Paul Nothaft
cdbfb514bd
mfaService unit (encrypt/decrypt, TOTP, single-use recovery, isEnrolled), adminMfa HTTP (enroll/challenge/verify/recovery/disable; super_admin enrollment guards #735), and reset-admin-mfa.js CLI.
83 lines
2.7 KiB
JavaScript
83 lines
2.7 KiB
JavaScript
/**
|
|
* CLI test for scripts/reset-admin-mfa.js — break-glass MFA reset (#738).
|
|
*
|
|
* Boots a temp-SQLite DB, seeds an admin with MFA fully enabled, then runs
|
|
* the script in a child process (--email <addr> --yes) pointed at the same
|
|
* DB file, and asserts the four MFA columns are zeroed. The script runs in
|
|
* its own process with its own knex connection; the parent connection is
|
|
* idle during the spawn so the SQLite write lock isn't contended.
|
|
*/
|
|
|
|
const path = require('path');
|
|
const { execFileSync } = require('child_process');
|
|
|
|
const { bootCrmDb } = require('./helpers/crmDb');
|
|
|
|
jest.setTimeout(60000);
|
|
|
|
let db;
|
|
let cleanup;
|
|
|
|
beforeAll(async () => {
|
|
({ db, cleanup } = await bootCrmDb());
|
|
}, 60000);
|
|
|
|
afterAll(async () => {
|
|
if (cleanup) await cleanup();
|
|
});
|
|
|
|
const SCRIPT = path.resolve(__dirname, '..', '..', 'scripts', 'reset-admin-mfa.js');
|
|
|
|
async function seedEnrolledAdmin(email) {
|
|
const inserted = await db('admin_users').insert({
|
|
username: email.split('@')[0],
|
|
email,
|
|
password_hash: 'x',
|
|
is_active: true,
|
|
two_factor_enabled: true,
|
|
two_factor_secret: 'iv.tag.ct',
|
|
two_factor_recovery_codes: JSON.stringify(['$2b$10$fakehashfakehashfakehashfa']),
|
|
two_factor_enrolled_at: new Date(),
|
|
created_at: new Date(),
|
|
}).returning('id');
|
|
return inserted[0]?.id ?? inserted[0];
|
|
}
|
|
|
|
it('zeroes the four MFA columns for the targeted admin', async () => {
|
|
const email = 'reset-me@example.com';
|
|
const id = await seedEnrolledAdmin(email);
|
|
|
|
execFileSync('node', [SCRIPT, '--email', email, '--yes'], {
|
|
env: {
|
|
...process.env,
|
|
NODE_ENV: 'test',
|
|
TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH,
|
|
},
|
|
stdio: 'pipe',
|
|
});
|
|
|
|
const row = await db('admin_users').where({ id }).first();
|
|
expect(Number(row.two_factor_enabled)).toBe(0);
|
|
expect(row.two_factor_secret).toBeNull();
|
|
expect(row.two_factor_recovery_codes).toBeNull();
|
|
expect(row.two_factor_enrolled_at).toBeNull();
|
|
});
|
|
|
|
it('leaves a different admin untouched', async () => {
|
|
const targetEmail = 'target@example.com';
|
|
const bystanderEmail = 'bystander@example.com';
|
|
const targetId = await seedEnrolledAdmin(targetEmail);
|
|
const bystanderId = await seedEnrolledAdmin(bystanderEmail);
|
|
|
|
execFileSync('node', [SCRIPT, '--email', targetEmail, '--yes'], {
|
|
env: { ...process.env, NODE_ENV: 'test', TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH },
|
|
stdio: 'pipe',
|
|
});
|
|
|
|
const target = await db('admin_users').where({ id: targetId }).first();
|
|
const bystander = await db('admin_users').where({ id: bystanderId }).first();
|
|
expect(Number(target.two_factor_enabled)).toBe(0);
|
|
expect(Number(bystander.two_factor_enabled)).toBe(1);
|
|
expect(bystander.two_factor_secret).toBe('iv.tag.ct');
|
|
});
|