coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support opt-in MFA per browser client with authoritative enrollment checks
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 00:27:28 +02:00
parent e1e292919a
commit ac8ed65203
14 changed files with 298 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

43
src/internal/adapters/privacyidea/optional_mfa_test.go Normal file
View file

@ -0,0 +1,43 @@
package privacyidea_test
import (
"context"
"keycape/internal/adapters/privacyidea"
"net/http"
"testing"
)
func TestEnrollmentLookupRejectsIndeterminateResponses(t *testing.T) {
for _, body := range []string{
`{}`, `{"result":{"status":true,"value":{"tokens":[{}],"count":1}}}`, `{"result":{"status":false,"value":{"tokens":[],"count":0}}}`,
`{"result":{"status":true,"value":{"count":0}}}`,
`{"result":{"status":true,"value":{"tokens":[]}}}`,
`{"result":{"status":true,"value":{"tokens":null,"count":0}}}`,
`{"result":{"status":true,"value":{"tokens":[],"count":1}}}`,
`{"result":{"status":true,"value":{"tokens":[],"count":-1}}}`,
} {
t.Run(body, func(t *testing.T) {
adapter := privacyidea.New(testConfig(), &mockHTTPClient{doFn: func(*http.Request) (*http.Response, error) { return jsonResponse(body), nil }})
required, err := adapter.HasEnrolledFactor(context.Background(), "alice")
if err == nil || required {
t.Fatalf("indeterminate lookup accepted: required=%v error=%v", required, err)
}
})
}
}
func TestEnrollmentLookupFiltersBeforePagination(t *testing.T) {
adapter := privacyidea.New(testConfig(), &mockHTTPClient{doFn: func(req *http.Request) (*http.Response, error) {
q := req.URL.Query()
if q.Get("user") != "alice" || q.Get("realm") != "netkingdom" || q.Get("active") != "True" {
t.Fatalf("incorrect filter: %v", q)
}
if req.Header.Get("Authorization") != "service-jwt" {
t.Fatal("provider requires raw JWT")
}
return jsonResponse(`{"result":{"status":true,"value":{"tokens":[{"active":true}],"count":20}}}`), nil
}})
required, err := adapter.HasEnrolledFactor(context.Background(), "alice")
if err != nil || !required {
t.Fatalf("active factor missed: %v %v", required, err)
}
}