82 lines
2.3 KiB
JavaScript
82 lines
2.3 KiB
JavaScript
|
// smoke: POST /api/v1/auth/login/mfa
|
|||
|
|
//
|
|||
|
|
// Covers:
|
|||
|
|
// login → mfa_required（已啟用 TOTP 時不回 token）
|
|||
|
|
// 403 — TOTP 錯誤（29505000）
|
|||
|
|
// 404 — challenge 不存在（28301000）
|
|||
|
|
// 403 — tenant slug 不符（28505000）
|
|||
|
|
// 400 — 缺少 code / challenge_id
|
|||
|
|
//
|
|||
|
|
// Happy path（login → login/mfa → JWT）見 journeys/login_mfa_full.js
|
|||
|
|
import { post, checkError } from '../lib/http.js';
|
|||
|
|
import { cfg } from '../lib/config.js';
|
|||
|
|
import { registerAndConfirm, loginExpectMFA } from '../lib/auth.js';
|
|||
|
|
import { enrollTOTP } from '../lib/member.js';
|
|||
|
|
|
|||
|
|
export const options = {
|
|||
|
|
vus: 1,
|
|||
|
|
iterations: 1,
|
|||
|
|
thresholds: { checks: ['rate==1.0'] },
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
export default function () {
|
|||
|
|
const { identity, tokens } = registerAndConfirm();
|
|||
|
|
const bearer = { Authorization: `Bearer ${tokens.access_token}` };
|
|||
|
|
const { otpauthUrl } = enrollTOTP(bearer);
|
|||
|
|
|
|||
|
|
const mfa = loginExpectMFA({
|
|||
|
|
email: identity.email,
|
|||
|
|
password: identity.password,
|
|||
|
|
});
|
|||
|
|
if (mfa.access_token) {
|
|||
|
|
throw new Error('login with TOTP enrolled should not return access_token');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// bad TOTP
|
|||
|
|
checkError(
|
|||
|
|
post('/api/v1/auth/login/mfa', {
|
|||
|
|
tenant_slug: cfg.tenantSlug,
|
|||
|
|
challenge_id: mfa.mfa_challenge_id,
|
|||
|
|
code: '000000',
|
|||
|
|
}),
|
|||
|
|
'POST /auth/login/mfa (bad totp)',
|
|||
|
|
403,
|
|||
|
|
29505000,
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
// unknown challenge — Redis miss 目前回 500（28201000）
|
|||
|
|
checkError(
|
|||
|
|
post('/api/v1/auth/login/mfa', {
|
|||
|
|
tenant_slug: cfg.tenantSlug,
|
|||
|
|
challenge_id: '00000000-0000-0000-0000-000000000000',
|
|||
|
|
code: '123456',
|
|||
|
|
}),
|
|||
|
|
'POST /auth/login/mfa (unknown challenge)',
|
|||
|
|
500,
|
|||
|
|
28201000,
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
// unknown tenant slug（resolveTenant 失敗）
|
|||
|
|
checkError(
|
|||
|
|
post('/api/v1/auth/login/mfa', {
|
|||
|
|
tenant_slug: 'wrong-tenant-slug',
|
|||
|
|
challenge_id: mfa.mfa_challenge_id,
|
|||
|
|
code: '123456',
|
|||
|
|
}),
|
|||
|
|
'POST /auth/login/mfa (unknown tenant)',
|
|||
|
|
404,
|
|||
|
|
29301000,
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
// missing fields
|
|||
|
|
const missing = post('/api/v1/auth/login/mfa', { tenant_slug: cfg.tenantSlug });
|
|||
|
|
if (missing.status !== 400) {
|
|||
|
|
throw new Error(`login/mfa missing fields: expected 400 got ${missing.status}`);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// otpauthUrl kept for journey reuse sanity (not used further in smoke)
|
|||
|
|
if (!otpauthUrl) {
|
|||
|
|
throw new Error('enrollTOTP did not return otpauthUrl');
|
|||
|
|
}
|
|||
|
|
}
|