admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-17 01:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Require mfa code to disable mfa (#10345)

Browse Source
This commit is contained in:
Tomi Turtiainen
2024-08-13 15:56:54 +03:00
committed by GitHub
parent e950df0de8
commit 3384f52a35
17 changed files with 215 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
packages/cli/test/integration/mfa/mfa.api.test.ts
View File

@@ -48,7 +48,8 @@ describe('Enable MFA setup', () => {
secondCall.body.data.recoveryCodes.join(''),
);
await testServer.authAgentFor(owner).delete('/mfa/disable').expect(200);
const token = new TOTPService().generateTOTP(firstCall.body.data.secret);
await testServer.authAgentFor(owner).post('/mfa/disable').send({ token }).expect(200);
const thirdCall = await testServer.authAgentFor(owner).get('/mfa/qr').expect(200);
@@ -135,9 +136,16 @@ describe('Enable MFA setup', () => {
describe('Disable MFA setup', () => {
test('POST /disable should disable login with MFA', async () => {
const { user } = await createUserWithMfaEnabled();
const { user, rawSecret } = await createUserWithMfaEnabled();
const token = new TOTPService().generateTOTP(rawSecret);
await testServer.authAgentFor(user).delete('/mfa/disable').expect(200);
await testServer
.authAgentFor(user)
.post('/mfa/disable')
.send({
token,
})
.expect(200);
const dbUser = await Container.get(AuthUserRepository).findOneOrFail({
where: { id: user.id },
@@ -147,6 +155,18 @@ describe('Disable MFA setup', () => {
expect(dbUser.mfaSecret).toBe(null);
expect(dbUser.mfaRecoveryCodes.length).toBe(0);
});
test('POST /disable should fail if invalid token is given', async () => {
const { user } = await createUserWithMfaEnabled();
await testServer
.authAgentFor(user)
.post('/mfa/disable')
.send({
token: 'invalid token',
})
.expect(403);
});
});
describe('Change password with MFA enabled', () => {