feat: popup quảng cáo, đặt lại mật khẩu bằng token 80 ký tự, 2FA email, vá lỗ hổng bảo mật
- Popup/banner quảng cáo cấu hình từ admin (loại, link, lịch hiển thị) - Đặt lại mật khẩu: token 80 ký tự kèm check digit Luhn thay cho token+email lộ trong URL, chỉ lưu bản băm, một lần dùng, hết hạn 60 phút - Xác thực 2 lớp qua email khi đăng nhập (mã 6 số, ghi nhớ thiết bị 90 ngày) - ApiAuthCheck chặn ngay tài khoản bị khoá dù JWT còn hạn (trước đây dùng được tới hết TTL) - Handler trả 404 thay vì 500 khi ModelNotFoundException không bọc HttpException - Test ClientTamperingTest: xác nhận IDOR/giả mạo dữ liệu từ client đều bị chặn Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
baodev0
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
e888a6ed5d
commit
12d5b4951c
@@ -0,0 +1,174 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Tests\Feature\Api\Client;
|
||||
|
||||
use App\Mail\Customer\TwoFactorCode;
|
||||
use App\Models\Customer;
|
||||
use App\Models\CustomerTrustedDevice;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Illuminate\Support\Facades\Hash;
|
||||
use Illuminate\Support\Facades\Mail;
|
||||
use Tests\TestCase;
|
||||
|
||||
class ClientTwoFactorTest extends TestCase
|
||||
{
|
||||
use RefreshDatabase;
|
||||
|
||||
private const PASSWORD = 'Secret12345';
|
||||
|
||||
private function api(): static
|
||||
{
|
||||
return $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()]);
|
||||
}
|
||||
|
||||
private function customer(bool $twoFactor = false): Customer
|
||||
{
|
||||
return Customer::factory()->create([
|
||||
'status' => 1,
|
||||
'password' => Hash::make(self::PASSWORD),
|
||||
'two_factor_enabled' => $twoFactor,
|
||||
]);
|
||||
}
|
||||
|
||||
private function login(Customer $customer, ?string $deviceToken = null)
|
||||
{
|
||||
return $this->api()->postJson('/v1/client/login', array_filter([
|
||||
'email' => $customer->email,
|
||||
'password' => self::PASSWORD,
|
||||
'device_token' => $deviceToken,
|
||||
]));
|
||||
}
|
||||
|
||||
private function lastCode(): string
|
||||
{
|
||||
$code = null;
|
||||
Mail::assertQueued(TwoFactorCode::class, function (TwoFactorCode $mail) use (&$code) {
|
||||
$code = $mail->data['code'];
|
||||
|
||||
return true;
|
||||
});
|
||||
|
||||
return $code;
|
||||
}
|
||||
|
||||
public function test_login_without_two_factor_returns_tokens_directly(): void
|
||||
{
|
||||
$this->login($this->customer())
|
||||
->assertOk()
|
||||
->assertJsonStructure(['data' => ['token', 'refresh_token']])
|
||||
->assertJsonMissingPath('data.two_factor');
|
||||
}
|
||||
|
||||
public function test_customer_enables_two_factor_with_emailed_code(): void
|
||||
{
|
||||
Mail::fake();
|
||||
$customer = $this->customer();
|
||||
|
||||
$this->actingAs($customer, 'client')->api()->postJson('/v1/client/two-factor/setup-code')->assertOk();
|
||||
$code = $this->lastCode();
|
||||
|
||||
$this->actingAs($customer, 'client')->api()
|
||||
->postJson('/v1/client/two-factor/setup-code')
|
||||
->assertStatus(422);
|
||||
|
||||
$this->actingAs($customer, 'client')->api()
|
||||
->postJson('/v1/client/two-factor/enable', ['code' => $code === '000000' ? '111111' : '000000'])
|
||||
->assertStatus(422);
|
||||
$this->assertFalse($customer->fresh()->two_factor_enabled);
|
||||
|
||||
$this->actingAs($customer, 'client')->api()
|
||||
->postJson('/v1/client/two-factor/enable', ['code' => $code])
|
||||
->assertOk();
|
||||
$this->assertTrue($customer->fresh()->two_factor_enabled);
|
||||
|
||||
$this->actingAs($customer->fresh(), 'client')->api()
|
||||
->getJson('/v1/client/me')
|
||||
->assertJsonPath('data.client.customer.active_2fa', 1);
|
||||
}
|
||||
|
||||
public function test_login_requires_emailed_code_and_can_remember_device(): void
|
||||
{
|
||||
Mail::fake();
|
||||
$customer = $this->customer(twoFactor: true);
|
||||
|
||||
$challenge = $this->login($customer)
|
||||
->assertOk()
|
||||
