TestVerifyOTP tests the resend verify OTP functionality
(t *testing.T)
| 18 | |
| 19 | // TestVerifyOTP tests the resend verify OTP functionality |
| 20 | func TestVerifyOTP(t *testing.T) { |
| 21 | cfg := getTestConfig() |
| 22 | cfg.IsSMSServiceEnabled = true |
| 23 | cfg.EnableEmailOTP = true |
| 24 | cfg.EnableSMSOTP = true |
| 25 | cfg.SMTPHost = "localhost" |
| 26 | cfg.SMTPPort = 1025 |
| 27 | cfg.SMTPSenderEmail = "test@authorizer.dev" |
| 28 | cfg.SMTPSenderName = "Test" |
| 29 | cfg.SMTPLocalName = "Test" |
| 30 | cfg.SMTPSkipTLSVerification = true |
| 31 | cfg.IsEmailServiceEnabled = true |
| 32 | cfg.IsSMSServiceEnabled = true |
| 33 | cfg.EnableEmailVerification = true |
| 34 | cfg.TwilioAPISecret = "test-twilio-api-secret" |
| 35 | cfg.TwilioAPIKey = "test-twilio-api-key" |
| 36 | cfg.TwilioAccountSID = "test-twilio-account-sid" |
| 37 | cfg.TwilioSender = "test-twilio-sender" |
| 38 | cfg.EnableMobileBasicAuthentication = true |
| 39 | cfg.EnablePhoneVerification = true |
| 40 | ts := initTestSetup(t, cfg) |
| 41 | req, ctx := createContext(ts) |
| 42 | |
| 43 | // Create a test user |
| 44 | mobile := fmt.Sprintf("+1%010d", time.Now().UnixNano()%10000000000) |
| 45 | password := "Password@123" |
| 46 | // Signup the user |
| 47 | signupReq := &model.SignUpRequest{ |
| 48 | PhoneNumber: &mobile, |
| 49 | Password: password, |
| 50 | ConfirmPassword: password, |
| 51 | } |
| 52 | |
| 53 | signupRes, err := ts.GraphQLProvider.SignUp(ctx, signupReq) |
| 54 | assert.NoError(t, err) |
| 55 | assert.NotNil(t, signupRes) |
| 56 | // Expect the user to be nil, as the email is not verified yet |
| 57 | assert.Nil(t, signupRes.User) |
| 58 | |
| 59 | // Get the OTP row written by signup. After the at-rest hardening it |
| 60 | // stores the HMAC digest, NOT the plaintext code that was sent over |
| 61 | // SMS. The integration suite cannot intercept the outgoing SMS, so we |
| 62 | // overwrite the row with a known plaintext/digest pair below and |
| 63 | // verify with the known plaintext. |
| 64 | storedOTP, err := ts.StorageProvider.GetOTPByPhoneNumber(ctx, mobile) |
| 65 | require.NoError(t, err) |
| 66 | require.NotNil(t, storedOTP) |
| 67 | |
| 68 | const knownPlainOTP = "123456" |
| 69 | storedOTP.Otp = crypto.HashOTP(knownPlainOTP, cfg.JWTSecret) |
| 70 | storedOTP.ExpiresAt = time.Now().Add(5 * time.Minute).Unix() |
| 71 | _, err = ts.StorageProvider.UpsertOTP(ctx, storedOTP) |
| 72 | require.NoError(t, err) |
| 73 | |
| 74 | t.Run("OTP at rest is hashed, not plaintext", func(t *testing.T) { |
| 75 | row, err := ts.StorageProvider.GetOTPByPhoneNumber(ctx, mobile) |
| 76 | require.NoError(t, err) |
| 77 | // 1. Stored value must NOT equal the plaintext |
nothing calls this directly
no test coverage detected