OTP autologin in request specs

[AlfonsoUceda]

Hello!

I'm using OTP feature in my accounts and I've implemented to force users to setup OTP after login the problem is that my request specs fails because after login they require otp setup.

I've been reading the code but I'm not sure how to do this to bypass OTP setup.

This is how I log in the request specs

post "/login", as: :json, params: { email: email, password: password }

the response for that request contains the path in location header /otp-setup. Does rodauth have any internal request method to bypass this?

Cheers,
Alfonso

[jeremyevans]

If you've setup forcing users to setup OTP after login, but you want your specs to work without OTP after login, you are basically ensuring you testing a flow you are not allowing in production. I would not recommend that approach, but if you want to do it anyway, why not just only require OTP after login in the development and production environments, and not in the test environment?

My recommendation would be to use OTP in the specs if you are requiring it in production. If you aren't sure how to do that, look at Rodauth's specs.

If I've misunderstood, please post a minimal self contained reproducible example showing the issue.

[AlfonsoUceda]

Maybe it is better if I redo the question.
Can I create an account programatically where the otp is configured?
I’ve already created the account programatically and allowing me to configure otp programatically I could use the otp key to login the otp auth screen.

Why do ask this? I could create a single request spec for this feature for an account that does not have the otp configured, then setup the otp and redirect to the right path.

On the other hand I would like to use an account with otp configured for the rest of the request specs so I only have to login with password and then login with otp.

[jeremyevans]

Can I create an account programatically where the otp is configured?

You can programmatically setup otp authentication after the account is created, using the internal request and otp features together. See the specs starting around:

rodauth/spec/two_factor_spec.rb

Line 1842 in f01bab5

otp_hash = app.rodauth.otp_setup_params(:account_login=>'foo@example.com')

[AlfonsoUceda]

Thanks @jeremyevans I'm using this piece of code based on that spec

otp_hash = RodauthApp.rodauth.otp_setup_params(account_login: account.email)
secret, raw_secret = otp_hash.values_at(:otp_setup, :otp_setup_raw)
totp = ROTP::TOTP.new(secret)
RodauthApp.rodauth.otp_setup(
  account_login: account.email,
  otp_setup: secret,
  otp_setup_raw: raw_secret,
  otp_auth: totp.now
)

but I had to do one thing after debugging rodauth code and getting
Error logging in via TOTP authentication (invalid_otp_auth_code, {"otp" => "Invalid authentication code"})

After setting up otp I have to do the following

ActiveRecord::Base.connection.execute <<~SQL
  UPDATE account_otp_keys SET last_use = date_subtract(CURRENT_TIMESTAMP, '600 seconds') WHERE id = '#{account.id}'
SQL

I saw that in the spec so after debugging I saw that the last_use check failed

so now my login method for requests specs is this one:

def login(email:, password:)
      post "/login", as: :json, params: { email: email, password: password }

      ActiveRecord::Base.connection.execute <<~SQL
        UPDATE account_otp_keys SET last_use = date_subtract(CURRENT_TIMESTAMP, '600 seconds') WHERE id = '#{account.id}'
      SQL
      post "/otp-auth", as: :json, params: { otp: account.totp.now }
      get response.headers["Location"]
    end

• The account is created programatically and also the otp setup
• Logins with email and password
• Update the otp last use
• Login with OTP auth using accounts totp (that method is defined using define_single_method
• Finally go to the location because I'm using two_factor_auth_return_to_requested_location? true

I hope this is useful for people.