authentik.stages.authenticator_totp.tests

  1"""Test TOTP API"""
  2
  3from time import time
  4from urllib.parse import parse_qs, urlsplit
  5
  6from django.test.utils import override_settings
  7from django.urls import reverse
  8from rest_framework.test import APITestCase
  9
 10from authentik.core.models import User
 11from authentik.core.tests.utils import create_test_admin_user
 12from authentik.stages.authenticator.tests import TestCase, ThrottlingTestMixin
 13from authentik.stages.authenticator_totp.models import TOTPDevice
 14
 15
 16class AuthenticatorTOTPStage(APITestCase):
 17    """Test TOTP API"""
 18
 19    def test_api_delete(self):
 20        """Test api delete"""
 21        user = User.objects.create(username="foo")
 22        self.client.force_login(user)
 23        dev = TOTPDevice.objects.create(user=user)
 24        response = self.client.delete(
 25            reverse("authentik_api:totpdevice-detail", kwargs={"pk": dev.pk})
 26        )
 27        self.assertEqual(response.status_code, 204)
 28
 29
 30class TOTPDeviceMixin:
 31    """
 32    A TestCase helper that gives us a TOTPDevice to work with.
 33    """
 34
 35    # The next ten tokens
 36    tokens = [
 37        179225,
 38        656163,
 39        839400,
 40        154567,
 41        346912,
 42        471576,
 43        45675,
 44        101397,
 45        491039,
 46        784503,
 47    ]
 48
 49    def setUp(self):
 50        """
 51        Create a device at the fourth time step. The current token is 154567.
 52        """
 53        self.alice = create_test_admin_user("alice", email="alice@example.com")
 54        self.device = self.alice.totpdevice_set.create(
 55            key="2a2bbba1092ffdd25a328ad1a0a5f5d61d7aacc4",
 56            step=30,
 57            t0=int(time() - (30 * 3)),
 58            digits=6,
 59            tolerance=0,
 60            drift=0,
 61        )
 62
 63
 64@override_settings(
 65    OTP_TOTP_SYNC=False,
 66    OTP_TOTP_THROTTLE_FACTOR=0,
 67)
 68class TOTPTest(TOTPDeviceMixin, TestCase):
 69    """TOTP tests"""
 70
 71    def test_default_key(self):
 72        """Ensure default_key is valid"""
 73        device = self.alice.totpdevice_set.create()
 74
 75        # Make sure we can decode the key.
 76        _ = device.bin_key
 77
 78    def test_single(self):
 79        """Test single token"""
 80        results = [self.device.verify_token(token) for token in self.tokens]
 81
 82        self.assertEqual(results, [False] * 3 + [True] + [False] * 6)
 83
 84    def test_tolerance(self):
 85        """Test tolerance"""
 86        self.device.tolerance = 1
 87        results = [self.device.verify_token(token) for token in self.tokens]
 88
 89        self.assertEqual(results, [False] * 2 + [True] * 3 + [False] * 5)
 90
 91    def test_drift(self):
 92        """Test drift"""
 93        self.device.tolerance = 1
 94        self.device.drift = -1
 95        results = [self.device.verify_token(token) for token in self.tokens]
 96
 97        self.assertEqual(results, [False] * 1 + [True] * 3 + [False] * 6)
 98
 99    def test_sync_drift(self):
100        """Test sync drift"""
101        self.device.tolerance = 2
102        with self.settings(OTP_TOTP_SYNC=True):
103            valid = self.device.verify_token(self.tokens[5])
104
105        self.assertTrue(valid)
106        self.assertEqual(self.device.drift, 2)
107
108    def test_no_reuse(self):
109        """Test reuse"""
110        verified1 = self.device.verify_token(self.tokens[3])
111        verified2 = self.device.verify_token(self.tokens[3])
112
113        self.assertEqual(self.device.last_t, 3)
114        self.assertTrue(verified1)
115        self.assertFalse(verified2)
116
117    def test_config_url(self):
118        """Test config_url"""
119        with override_settings(OTP_TOTP_ISSUER=None):
120            url = self.device.config_url
121
122        parsed = urlsplit(url)
123        params = parse_qs(parsed.query)
124
125        self.assertEqual(parsed.scheme, "otpauth")
126        self.assertEqual(parsed.netloc, "totp")
127        self.assertEqual(parsed.path, "/alice")
128        self.assertIn("secret", params)
129        self.assertNotIn("issuer", params)
130
131    def test_config_url_issuer(self):
132        """Test config_url issuer"""
133        with override_settings(OTP_TOTP_ISSUER="example.com"):
134            url = self.device.config_url
135
136        parsed = urlsplit(url)
137        params = parse_qs(parsed.query)
138
139        self.assertEqual(parsed.scheme, "otpauth")
140        self.assertEqual(parsed.netloc, "totp")
141        self.assertEqual(parsed.path, "/example.com%3Aalice")
142        self.assertIn("secret", params)
143        self.assertIn("issuer", params)
144        self.assertEqual(params["issuer"][0], "example.com")
145
146    def test_config_url_issuer_spaces(self):
147        """Test config_url issuer with spaces"""
148        with override_settings(OTP_TOTP_ISSUER="Very Trustworthy Source"):
149            url = self.device.config_url
150
151        parsed = urlsplit(url)
152        params = parse_qs(parsed.query)
153
154        self.assertEqual(parsed.scheme, "otpauth")
155        self.assertEqual(parsed.netloc, "totp")
156        self.assertEqual(parsed.path, "/Very%20Trustworthy%20Source%3Aalice")
157        self.assertIn("secret", params)
158        self.assertIn("issuer", params)
159        self.assertEqual(params["issuer"][0], "Very Trustworthy Source")
160
161    def test_config_url_issuer_method(self):
162        """Test config_url issuer method"""
163        with override_settings(OTP_TOTP_ISSUER=lambda d: d.user.email):
164            url = self.device.config_url
165
166        parsed = urlsplit(url)
167        params = parse_qs(parsed.query)
168
169        self.assertEqual(parsed.scheme, "otpauth")
170        self.assertEqual(parsed.netloc, "totp")
171        self.assertEqual(parsed.path, "/alice%40example.com%3Aalice")
172        self.assertIn("secret", params)
173        self.assertIn("issuer", params)
174        self.assertEqual(params["issuer"][0], "alice@example.com")
175
176    def test_config_url_image(self):
177        """Test config_url with image"""
178        image_url = "https://test.invalid/square.png"
179
180        with override_settings(OTP_TOTP_ISSUER=None, OTP_TOTP_IMAGE=image_url):
181            url = self.device.config_url
182
183        parsed = urlsplit(url)
184        params = parse_qs(parsed.query)
185
186        self.assertEqual(parsed.scheme, "otpauth")
187        self.assertEqual(parsed.netloc, "totp")
188        self.assertEqual(parsed.path, "/alice")
189        self.assertIn("secret", params)
190        self.assertEqual(params["image"][0], image_url)
191
192
193@override_settings(
194    OTP_TOTP_THROTTLE_FACTOR=1,
195)
196class ThrottlingTestCase(TOTPDeviceMixin, ThrottlingTestMixin, TestCase):
197    """Test TOTP Throttling"""
198
199    def valid_token(self):
200        return self.tokens[3]
201
202    def invalid_token(self):
203        return -1