mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
121 lines
4.3 KiB
Go
121 lines
4.3 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"io"
|
|
"strconv"
|
|
"testing"
|
|
|
|
auth_model "github.com/hanzoai/git/models/auth"
|
|
"github.com/hanzoai/git/models/db"
|
|
"github.com/hanzoai/git/models/unittest"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestDisableTwoFactorCommand(t *testing.T) {
|
|
ctx := t.Context()
|
|
|
|
defer func() {
|
|
require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
|
|
}()
|
|
|
|
t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
|
|
require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "[email protected]", "--random-password"}))
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
|
|
|
|
// Enroll TOTP.
|
|
tf := &auth_model.TwoFactor{UID: user.ID}
|
|
require.NoError(t, tf.SetSecret("test-secret"))
|
|
_, err := tf.GenerateScratchToken()
|
|
require.NoError(t, err)
|
|
require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
|
|
|
|
// Register a WebAuthn credential.
|
|
_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
|
|
require.NoError(t, err)
|
|
|
|
has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
|
|
require.NoError(t, err)
|
|
require.True(t, has)
|
|
|
|
require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
|
|
|
|
// Both factors must be gone afterwards.
|
|
has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
|
|
require.NoError(t, err)
|
|
assert.False(t, has)
|
|
})
|
|
|
|
t.Run("disable by id", func(t *testing.T) {
|
|
require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "[email protected]", "--random-password"}))
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
|
|
|
|
tf := &auth_model.TwoFactor{UID: user.ID}
|
|
require.NoError(t, tf.SetSecret("test-secret"))
|
|
require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
|
|
|
|
require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
|
|
|
|
has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
|
|
require.NoError(t, err)
|
|
assert.False(t, has)
|
|
})
|
|
|
|
t.Run("no enrollment is a no-op", func(t *testing.T) {
|
|
require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "[email protected]", "--random-password"}))
|
|
require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
|
|
})
|
|
|
|
t.Run("id and username must match when both given", func(t *testing.T) {
|
|
require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "[email protected]", "--random-password"}))
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
|
|
id := strconv.FormatInt(user.ID, 10)
|
|
|
|
// Matching id + username is accepted.
|
|
require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
|
|
|
|
// Mismatched id + username is rejected.
|
|
cmd := microcmdUserDisableTwoFactor()
|
|
cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
|
|
err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), "does not match the provided username")
|
|
})
|
|
|
|
t.Run("failure cases", func(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
args []string
|
|
expectedErr string
|
|
}{
|
|
{
|
|
name: "user does not exist",
|
|
args: []string{"disable-2fa", "--username", "nonexistentuser"},
|
|
expectedErr: "user does not exist",
|
|
},
|
|
{
|
|
name: "neither id nor username",
|
|
args: []string{"disable-2fa"},
|
|
expectedErr: "either --id or --username must be provided",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
cmd := microcmdUserDisableTwoFactor()
|
|
cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
|
|
err := cmd.Run(ctx, tc.args)
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), tc.expectedErr)
|
|
})
|
|
}
|
|
})
|
|
}
|