', $buffer );
$this->assertStringContainsString( '
', $buffer );
- $this->assertStringContainsString( "user_id: {$user->ID}", $buffer );
+
+ $scripts = wp_scripts();
+ $data = $scripts->get_data( 'two-factor-backup-codes-admin', 'data' );
+ $this->assertStringContainsString( '"userId":' . $user->ID, $data );
}
/**
diff --git a/tests/providers/class-two-factor-email-rest-api.php b/tests/providers/class-two-factor-email-rest-api.php
new file mode 100644
index 00000000..8562ba0c
--- /dev/null
+++ b/tests/providers/class-two-factor-email-rest-api.php
@@ -0,0 +1,277 @@
+user->create(
+ array(
+ 'role' => 'administrator',
+ )
+ );
+
+ self::$editor_id = $factory->user->create(
+ array(
+ 'role' => 'editor',
+ )
+ );
+
+ self::$provider = Two_Factor_Email::get_instance();
+
+ self::$mockmailer = new MockPHPMailer();
+
+ if ( isset( $GLOBALS['phpmailer'] ) ) {
+ self::$phpmailer = $GLOBALS['phpmailer'];
+ $GLOBALS['phpmailer'] = self::$mockmailer;
+ }
+
+ $_SERVER['SERVER_NAME'] = 'example.com';
+ }
+
+ /**
+ * Clean up test fixtures.
+ */
+ public static function wpTearDownAfterClass() {
+ self::delete_user( self::$admin_id );
+ self::delete_user( self::$editor_id );
+
+ unset( $_SERVER['SERVER_NAME'] );
+
+ if ( isset( self::$phpmailer ) ) {
+ $GLOBALS['phpmailer'] = self::$phpmailer;
+ self::$phpmailer = null;
+ }
+ }
+
+ /**
+ * Set up before each test.
+ */
+ public function set_up() {
+ parent::set_up();
+ // Clear mock emails before each test.
+ self::$mockmailer->mock_sent = array();
+ }
+
+ /**
+ * Verify setting up email without a code triggers email sending.
+ *
+ * @covers Two_Factor_Email::rest_setup_email
+ */
+ public function test_user_two_factor_rest_setup_email_sends_code() {
+ wp_set_current_user( self::$admin_id );
+
+ $request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ )
+ );
+
+ $emails_before = count( self::$mockmailer->mock_sent );
+
+ $response = rest_do_request( $request );
+ $data = $response->get_data();
+
+ $this->assertEquals( 200, $response->get_status() );
+ $this->assertTrue( $data['success'] );
+
+ $this->assertCount( $emails_before + 1, self::$mockmailer->mock_sent, 'A new email should be sent' );
+
+ // User should have a token saved.
+ $this->assertTrue( self::$provider->user_has_token( self::$admin_id ) );
+ }
+
+ /**
+ * Verify setting up email with an invalid code.
+ *
+ * @covers Two_Factor_Email::rest_setup_email
+ */
+ public function test_user_two_factor_rest_setup_email_bad_code() {
+ wp_set_current_user( self::$admin_id );
+
+ self::$provider->generate_token( self::$admin_id );
+
+ $request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ 'code' => 'invalid123',
+ )
+ );
+
+ $response = rest_do_request( $request );
+
+ $this->assertErrorResponse( 'invalid_code', $response, 400 );
+ $this->assertFalse( self::$provider->is_available_for_user( wp_get_current_user() ) );
+ }
+
+ /**
+ * Verify setting up email with a valid code enables the provider.
+ *
+ * @covers Two_Factor_Email::rest_setup_email
+ */
+ public function test_user_two_factor_rest_setup_email_valid_code() {
+ wp_set_current_user( self::$admin_id );
+
+ $token = self::$provider->generate_token( self::$admin_id );
+
+ $request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ 'code' => $token,
+ 'enable_provider' => true,
+ )
+ );
+
+ $response = rest_do_request( $request );
+ $data = $response->get_data();
+
+ $this->assertEquals( 200, $response->get_status() );
+ $this->assertTrue( $data['success'] );
+ $this->assertArrayHasKey( 'html', $data );
+
+ // Should be verified and enabled.
+ $this->assertTrue( (bool) get_user_meta( self::$admin_id, Two_Factor_Email::VERIFIED_META_KEY, true ) );
+ $this->assertTrue( in_array( 'Two_Factor_Email', Two_Factor_Core::get_enabled_providers_for_user( self::$admin_id ), true ) );
+ }
+
+ /**
+ * Verify deleting email verification via REST API.
