DrSmoothl
5c2f620c54
WebUI access was a single shared password. This adds optional
Authenticator TOTP as a second factor, with one-time recovery codes
and SSH as the last-resort disable path.
Login stays two HTTP posts with no pending token: a correct password
and enabled 2FA without a second factor returns { needsTotp: true };
the client then resubmits { password, totp } or { password, recoveryCode }.
The TOTP secret is wrapped with a password-derived AES-256-GCM key.
Eight XXXX-XXXX recovery codes are stored as SHA-256 hashes and each
code is consumed once. Enabling or disabling 2FA invalidates other
sessions; disabling still requires password plus TOTP or a recovery
code. SNOWLUMA_DEV_MODE hides the feature.
The login page uses a dedicated second-factor screen (Interior OTP
cells for the 6-digit code; the same cell UI for recovery codes,
grouped as XXXX-XXXX). Settings expose enroll/confirm/disable and
one-time recovery-code display.
Fixes #351
52 lines
1.6 KiB
TypeScript
52 lines
1.6 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest';
|
|
import { createApiClient } from '../src/lib/api/client';
|
|
|
|
const tokenStore = {
|
|
load: () => null as string | null,
|
|
save: vi.fn(),
|
|
};
|
|
|
|
afterEach(() => {
|
|
vi.unstubAllGlobals();
|
|
tokenStore.save.mockReset();
|
|
});
|
|
|
|
describe('login 2FA client', () => {
|
|
it('returns needsTotp without storing a session token', async () => {
|
|
vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({
|
|
success: false,
|
|
needsTotp: true,
|
|
}), {
|
|
status: 200,
|
|
headers: { 'content-type': 'application/json' },
|
|
})));
|
|
|
|
const client = createApiClient({ tokenStore });
|
|
await expect(client.login('Correct-Horse-1!')).resolves.toEqual({ ok: false, needsTotp: true });
|
|
expect(tokenStore.save).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('sends the TOTP on the second login request and stores the session', async () => {
|
|
const fetchMock = vi.fn(async () => new Response(JSON.stringify({
|
|
success: true,
|
|
token: 'session-token',
|
|
mustChangePassword: false,
|
|
}), {
|
|
status: 200,
|
|
headers: { 'content-type': 'application/json' },
|
|
}));
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
|
|
const client = createApiClient({ tokenStore });
|
|
await expect(client.login('Correct-Horse-1!', { totp: '287082' })).resolves.toEqual({
|
|
ok: true,
|
|
mustChangePassword: false,
|
|
});
|
|
expect(fetchMock).toHaveBeenCalledWith('/api/login', expect.objectContaining({
|
|
method: 'POST',
|
|
body: JSON.stringify({ password: 'Correct-Horse-1!', totp: '287082' }),
|
|
}));
|
|
expect(tokenStore.save).toHaveBeenCalledWith('session-token');
|
|
});
|
|
});
|