gitea/models/auth/twofactor_test.go at 96369d250fa98351684104939e7029e6a2d0da92 · lunny/gitea · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package auth_test

import (
	"crypto/md5"
	"encoding/base64"
	"testing"
	"time"

	auth_model "code.gitea.io/gitea/models/auth"
	"code.gitea.io/gitea/modules/secret"
	"code.gitea.io/gitea/modules/setting"

	"github.com/pquerna/otp/totp"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestTwoFactorSetSecretUsesPBKDF2(t *testing.T) {
	oldSecretKey := setting.SecretKey
	setting.SecretKey = "twofactor-test-secret"
	defer func() {
		setting.SecretKey = oldSecretKey
	}()

	secretStr := "JBSWY3DPEHPK3PXP"
	twofa := &auth_model.TwoFactor{}
	require.NoError(t, twofa.SetSecret(secretStr))

	assert.NotEmpty(t, twofa.SecretSalt)
	assert.Equal(t, "pbkdf2", twofa.SecretAlgo)

	passcode, err := totp.GenerateCode(secretStr, time.Now())
	require.NoError(t, err)

	ok, upgraded, err := twofa.ValidateTOTP(passcode)
	require.NoError(t, err)
	assert.True(t, ok)
	assert.False(t, upgraded)
}

func TestTwoFactorLegacySecretUpgrade(t *testing.T) {
	oldSecretKey := setting.SecretKey
	setting.SecretKey = "twofactor-test-secret"
	defer func() {
		setting.SecretKey = oldSecretKey
	}()

	secretStr := "JBSWY3DPEHPK3PXP"
	legacyKey := md5.Sum([]byte(setting.SecretKey))
	ciphertext, err := secret.AesEncrypt(legacyKey[:], []byte(secretStr))
	require.NoError(t, err)
	legacySecret := base64.StdEncoding.EncodeToString(ciphertext)

	twofa := &auth_model.TwoFactor{Secret: legacySecret}
	passcode, err := totp.GenerateCode(secretStr, time.Now())
	require.NoError(t, err)

	ok, upgraded, err := twofa.ValidateTOTP(passcode)
	require.NoError(t, err)
	assert.True(t, ok)
	assert.True(t, upgraded)
	assert.NotEmpty(t, twofa.SecretSalt)
	assert.Equal(t, "pbkdf2", twofa.SecretAlgo)
	assert.NotEqual(t, legacySecret, twofa.Secret)
}