NethSecurity controller: 2FA is enabled when cancelled

[mrmarkuz]

After clicking the "Configure 2FA" button in the account settings 2FA is enabled without confirming it by entering an OTP code and clicking "Configure".

Steps to reproduce

• Install NethSecurity controller
• Go to account settings on the top right
• Click "Configure 2FA"
• Click "Cancel"
• Refresh the page

Expected behavior

2FA isn't enabled

Actual behavior

2FA is enabled

Components

NethSecurity controller 2.0.0

See also

https://community.nethserver.org/t/nethsec-controller-module-2fa-initialisation-bug/26345

---

Thanks to Matthieu Gaillet

[gsanchietti]

Testing image: 2.1.0-dev.1

Test Case 1: 2FA Setup Cancelled

Steps:

1. Log in as a user (e.g., admin).
2. Go to account settings, click "Configure 2FA".
3. When presented with the QR code, do not enter an OTP.
4. Click "Cancel" or leave the setup page.
5. Refresh the account settings page.

Expected Result:
2FA should not be enabled for the user.

• The user's 2FA status should be "disabled".
• No recovery codes are generated.
• No permanent secret is stored.

Test Case 2: 2FA Setup Confirmed

Steps:

1. Log in as a user.
2. Go to account settings, click "Configure 2FA".
3. Scan the QR code and enter a valid OTP code.
4. Click "Configure".

Expected Result:
2FA should be enabled.

• The user's 2FA status shows "enabled".
• Recovery codes are generated and shown.
• The secret is stored permanently.

Test Case 3: 2FA Setup + Cancel + Retry

Steps:

1. Start 2FA setup and cancel before confirming.
2. Re-initiate 2FA setup.
3. Complete setup with a valid OTP.

Expected Result:
2FA is enabled only after a valid OTP is confirmed.
Cancelling the initial setup does not enable 2FA or create recovery codes.

Test Case 4: Regression - Existing 2FA Users

Steps:

1. Log in as a user with 2FA already configured.
2. Ensure normal login flow works with OTP.
3. Recovery codes can be used if needed.

Expected Result:
No change in the behavior for users with existing 2FA.
No regression in login, recovery, or disabling flows.

Test Case 5: Regression - Invalid OTP or Recovery Code

Steps:

1. Attempt to enable 2FA with an invalid OTP.
2. Attempt to use an invalid recovery code with 2FA enabled.

Expected Result:

• Setup does not complete; 2FA remains disabled.
• Invalid codes do not grant access.