feat(KAN-37): rebuild security and application key settings

tests/Feature/Settings/SecurityTest.php

@@ -6,6 +6,7 @@ use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Hash;
 use Inertia\Testing\AssertableInertia as Assert;
+use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
 use Laravel\Fortify\Features;
 use Tests\TestCase;
 
@@ -249,4 +250,55 @@ class SecurityTest extends TestCase
 
         $this->assertTrue(Hash::check('password', $user->fresh()->password));
     }
+
+    public function test_two_factor_setup_requires_a_valid_code_before_protection_is_enabled(): void
+    {
+        $user = User::factory()->create();
+        $this->actingAs($user)->withSession(['auth.password_confirmed_at' => time()])
+            ->from(route('security.edit'))
+            ->post(route('two-factor.enable'))->assertSessionHasNoErrors();
+
+        $this->assertNotNull($user->refresh()->two_factor_secret);
+        $this->assertFalse($user->hasEnabledTwoFactorAuthentication());
+        $this->getJson(route('two-factor.secret-key'))->assertOk()->assertJsonStructure(['secretKey']);
+        $this->getJson(route('two-factor.qr-code'))->assertOk()->assertJsonStructure(['svg']);
+
+        $this->mock(TwoFactorAuthenticationProvider::class, function ($mock): void {
+            $mock->shouldReceive('verify')->withArgs(fn ($secret, $code) => $code === '000000')->once()->andReturn(false);
+            $mock->shouldReceive('verify')->withArgs(fn ($secret, $code) => $code === '123456')->once()->andReturn(true);
+        });
+        $this->post(route('two-factor.confirm'), ['code' => '000000'])
+            ->assertSessionHasErrors('code', errorBag: 'confirmTwoFactorAuthentication');
+        $this->assertFalse($user->refresh()->hasEnabledTwoFactorAuthentication());
+        $this->post(route('two-factor.confirm'), ['code' => '123456'])->assertSessionHasNoErrors();
+        $this->assertTrue($user->refresh()->hasEnabledTwoFactorAuthentication());
+    }
+
+    public function test_recovery_codes_can_be_retrieved_regenerated_and_removed_with_two_factor(): void
+    {
+        $user = User::factory()->withTwoFactor()->create();
+        $this->actingAs($user)->withSession(['auth.password_confirmed_at' => time()]);
+        $oldCodes = $this->getJson(route('two-factor.recovery-codes'))->assertOk()->json();
+        $this->assertSame($user->recoveryCodes(), $oldCodes);
+        $this->post(route('two-factor.regenerate-recovery-codes'))->assertSessionHasNoErrors();
+        $newCodes = $this->getJson(route('two-factor.recovery-codes'))->assertOk()->json();
+        $this->assertCount(8, $newCodes);
+        $this->assertEmpty(array_intersect($oldCodes, $newCodes));
+        $this->delete(route('two-factor.disable'))->assertSessionHasNoErrors();
+        $this->assertNull($user->refresh()->two_factor_secret);
+        $this->assertNull($user->two_factor_recovery_codes);
+        $this->assertFalse($user->hasEnabledTwoFactorAuthentication());
+    }
+
+    public function test_sensitive_two_factor_endpoints_reject_expired_password_confirmation(): void
+    {
+        $user = User::factory()->withTwoFactor()->create();
+        $this->actingAs($user);
+        foreach (['two-factor.qr-code', 'two-factor.secret-key', 'two-factor.recovery-codes'] as $route) {
+            $this->getJson(route($route))->assertStatus(423);
+        }
+        $this->deleteJson(route('two-factor.disable'))->assertStatus(423);
+        $this->postJson(route('two-factor.regenerate-recovery-codes'))->assertStatus(423);
+        $this->assertTrue($user->refresh()->hasEnabledTwoFactorAuthentication());
+    }
 }

tests/Feature/Settings/SecurityUiTest.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Tests\Feature\Settings;
+
+use Symfony\Component\Process\Process;
+use Tests\TestCase;
+
+class SecurityUiTest extends TestCase
+{
+    public function test_security_and_application_key_rendering(): void
+    {
+        $process = new Process(['node', 'tests/Fixtures/security.mjs'], base_path());
+        $process->setTimeout(60);
+        $process->run();
+        $this->assertTrue($process->isSuccessful(), $process->getOutput().$process->getErrorOutput());
+        $this->assertStringContainsString('Security UI rendering checks passed.', $process->getOutput());
+    }
+}

tests/Feature/Settings/UserApplicationTest.php

@@ -25,7 +25,9 @@ class UserApplicationTest extends TestCase
             ->assertInertia(fn (Assert $page) => $page
                 ->component('settings/Applications')
                 ->where('applications.0.name', 'Claude Desktop')
-                ->where('applicationKey', null),
+                ->where('applicationKey', null)
+                ->missing('applications.0.key_hash')
+                ->missing('applications.0.plain_text_key'),
             );
     }
 
@@ -100,4 +102,26 @@ class UserApplicationTest extends TestCase
             'id' => $application->id,
         ]);
     }
+
+    public function test_application_list_only_contains_the_current_users_keys(): void
+    {
+        $user = User::factory()->create();
+        UserApplication::factory()->for($user)->create(['name' => 'Own tool']);
+        UserApplication::factory()->create(['name' => 'Foreign tool']);
+        $this->actingAs($user)->get(route('applications.edit'))
+            ->assertInertia(fn (Assert $page) => $page
+                ->has('applications', 1)
+                ->where('applications.0.name', 'Own tool')
+                ->where('applicationKey', null));
+    }
+
+    public function test_invalid_application_name_does_not_issue_a_key(): void
+    {
+        $user = User::factory()->create();
+        $this->actingAs($user)->from(route('applications.edit'))
+            ->post(route('applications.store'), ['name' => ''])
+            ->assertSessionHasErrors('name')
+            ->assertSessionMissing('applicationKey');
+        $this->assertDatabaseCount('user_applications', 0);
+    }
 }