+ *
+ * @covers Two_Factor_Email::rest_delete_email
+ */
+ public function test_user_can_delete_email_verification() {
+ wp_set_current_user( self::$admin_id );
+ update_user_meta( self::$admin_id, Two_Factor_Email::VERIFIED_META_KEY, true );
+ Two_Factor_Core::enable_provider_for_user( self::$admin_id, 'Two_Factor_Email' );
+
+ $request = new WP_REST_Request( 'DELETE', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ )
+ );
+ $response = rest_do_request( $request );
+
+ $this->assertEquals( 200, $response->get_status() );
+
+ // Should no longer be verified.
+ $this->assertFalse( get_user_meta( self::$admin_id, Two_Factor_Email::VERIFIED_META_KEY, true ) );
+ }
+
+ /**
+ * Verify admin can delete email verification for others.
+ *
+ * @covers Two_Factor_Email::rest_delete_email
+ */
+ public function test_admin_can_delete_email_for_others() {
+ wp_set_current_user( self::$admin_id );
+ update_user_meta( self::$editor_id, Two_Factor_Email::VERIFIED_META_KEY, true );
+ Two_Factor_Core::enable_provider_for_user( self::$editor_id, 'Two_Factor_Email' );
+
+ $request = new WP_REST_Request( 'DELETE', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$editor_id,
+ )
+ );
+ $response = rest_do_request( $request );
+
+ $this->assertEquals( 200, $response->get_status() );
+ $this->assertFalse( get_user_meta( self::$editor_id, Two_Factor_Email::VERIFIED_META_KEY, true ) );
+ }
+
+ /**
+ * Verify deleting email via REST API denied for other users.
+ *
+ * @covers Two_Factor_Email::rest_delete_email
+ */
+ public function test_user_cannot_delete_email_for_others() {
+ wp_set_current_user( self::$editor_id );
+ update_user_meta( self::$admin_id, Two_Factor_Email::VERIFIED_META_KEY, true );
+
+ $request = new WP_REST_Request( 'DELETE', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ )
+ );
+ $response = rest_do_request( $request );
+
+ $this->assertErrorResponse( 'rest_forbidden', $response, 403 );
+
+ // Verified state shouldn't be altered.
+ $this->assertTrue( (bool) get_user_meta( self::$admin_id, Two_Factor_Email::VERIFIED_META_KEY, true ) );
+ }
+
+ /**
+ * Verify setup email via REST API denied for other users.
+ *
+ * @covers Two_Factor_Email::rest_setup_email
+ */
+ public function test_user_cannot_setup_email_for_others() {
+ wp_set_current_user( self::$editor_id );
+
+ $request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/email' );
+ $request->set_body_params(
+ array(
+ 'user_id' => self::$admin_id,
+ )
+ );
+ $response = rest_do_request( $request );
+
+ $this->assertErrorResponse( 'rest_forbidden', $response, 403 );
+ }
+}
diff --git a/tests/providers/class-two-factor-email.php b/tests/providers/class-two-factor-email.php
index 8b37a983..2d17bf92 100644
--- a/tests/providers/class-two-factor-email.php
+++ b/tests/providers/class-two-factor-email.php
@@ -174,6 +174,55 @@ public function test_generate_and_email_token() {
$this->assertTrue( $this->provider->validate_token( $user->ID, $match[1] ) );
}
+ /**
+ * Verify that verification setup emails have correct content.
+ *
+ * @covers Two_Factor_Email::generate_and_email_token
+ */
+ public function test_generate_and_email_token_verification_context() {
+ $user = new WP_User( self::factory()->user->create() );
+
+ $this->provider->generate_and_email_token( $user, 'verification_setup' );
+
+ $subject = $GLOBALS['phpmailer']->Subject;
+ $content = $GLOBALS['phpmailer']->Body;
+
+ $this->assertStringContainsString( 'Verify your email for Two-Factor Authentication', $subject );
+ $this->assertStringContainsString( 'verify your email address', $content );
+ $this->assertStringNotContainsString( 'successfully authenticated', $content );
+ }
+
+ /**
+ * Verify that login emails have correct content arguments.
