popertots
f9e8385d5a
- TWO_FACTOR_ALLOW_LOG_DELIVERY production opt-in REMOVED: plaintext codes are written to the stdout log ([2FA]/[VERIFY]) only in dev/test builds as a local DEV ONLY feature while email/SMS delivery (P6) is implemented. Production builds have no delivery channel and code issuance fails closed (503) under any configuration — no silent log-based code leak - verification/2FA codes hashed at rest (HMAC-SHA256 via TWO_FACTOR_PEPPER, CHAR(64)); [VERIFY] dev log relay; per-user brute-force budget; password_reset purpose clears lockout for self-service recovery; dummy-bcrypt on login no-user path kills timing oracle - sabredav weak-password list + entropy gate; .env.example ships fail-closed DAV_ADMIN_PASSWORD - delete-account re-auth (current_password + fresh 2FA code when enforced) - prod-tag suite (run-prod-tag-tests.sh) compiles and runs the production 2FA issuance gate: production ALWAYS reports no delivery channel and refuses issuance after the pepper check - startup_checks_test SNAPSHOT_ENC_KEY values built at runtime so gitleaks sees no secret-shaped literals - env-docs parity updated (flag removed, 38 vars)
63 lines
2.7 KiB
Go
63 lines
2.7 KiB
Go
//go:build test
|
|
|
|
package user
|
|
|
|
// M17 follow-up (ITEM 2): twofa_prod.go is excluded from the test,dev suite
|
|
// (`!dev && !test`), so its fail-closed branches were never exercised in CI —
|
|
// the old twofa_prod_test.go only runs its assertions in a genuine production
|
|
// build and skips under the test tag. The pure decision logic now lives
|
|
// build-agnostically in twofa.go (twoFAEnsureIssueAllowedStrict /
|
|
// twoFAPepperConfigured / twoFADeliveryChannelConfigured); these tests exercise
|
|
// those branches in the STANDARD test,dev run, so a regression in the prod
|
|
// fail-closed behaviour is CI-visible even though the prod file itself is only
|
|
// compiled in a genuine production build.
|
|
//
|
|
// DELIVERY POSTURE (current): stdout-log delivery of 2FA codes is a
|
|
// DEV/TEST-ONLY local feature. Production has no delivery channel of any kind
|
|
// (email/SMS unwired, P6; no production opt-in to log delivery), so the strict
|
|
// gate refuses issuance unconditionally after the pepper check.
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestTwoFAEnsureIssueAllowedStrict_FailClosed pins the production-style
|
|
// issuance gate that twofa_prod.go's twoFAEnsureIssueAllowed delegates to:
|
|
// (a) pepper unset → issuance refused (errTwoFAPepperRequired — an unsalted
|
|
// digest in the 1M code space would be offline-brute-forceable);
|
|
// (b) pepper set but no delivery channel → issuance STILL refused
|
|
// (errTwoFADeliveryUnavailable — production has no channel until email/SMS
|
|
// lands, P6; the 503-style error the handlers surface as
|
|
// StatusServiceUnavailable). Issuance can never succeed in a production build
|
|
// until a real transport exists.
|
|
func TestTwoFAEnsureIssueAllowedStrict_FailClosed(t *testing.T) {
|
|
t.Run("pepper_unset_refuses_issuance", func(t *testing.T) {
|
|
t.Setenv(twoFAPepperEnv, "")
|
|
require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFAPepperRequired)
|
|
})
|
|
|
|
t.Run("no_delivery_channel_refuses_issuance", func(t *testing.T) {
|
|
t.Setenv(twoFAPepperEnv, "test-pepper")
|
|
require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFADeliveryUnavailable)
|
|
})
|
|
}
|
|
|
|
// TestTwoFADeliveryChannelConfigured pins the pure delivery-channel predicate:
|
|
// production has NO delivery channel — stdout-log delivery is a dev/test-only
|
|
// local feature and there is no production opt-in — so it is always false.
|
|
func TestTwoFADeliveryChannelConfigured(t *testing.T) {
|
|
t.Setenv(twoFAPepperEnv, "test-pepper")
|
|
require.False(t, twoFADeliveryChannelConfigured())
|
|
}
|
|
|
|
// TestTwoFAPepperConfigured pins the pure pepper predicate behind the
|
|
// pepper-required refusal.
|
|
func TestTwoFAPepperConfigured(t *testing.T) {
|
|
t.Setenv(twoFAPepperEnv, "")
|
|
require.False(t, twoFAPepperConfigured())
|
|
t.Setenv(twoFAPepperEnv, "test-pepper")
|
|
require.True(t, twoFAPepperConfigured())
|
|
}
|