path: root/spec/features/admin/admin_mode/login_spec.rb

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe 'Admin Mode Login' do
  include TermsHelper
  include UserLoginHelper
  include LdapHelpers

  describe 'with two-factor authentication', :js do
    def enter_code(code)
      fill_in 'user_otp_attempt', with: code
      click_button 'Verify code'
    end

    flag_values = [true, false]
    flag_values.each do |val|
      before do
        stub_feature_flags(restyle_login_page: val)
      end
      context 'with valid username/password' do
        let(:user) { create(:admin, :two_factor) }

        context 'using one-time code' do
          it 'blocks login if we reuse the same code immediately' do
            gitlab_sign_in(user, remember: true)

            expect(page).to have_content('Two-Factor Authentication')

            repeated_otp = user.current_otp
            enter_code(repeated_otp)
            gitlab_enable_admin_mode_sign_in(user)

            expect(page).to have_content('Two-Factor Authentication')

            enter_code(repeated_otp)

            expect(page).to have_current_path admin_session_path, ignore_query: true
            expect(page).to have_content('Invalid two-factor code')
          end

          context 'not re-using codes' do
            before do
              gitlab_sign_in(user, remember: true)

              expect(page).to have_content('Two-factor authentication code')

              enter_code(user.current_otp)
              gitlab_enable_admin_mode_sign_in(user)

              expect(page).to have_content('Two-Factor Authentication')
            end

            it 'allows login with valid code' do
              # Cannot reuse the TOTP
              travel_to(30.seconds.from_now) do
                enter_code(user.current_otp)

                expect(page).to have_current_path admin_root_path, ignore_query: true
                expect(page).to have_content('Admin mode enabled')
              end
            end

            it 'blocks login with invalid code' do
              # Cannot reuse the TOTP
              travel_to(30.seconds.from_now) do
                enter_code('foo')

                expect(page).to have_content('Invalid two-factor code')
              end
            end

            it 'allows login with invalid code, then valid code' do
              # Cannot reuse the TOTP
              travel_to(30.seconds.from_now) do
                enter_code('foo')

                expect(page).to have_content('Invalid two-factor code')

                enter_code(user.current_otp)

                expect(page).to have_current_path admin_root_path, ignore_query: true
                expect(page).to have_content('Admin mode enabled')
              end
            end

            context 'using backup code' do
              let(:codes) { user.generate_otp_backup_codes! }

              before do
                expect(codes.size).to eq 10

                # Ensure the generated codes get saved
                user.save!
              end

              context 'with valid code' do
                it 'allows login' do
                  enter_code(codes.sample)

                  expect(page).to have_current_path admin_root_path, ignore_query: true
                  expect(page).to have_content('Admin mode enabled')
                end

                it 'invalidates the used code' do
                  expect { enter_code(codes.sample) }
                    .to change { user.reload.otp_backup_codes.size }.by(-1)
                end
              end

              context 'with invalid code' do
                it 'blocks login' do
                  code = codes.sample
                  expect(user.invalidate_otp_backup_code!(code)).to eq true

                  user.save!
                  expect(user.reload.otp_backup_codes.size).to eq 9

                  enter_code(code)

                  expect(page).to have_content('Invalid two-factor code.')
                end
              end
            end
          end
        end

        context 'when logging in via omniauth' do
          let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: 'my-uid', provider: 'saml', password_automatically_set: false) }
          let(:mock_saml_response) do
            File.read('spec/fixtures/authentication/saml_response.xml')
          end

          before do
            stub_omniauth_saml_config(enabled: true, auto_link_saml_user: true, allow_single_sign_on: ['saml'], providers: [mock_saml_config_with_upstream_two_factor_authn_contexts])
          end

          context 'when authn_context is worth two factors' do
            let(:mock_saml_response) do
              File.read('spec/fixtures/authentication/saml_response.xml')
                  .gsub('urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
                        'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS')
            end

            it 'signs user in without prompting for second factor' do
              sign_in_using_saml!

              expect(page).not_to have_content('Two-Factor Authentication')

              enable_admin_mode_using_saml!

              expect(page).not_to have_content('Two-Factor Authentication')
              expect(page).to have_current_path admin_root_path, ignore_query: true
              expect(page).to have_content('Admin mode enabled')
            end
          end

          context 'when two factor authentication is required' do
            it 'shows 2FA prompt after omniauth login' do
              sign_in_using_saml!

              expect(page).to have_content('Two-Factor Authentication')
              enter_code(user.current_otp)

              enable_admin_mode_using_saml!

              expect(page).to have_content('Two-Factor Authentication')

              # Cannot reuse the TOTP
              travel_to(30.seconds.from_now) do
                enter_code(user.current_otp)

                expect(page).to have_current_path admin_root_path, ignore_query: true
                expect(page).to have_content('Admin mode enabled')
              end
            end
          end

          def sign_in_using_saml!
            gitlab_sign_in_via('saml', user, 'my-uid', mock_saml_response)
          end

          def enable_admin_mode_using_saml!
            gitlab_enable_admin_mode_sign_in_via('saml', user, 'my-uid', mock_saml_response)
          end
        end

        context 'when logging in via ldap' do
          let(:uid) { 'my-uid' }
          let(:provider_label) { 'Main LDAP' }
          let(:provider_name) { 'main' }
          let(:provider) { "ldap#{provider_name}" }
          let(:ldap_server_config) do
            {
              'label' => provider_label,
              'provider_name' => provider,
              'attributes' => {},
              'encryption' => 'plain',
              'uid' => 'uid',
              'base' => 'dc=example,dc=com'
            }
          end

          let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: uid, provider: provider) }

          before do
            setup_ldap(provider, user, uid, ldap_server_config)
          end

          context 'when two factor authentication is required' do
            it 'shows 2FA prompt after ldap login' do
              sign_in_using_ldap!(user, provider_label)
              expect(page).to have_content('Two-Factor Authentication')

              enter_code(user.current_otp)
              enable_admin_mode_using_ldap!(user)

              expect(page).to have_content('Two-Factor Authentication')

              # Cannot reuse the TOTP
              travel_to(30.seconds.from_now) do
                enter_code(user.current_otp)

                expect(page).to have_current_path admin_root_path, ignore_query: true
                expect(page).to have_content('Admin mode enabled')
              end
            end
          end

          def setup_ldap(provider, user, uid, ldap_server_config)
            stub_ldap_setting(enabled: true)

            allow(::Gitlab::Auth::Ldap::Config).to receive_messages(enabled: true, servers: [ldap_server_config])
            allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [provider.to_sym])

            Ldap::OmniauthCallbacksController.define_providers!
            Rails.application.reload_routes!

            mock_auth_hash(provider, uid, user.email)
            allow(Gitlab::Auth::Ldap::Access).to receive(:allowed?).with(user).and_return(true)

            allow_any_instance_of(ActionDispatch::Routing::RoutesProxy)
              .to receive(:"user_#{provider}_omniauth_callback_path")
              .and_return("/users/auth/#{provider}/callback")
          end

          def sign_in_using_ldap!(user, provider_label)
            visit new_user_session_path
            click_link provider_label
            fill_in 'username', with: user.username
            fill_in 'password', with: user.password
            click_button 'Sign in'
          end

          def enable_admin_mode_using_ldap!(user)
            visit new_admin_session_path
            click_link provider_label
            fill_in 'username', with: user.username
            fill_in 'password', with: user.password
            click_button 'Enter Admin Mode'
          end
        end
      end
    end
  end
end