+ *
+ * @covers Two_Factor_Email::generate_and_email_token
+ */
+ public function test_generate_and_email_token_login_context_correct_args() {
+ $user = new WP_User( self::factory()->user->create() );
+ // Mock REMOTE_ADDR for IP check
+ $prev_remote_addr = $_SERVER['REMOTE_ADDR'] ?? null;
+ $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+
+ try {
+ $this->provider->generate_and_email_token( $user, 'login' );
+ } finally {
+ if ( null === $prev_remote_addr ) {
+ unset( $_SERVER['REMOTE_ADDR'] );
+ } else {
+ $_SERVER['REMOTE_ADDR'] = $prev_remote_addr;
+ }
+ }
+
+ $content = $GLOBALS['phpmailer']->Body;
+
+ $this->assertStringContainsString( 'entering', $content );
+ $this->assertStringContainsString( 'login', $content );
+ // Check that IP is effectively in the message (and not the token key or something else)
+ $this->assertStringContainsString( '127.0.0.1', $content );
+ // Check that username is in the message
+ $this->assertStringContainsString( $user->user_login, $content );
+ }
+
/**
* Verify the contents of the authentication page when no user is provided.
*
@@ -237,12 +286,45 @@ public function test_validate_authentication_code_with_spaces() {
}
/**
- * Verify that availability returns true.
+ * Verify that availability returns false for unverified users.
*
* @covers Two_Factor_Email::is_available_for_user
*/
public function test_is_available_for_user() {
- $this->assertTrue( $this->provider->is_available_for_user( false ) );
+ $user = new WP_User( self::factory()->user->create() );
+ $this->assertFalse( $this->provider->is_available_for_user( $user ) );
+ }
+
+ /**
+ * Verify that availability returns true for verified users.
+ *
+ * @covers Two_Factor_Email::is_available_for_user
+ */
+ public function test_is_available_for_user_verified() {
+ $user = new WP_User( self::factory()->user->create() );
+ update_user_meta( $user->ID, Two_Factor_Email::VERIFIED_META_KEY, true );
+ $this->assertTrue( $this->provider->is_available_for_user( $user ) );
+ }
+
+ /**
+ * Verify that availability returns true for users who already have it enabled (backwards compatibility).
+ *
+ * @covers Two_Factor_Email::is_available_for_user
+ */
+ public function test_is_available_for_user_backwards_compat() {
+ $user = new WP_User( self::factory()->user->create() );
+ update_user_meta( $user->ID, Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY, array( 'Two_Factor_Email' ) );
+ $this->assertTrue( $this->provider->is_available_for_user( $user ) );
+ }
+
+ /**
+ * Verify that the verified meta key is cleaned up on uninstall.
+ *
+ * @covers Two_Factor_Email::uninstall_user_meta_keys
+ */
+ public function test_verified_meta_cleanup() {
+ $keys = Two_Factor_Email::uninstall_user_meta_keys();
+ $this->assertContains( Two_Factor_Email::VERIFIED_META_KEY, $keys );
}
/**
@@ -260,6 +342,67 @@ public function test_get_user_token() {
$this->assertFalse( $this->provider->get_user_token( $user_without_token->ID ), 'Failed to recognize a missing token.' );
}
+ /**
+ * Verify that pre_user_options_update blocks enabling if not verified.
+ *
+ * @covers Two_Factor_Email::pre_user_options_update
+ */
+ public function test_pre_user_options_update_blocks_unverified() {
+ $user_id = self::factory()->user->create();
+
+ // Simulate POST request trying to enable Email provider.
+ $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Email', 'Two_Factor_Dummy' );
+
+ $this->provider->pre_user_options_update( $user_id );
+
+ $this->assertNotContains( 'Two_Factor_Email', $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+ $this->assertContains( 'Two_Factor_Dummy', $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+
+ unset( $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+ }
+
+ /**
+ * Verify that pre_user_options_update allows keeping legacy enabled provider.
+ *
+ * @covers Two_Factor_Email::pre_user_options_update
+ */
+ public function test_pre_user_options_update_allows_legacy() {
+ $user_id = self::factory()->user->create();
+
+ // Set up legacy state: enabled but not verified.
+ update_user_meta( $user_id, Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY, array( 'Two_Factor_Email' ) );
+
+ // Simulate POST request keeping it enabled.
+ $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Email' );
+
+ $this->provider->pre_user_options_update( $user_id );
+
+ $this->assertContains( 'Two_Factor_Email', $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+
+ unset( $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+ }
+
+ /**
+ * Verify that verified users can enable the provider.
+ *
+ * @covers Two_Factor_Email::pre_user_options_update
+ */
+ public function test_pre_user_options_update_allows_verified() {
+ $user_id = self::factory()->user->create();
+
+ // Set up verified state.
+ update_user_meta( $user_id, Two_Factor_Email::VERIFIED_META_KEY, true );
+
+ // Simulate POST request enabling it.
+ $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Email' );
+
+ $this->provider->pre_user_options_update( $user_id );
+
+ $this->assertContains( 'Two_Factor_Email', $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+
+ unset( $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
+ }
+
/**
* Check if an email code is re-sent.
*