 200 || f.sender.purpose != SMSPurposeChangePassword {
|
|
t.Fatal("wrong password template", w.Body.String())
|
|
}
|
|
w, again := f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, id)
|
|
if w.Code != 200 || first["sms_challenge_id"] != again["sms_challenge_id"] || f.sender.calls != 1 {
|
|
t.Fatal("replay sent a second message", w.Body.String())
|
|
}
|
|
in.Purpose = SMSPurposeLogin
|
|
w, _ = f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, id)
|
|
if w.Code != 409 || f.sender.calls != 1 {
|
|
t.Fatal("request ID reused across purposes", w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestSMSLoginRejectsPhoneChangePurpose(t *testing.T) {
|
|
f := newLoginFixture(t)
|
|
in := f.smsInput()
|
|
in.Purpose = SMSPurposeChangePhone
|
|
w, _ := f.request("POST", "/api/v1/web/login/sms/send", in, f.cookie, f.csrf, "")
|
|
if w.Code != 400 || f.sender.calls != 0 {
|
|
t.Fatal("phone change accepted by login", w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestSMSOperatorAlwaysUsesLoginTemplate(t *testing.T) {
|
|
f := newOperatorLoginFixture(t)
|
|
f.send()
|
|
if f.sender.purpose != SMSPurposeLogin {
|
|
t.Fatal("unprovisioned operator received a registration message")
|
|
}
|
|
}
|