New endpoints tests#3
Merged
Merged
Conversation
smarcet
reviewed
Dec 21, 2021
| $user_registration_request = json_decode($content); | ||
|
|
||
| $this->assertTrue(!empty($user_registration_request->hash)); | ||
| // $params = [ |
smarcet
reviewed
Dec 21, 2021
| ); | ||
|
|
||
| //$this->assertResponseStatus(204); | ||
| $this->assertResponseStatus(201); //TODO: last operation should return 204 |
Collaborator
There was a problem hiding this comment.
please check here the response of the action and if its get the updated data
smarcet
reviewed
Dec 21, 2021
| ); | ||
|
|
||
| //$this->assertResponseStatus(204); | ||
| $this->assertResponseStatus(201); //TODO: last operation should return 204 |
Collaborator
There was a problem hiding this comment.
please check response here to see if updated or not
romanetar
force-pushed
the
feature/users-update
branch
from
December 21, 2021 14:17
5b514c6 to
a601ac0
Compare
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I6b4a734de97c90afa9f09f0badefceeea1d6ba1a
smarcet
added a commit
that referenced
this pull request
Dec 28, 2021
* New endpoints tests * Refactored test seeding Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I6b4a734de97c90afa9f09f0badefceeea1d6ba1a Co-authored-by: romanetar <roman_ag@hotmail.com> Co-authored-by: smarcet@gmail.com <smarcet@gmail.com>
smarcet
added a commit
that referenced
this pull request
Jul 23, 2026
Two related fixes to the MFA login flow: 1. Passwordless (flow=otp) login never checked shouldRequire2FA(), so an enforced-2FA user could bypass MFA entirely via emitOTP() + postLogin with flow=otp instead of flow=password (SDS idp-mfa.md §7.4 / Open Question #3 explicitly treats passwordless as single-factor). Now throws AuthenticationException before loginWithOTP(), reusing the existing errorLogin() redirect+flash path - the OTP form still submits as a native form POST, so this needed no new response contract. 2. challengeRequired()'s redirect-based implementations (DefaultLoginStrategy, DisplayResponseUserAgentStrategy) previously ignored the $params they received, silently depending on the caller having already flashed otp_length/otp_lifetime to session - an implicit contract that would silently break for any other caller. Both now flash their own $params (persistent, not one-shot, so it survives repeated refreshes) and set error_code, mirroring what DisplayResponseJsonStrategy already sends native clients in JSON. clearMFAUISessionState() now clears error_code too. The '2fa' flow value moves from a new ILoginStrategy constant to IAuthService::AuthenticationFlowMFA, alongside its siblings AuthenticationFlowPassword/AuthenticationFlowPasswordless - all three are the same session 'flow' enum (already flashed together in the AuthenticationException catch block), so splitting the third value into a different interface would have been inconsistent. New test: OAuth2NativeMFALoginFlowTest gains a non-native (page/popup/ touch) case proving the 302+session-flash contract, alongside the existing native 412+JSON case. TwoFactorLoginFlowTest covers the passwordless-bypass rejection (including that it still reuses errorLogin(), not a new JSON contract) and the error_code flash/clear.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ref https://tipit.avaza.com/project/view#!tab=task-pane&groupby=MyTaskDueDate&view=vertical&task=2729362&fileview=grid