->assertJsonMissingPath('data.token')
|
||||
->json('data.two_factor.challenge');
|
||||
$this->assertSame(64, strlen($challenge));
|
||||
$code = $this->lastCode();
|
||||
|
||||
$this->api()->postJson('/v1/client/login/two-factor', ['challenge' => $challenge, 'code' => $code === '000000' ? '111111' : '000000'])
|
||||
->assertStatus(422);
|
||||
|
||||
$response = $this->api()->postJson('/v1/client/login/two-factor', [
|
||||
'challenge' => $challenge, 'code' => $code, 'remember_device' => true,
|
||||
])->assertOk()->assertJsonStructure(['data' => ['token', 'refresh_token', 'device_token', 'device_expires_in']]);
|
||||
|
||||
$this->api()->postJson('/v1/client/login/two-factor', ['challenge' => $challenge, 'code' => $code])
|
||||
->assertStatus(422);
|
||||
|
||||
$deviceToken = $response->json('data.device_token');
|
||||
$device = CustomerTrustedDevice::where('customer_id', $customer->id)->sole();
|
||||
$this->assertNotSame($deviceToken, $device->token_hash);
|
||||
$this->assertTrue($device->expires_at->between(now()->addDays(89), now()->addDays(91)));
|
||||
|
||||
$this->login($customer, $deviceToken)->assertOk()->assertJsonStructure(['data' => ['token']]);
|
||||
$this->login($customer, str_repeat('x', 64))->assertOk()->assertJsonPath('data.two_factor.resend_in', 60);
|
||||
|
||||
$this->travel(91)->days();
|
||||
$this->login($customer, $deviceToken)->assertOk()->assertJsonStructure(['data' => ['two_factor']]);
|
||||
}
|
||||
|
||||
public function test_challenge_is_destroyed_after_five_wrong_codes(): void
|
||||
{
|
||||
Mail::fake();
|
||||
$customer = $this->customer(twoFactor: true);
|
||||
$challenge = $this->login($customer)->json('data.two_factor.challenge');
|
||||
$code = $this->lastCode();
|
||||
$wrong = $code === '000000' ? '111111' : '000000';
|
||||
|
||||
for ($i = 0; $i < 5; $i++) {
|
||||
$this->api()->postJson('/v1/client/login/two-factor', ['challenge' => $challenge, 'code' => $wrong])->assertStatus(422);
|
||||
}
|
||||
|
||||
$this->api()->postJson('/v1/client/login/two-factor', ['challenge' => $challenge, 'code' => $code])->assertStatus(429);
|
||||
|
||||
$this->travel(61)->seconds();
|
||||
$this->api()->postJson('/v1/client/login/two-factor', ['challenge' => $challenge, 'code' => $code])
|
||||
->assertStatus(422)
|
||||
->assertJsonPath('errors.code.0', 'Phiên xác thực đã hết hạn, vui lòng đăng nhập lại.');
|
||||
}
|
||||
|
||||
public function test_disabling_requires_password_and_revokes_devices_password_change_also_revokes(): void
|
||||
{
|
||||
$customer = $this->customer(twoFactor: true);
|
||||
$twoFactor = app(\App\Services\Api\Client\ClientTwoFactorService::class);
|
||||
$twoFactor->rememberDevice($customer, 'UA', '1.1.1.1');
|
||||
|
||||
$this->actingAs($customer, 'client')->api()->getJson('/v1/client/two-factor')
|
||||
->assertOk()
|
||||
->assertJsonPath('data.enabled', true)
|
||||
->assertJsonCount(1, 'data.devices')
|
||||
->assertJsonMissingPath('data.devices.0.token_hash');
|
||||
|
||||
$this->actingAs($customer, 'client')->api()
|
||||
->postJson('/v1/client/two-factor/disable', ['password' => 'wrong-password'])
|
||||
->assertStatus(422);
|
||||
$this->assertTrue($customer->fresh()->two_factor_enabled);
|
||||
|
||||
$this->actingAs($customer, 'client')->api()
|
||||
->postJson('/v1/client/two-factor/disable', ['password' => self::PASSWORD])
|
||||
->assertOk();
|
||||
$this->assertFalse($customer->fresh()->two_factor_enabled);
|
||||
$this->assertSame(0, CustomerTrustedDevice::count());
|
||||
|
||||
$twoFactor->rememberDevice($customer, 'UA', '1.1.1.1');
|
||||
$this->actingAs($customer, 'client')->api()->putJson('/v1/client/change-password', [
|
||||
'current_password' => self::PASSWORD, 'password' => 'NewSecret123', 'password_confirmation' => 'NewSecret123',
|
||||
])->assertOk();
|
||||
$this->assertSame(0, CustomerTrustedDevice::count());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user