popertots
fe88f2084d
Loop B aggressive adversarial round (3 attack agents) + fix + secondary + verification:
- CRITICAL: sweep replay auto-refunds provably-created-later duplicate charges (gated on parseable CreatedAt); 22h legitimate-retry window == 22h sweep cutoff (no dead zone)
- HIGH: admin Take Payment clamps to remaining obligation (cash/giftcard/saved-card/terminal); no unintended tip from overflow; campaign credit against remaining
- HIGH: /api/services/eligible-for/{id} requires auth + owner-or-admin (DOB/age + patch-test health-data leak closed)
- HIGH: opaque refresh-token rotation (login/refresh return {token, jti, refreshToken}; refresh REQUIRES opaque token; single-use rotation; logout revokes; access token rejected at refresh)
- HIGH: saved-card charges require a REAL 2FA verification code (B6/B10) — backend gate on all 8 charge paths + shared TwoFactorCodeInput frontend component on all 7 surfaces; 2FA gate is no longer setup-flag-only
- MEDIUM: ungated CF-Connecting-IP in reserve/admin_reserve gated via exported mw.ClientIP; 2FA limiter keyed on userID alone (no header-rotation bypass); ChangePassword actually revokes JTI + refresh tokens; 2FA setup mint cooldown + persistent failed-attempt counter; campaign redemption race surfaces campaign_fully_redeemed
- Terminal saved-card VAT applied (was under-collected); age-guard reconcile failures notify; isWeakJWTSecret entropy gate; gift-card redeem per-card counter + per-user limiter; webhook signature key startup validation
- NEW internal/twofa package (single source of truth breaking the payments<->user import cycle); consolidation of duplicate 2FA hash/verify
- Frontend: refresh-token storage + rotation, TwoFactorCodeInput component, amountPaidPence in admin modal, B5/B6/B10 contract wiring; 70 frontend tests
- Tests: loop_b_fixes_test.go, internal/twofa tests, updated auth/services/profile/twofa/mw tests
All 26 backend packages pass (incl. internal/twofa); frontend 70/70 + build clean; env-docs 41/41.
92 lines
2.9 KiB
Go
92 lines
2.9 KiB
Go
//go:build test
|
|
|
|
package twofa
|
|
|
|
// Tests for the shared 2FA verification core (the package the payments
|
|
// card-access gate — B6/B10 — imports for real-challenge verification).
|
|
// The pepper provider is never registered here (handlers/user's build-tagged
|
|
// files register it), so Hash falls back to the legacy plain SHA-256 digest —
|
|
// which is exactly what the seeded pending-code hashes use.
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"crussell/clock"
|
|
"crussell/db"
|
|
"crussell/testutils"
|
|
"crussell/testutils/fixtures"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func seedPending(t *testing.T, ctx context.Context, tx db.Querier, userID, code string) {
|
|
t.Helper()
|
|
_, err := tx.Exec(ctx, `UPDATE users
|
|
SET two_factor_method = 'email',
|
|
two_factor_pending_code_hash = $2,
|
|
two_factor_pending_code_expires = $3
|
|
WHERE id = $1`, userID, Hash(code), clock.Now().Add(10*time.Minute))
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
func TestVerifyForUser_CorrectAndWrongCode(t *testing.T) {
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
require.NoError(t, err)
|
|
seedPending(t, ctx, tx, userID, "123456")
|
|
|
|
require.NoError(t, VerifyForUser(ctx, userID, "123456"), "correct code must verify")
|
|
require.ErrorIs(t, VerifyForUser(ctx, userID, "999999"), ErrIncorrect)
|
|
}
|
|
|
|
func TestVerifyForUser_LockoutAndMissing(t *testing.T) {
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
require.NoError(t, err)
|
|
seedPending(t, ctx, tx, userID, "123456")
|
|
|
|
// Wrong code #1 → ErrIncorrect; four more reach the 5-attempt cap.
|
|
require.ErrorIs(t, VerifyForUser(ctx, userID, "999999"), ErrIncorrect)
|
|
for i := 0; i < 4; i++ {
|
|
_ = VerifyForUser(ctx, userID, "999999")
|
|
}
|
|
require.ErrorIs(t, VerifyForUser(ctx, userID, "999999"), ErrLockedOut)
|
|
|
|
// A fresh user with no pending code → ErrMissingOrExpired.
|
|
userID2, err := fixtures.CreateTestUser(tx)
|
|
require.NoError(t, err)
|
|
require.ErrorIs(t, VerifyForUser(ctx, userID2, "123456"), ErrMissingOrExpired)
|
|
}
|
|
|
|
// TestVerifyForUser_AttemptStateMapPersists exercises the shared per-user
|
|
// attempt map directly (the state the payments gate shares with the interactive
|
|
// endpoints): the map is bounded and a locked-out record is never evicted.
|
|
func TestVerifyForUser_AttemptStateMapPersists(t *testing.T) {
|
|
t.Cleanup(func() {
|
|
MapMu.Lock()
|
|
Map = make(map[string]*AttemptState)
|
|
MaxTrackedAttempts = 10_000
|
|
MapMu.Unlock()
|
|
})
|
|
|
|
MapMu.Lock()
|
|
Map = make(map[string]*AttemptState)
|
|
MaxTrackedAttempts = 2
|
|
MapMu.Unlock()
|
|
|
|
// Fill the map with locked-out records; a new key must NOT evict one.
|
|
now := clock.Now()
|
|
for _, id := range []string{"victim_a", "victim_b"} {
|
|
st := &AttemptState{}
|
|
st.SetLastActive(now)
|
|
st.Count.Store(MaxAttempts)
|
|
Map[id] = st
|
|
}
|
|
_ = StateFor("new_user") // transient, untracked (map full of lockouts)
|
|
MapMu.Lock()
|
|
defer MapMu.Unlock()
|
|
require.Len(t, Map, 2, "locked-out records must survive the cap pressure")
|
|
}
|