feat(KAN-21): rebuild login verification and two-factor flows

2026-09-10 11:02:15 +02:00
parent 7edd8daf49
commit a43aff0477
17 changed files with 1294 additions and 250 deletions
@@ -4,7 +4,9 @@ namespace Tests\Feature\Auth;

 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Auth;
 use Inertia\Testing\AssertableInertia as Assert;
+use Laravel\Fortify\Contracts\TwoFactorAuthenticationProvider;
 use Laravel\Fortify\Features;
 use Tests\TestCase;

@@ -52,4 +54,77 @@ class TwoFactorChallengeTest extends TestCase
                ->component('auth/TwoFactorChallenge'),
            );
    }
+
+    public function test_valid_authenticator_code_completes_the_pending_login(): void
+    {
+        $user = User::factory()->withTwoFactor()->create();
+        $this->mock(TwoFactorAuthenticationProvider::class)
+            ->shouldReceive('verify')->once()->with('secret', '012345')->andReturnTrue();
+
+        $this->withSession(['url.intended' => route('dashboard')])
+            ->post(route('login.store'), [
+                'email' => $user->email,
+                'password' => 'password',
+                'remember' => true,
+            ])->assertRedirect(route('two-factor.login'));
+        $this->assertGuest();
+
+        $this->post(route('two-factor.login.store'), ['code' => '012345'])
+            ->assertRedirect(route('dashboard'))
+            ->assertSessionMissing('login.id')
+            ->assertSessionMissing('login.remember')
+            ->assertCookie(Auth::guard('web')->getRecallerName());
+
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_invalid_authenticator_code_keeps_the_pending_login_for_retry(): void
+    {
+        $user = User::factory()->withTwoFactor()->create();
+        $this->mock(TwoFactorAuthenticationProvider::class)
+            ->shouldReceive('verify')->once()->with('secret', '000000')->andReturnFalse();
+
+        $this->withSession(['login.id' => $user->id])
+            ->from(route('two-factor.login'))
+            ->post(route('two-factor.login.store'), ['code' => '000000'])
+            ->assertRedirect(route('two-factor.login'))
+            ->assertSessionHasErrors('code')
+            ->assertSessionHas('login.id', $user->id);
+
+        $this->assertGuest();
+    }
+
+    public function test_recovery_code_signs_in_once_and_is_replaced(): void
+    {
+        $user = User::factory()->withTwoFactor()->create();
+
+        $this->withSession(['login.id' => $user->id, 'login.remember' => true])
+            ->post(route('two-factor.login.store'), ['recovery_code' => 'recovery-code-1'])
+            ->assertRedirect(route('dashboard', absolute: false))
+            ->assertSessionMissing('login.id')
+            ->assertCookie(Auth::guard('web')->getRecallerName());
+
+        $this->assertAuthenticatedAs($user);
+        $this->assertNotContains('recovery-code-1', $user->fresh()->recoveryCodes());
+        $this->assertCount(1, $user->fresh()->recoveryCodes());
+
+        $this->post(route('logout'));
+        $this->withSession(['login.id' => $user->id])
+            ->post(route('two-factor.login.store'), ['recovery_code' => 'recovery-code-1'])
+            ->assertSessionHasErrors('recovery_code')
+            ->assertSessionHas('login.id', $user->id);
+
+        $this->assertGuest();
+    }
+
+    public function test_challenge_submission_cannot_sign_in_without_a_pending_login(): void
+    {
+        $this->from(route('two-factor.login'))
+            ->post(route('two-factor.login.store'), ['code' => '012345'])
+            ->assertRedirect(route('two-factor.login'))
+            ->assertSessionHasErrors('code');
+
+        $this->assertGuest();
+        $this->get(route('two-factor.login'))->assertRedirect(route('login'));
+    }
 }