ppeasy_vg12/tests/Feature/Api/Users/TwoFactorControllerTest.php

<?php

use App\Events\User\TwoFactorDisabledByAdmin;
use App\Events\User\TwoFactorEnabledByAdmin;
use App\Http\Resources\UserResource;
use App\Models\User;
use Carbon\Carbon;
use Facades\Tests\Setup\UserFactory;
use PragmaRX\Google2FA\Google2FA;
use Tests\Feature\ApiTestCase;

test('update 2fa unathenticated', function () {
    $this->setSettings(['2fa.enabled' => true]);

    $user = User::factory()->create();

    $this->putJson("api/users/{$user->id}/2fa")
        ->assertStatus(401);
});

test('update 2fa without permission', function () {
    $this->setSettings(['2fa.enabled' => true]);

    $user = User::factory()->create();

    $this->actingAs($user, ApiTestCase::API_GUARD)
        ->putJson("api/users/{$user->id}/2fa")
        ->assertForbidden();
});

test('enable two factor auth for user', function () {
    $this->setSettings(['2fa.enabled' => true]);

    Event::fake([TwoFactorEnabledByAdmin::class]);

    $user = UserFactory::withPermissions('users.manage')->create();

    $this->actingAs($user, ApiTestCase::API_GUARD)->putJson("api/users/{$user->id}/2fa")
        ->assertOk()
        ->assertJson(['message' => 'Verification token sent.'])
        ->assertJsonStructure([
            'message',
            'qrcode',
        ]);

    $this->assertTrue(
        DB::table('users')
            ->where('id', $user->id)
            ->whereNotNull('two_factor_secret')
            ->exists()
    );

    Event::assertNotDispatched(TwoFactorEnabledByAdmin::class);
});

test('verify user app with correct code', function () {
    $google2fa = new Google2FA;
    $secret = encrypt($google2fa->generateSecretKey());

    $this->setSettings(['2fa.enabled' => true]);

    Event::fake([TwoFactorEnabledByAdmin::class]);

    $user = UserFactory::withPermissions('users.manage')->create();
    $user->two_factor_secret = $secret;
    $user->save();

    $validCode = $google2fa->getCurrentOtp(decrypt($user->two_factor_secret));

    $response = $this->actingAs($user, ApiTestCase::API_GUARD)
        ->postJson("api/users/{$user->id}/2fa/verify", ['code' => $validCode]);

    $updatedUser = (new UserResource($user->fresh()))->resolve();

    $response->assertOk()
        ->assertJsonFragment($updatedUser);

    $this->assertTrue($user->fresh()->twoFactorEnabled());

    Event::assertDispatched(TwoFactorEnabledByAdmin::class);
});

test('verify user app with invalid token', function () {
    $this->setSettings(['2fa.enabled' => true]);

    $user = UserFactory::withPermissions('users.manage')->create();

    $this->actingAs($user, ApiTestCase::API_GUARD)
        ->postJson("api/users/{$user->id}/2fa/verify", ['code' => '123123'])
        ->assertStatus(422)
        ->assertJson([
            'message' => 'Invalid 2FA token.',
        ]);

    $this->assertTrue(
        DB::table('users')
            ->where('id', $user->id)
            ->whereNull('two_factor_confirmed_at')
            ->exists()
    );
});

test('enable two factor auth for user when it is already enabled', function () {
    $google2fa = new Google2FA;
    $secret = encrypt($google2fa->generateSecretKey());

    $this->setSettings(['2fa.enabled' => true]);

    $user = UserFactory::withPermissions('users.manage')->create();
    $user->two_factor_secret = $secret;
    $user->two_factor_confirmed_at = Carbon::now();
    $user->save();

    $this->actingAs($user, ApiTestCase::API_GUARD)
        ->putJson("api/users/{$user->id}/2fa")
        ->assertStatus(422)
        ->assertJson([
            'message' => '2FA is already enabled for this user.',
        ]);
});

test('disable two factor auth for user', function () {
    $google2fa = new Google2FA;
    $secret = encrypt($google2fa->generateSecretKey());

    $this->setSettings(['2fa.enabled' => true]);

    Event::fake([TwoFactorDisabledByAdmin::class]);

    $user = UserFactory::withPermissions('users.manage')->create();
    $user->two_factor_secret = $secret;
    $user->two_factor_confirmed_at = Carbon::now();
    $user->save();

    $this->be($user, ApiTestCase::API_GUARD);

    $response = $this->deleteJson("api/users/{$user->id}/2fa");

    $user = (new UserResource($user->fresh()))->resolve();

    $response->assertOk()
        ->assertJsonFragment($user);

    Event::assertDispatched(TwoFactorDisabledByAdmin::class);
});

test('disable 2fa for user when it is already disabled', function () {
    $this->setSettings(['2fa.enabled' => true]);

    $user = UserFactory::withPermissions('users.manage')->create();

    $this->actingAs($user, ApiTestCase::API_GUARD)
        ->deleteJson("api/users/{$user->id}/2fa")
        ->assertStatus(422)
        ->assertJson([
            'message' => '2FA is not enabled for this user.',
        ]);
});