Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#472 Require recovery code before resetting password

Browse Source 
- /email recovery generates recovery code and resets password only if recovery code is also given
- Change data source method to return email and recovery code
This commit is contained in:
ljacqu
2016-09-10 14:27:26 +02:00
parent 3b723bbbe9
commit c5f5c0d2fd
12 changed files with 224 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/fr/xephi/authme/command/executable/email/RecoverEmailCommandTest.java
+81 -28
View File
@@ -1,7 +1,7 @@
package fr.xephi.authme.command.executable.email;
import fr.xephi.authme.TestHelper;
import fr.xephi.authme.cache.auth.PlayerAuth;
import fr.xephi.authme.cache.auth.EmailRecoveryData;
import fr.xephi.authme.cache.auth.PlayerCache;
import fr.xephi.authme.command.CommandService;
import fr.xephi.authme.datasource.DataSource;
@@ -14,21 +14,25 @@ import org.bukkit.entity.Player;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.ArgumentCaptor;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.invocation.InvocationOnMock;
import org.mockito.runners.MockitoJUnitRunner;
import org.mockito.stubbing.Answer;
import java.util.Arrays;
import java.util.Collections;
import static fr.xephi.authme.AuthMeMatchers.stringWithLength;
import static org.hamcrest.Matchers.containsString;
import static org.junit.Assert.assertThat;
import static org.mockito.BDDMockito.given;
import static org.mockito.Matchers.any;
import static org.mockito.Matchers.anyLong;
import static org.mockito.Matchers.anyString;
import static org.mockito.Matchers.argThat;
import static org.mockito.Matchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.only;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.mockito.Mockito.verifyZeroInteractions;
@@ -104,14 +108,14 @@ public class RecoverEmailCommandTest {
given(sender.getName()).willReturn(name);
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
given(dataSource.getAuth(name)).willReturn(null);
given(dataSource.getEmailRecoveryData(name)).willReturn(null);
// when
command.executeCommand(sender, Collections.singletonList("someone@example.com"));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource).getAuth(name);
verify(dataSource).getEmailRecoveryData(name);
verifyNoMoreInteractions(dataSource);
verify(commandService).send(sender, MessageKey.REGISTER_EMAIL_MESSAGE);
}
@@ -124,14 +128,14 @@ public class RecoverEmailCommandTest {
given(sender.getName()).willReturn(name);
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
given(dataSource.getAuth(name)).willReturn(authWithEmail(DEFAULT_EMAIL));
given(dataSource.getEmailRecoveryData(name)).willReturn(newEmailRecoveryData(DEFAULT_EMAIL));
// when
command.executeCommand(sender, Collections.singletonList(DEFAULT_EMAIL));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource).getAuth(name);
verify(dataSource).getEmailRecoveryData(name);
verifyNoMoreInteractions(dataSource);
verify(commandService).send(sender, MessageKey.INVALID_EMAIL);
}
@@ -144,18 +148,67 @@ public class RecoverEmailCommandTest {
given(sender.getName()).willReturn(name);
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
given(dataSource.getAuth(name)).willReturn(authWithEmail("raptor@example.org"));
given(dataSource.getEmailRecoveryData(name)).willReturn(newEmailRecoveryData("raptor@example.org"));
// when
command.executeCommand(sender, Collections.singletonList("wrong-email@example.com"));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource).getAuth(name);
verify(dataSource).getEmailRecoveryData(name);
verifyNoMoreInteractions(dataSource);
verify(commandService).send(sender, MessageKey.INVALID_EMAIL);
}
@Test
public void shouldGenerateRecoveryCode() {
// given
String name = "Vultur3";
Player sender = mock(Player.class);
given(sender.getName()).willReturn(name);
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
String email = "v@example.com";
given(dataSource.getEmailRecoveryData(name)).willReturn(newEmailRecoveryData(email));
// when
command.executeCommand(sender, Collections.singletonList(email.toUpperCase()));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource).getEmailRecoveryData(name);
ArgumentCaptor<String> codeCaptor = ArgumentCaptor.forClass(String.class);
verify(dataSource).setRecoveryCode(eq(name), codeCaptor.capture(), anyLong());
assertThat(codeCaptor.getValue(), stringWithLength(8));
verify(sendMailSsl).sendRecoveryCode(email, codeCaptor.getValue());
}
@Test
public void shouldSendErrorForInvalidRecoveryCode() {
// given
String name = "Vultur3";
Player sender = mock(Player.class);
given(sender.getName()).willReturn(name);
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
String email = "vulture@example.com";
String code = "A6EF3AC8";
EmailRecoveryData recoveryData = newEmailRecoveryData(email, code);
given(dataSource.getEmailRecoveryData(name)).willReturn(recoveryData);
given(commandService.getProperty(EmailSettings.RECOVERY_PASSWORD_LENGTH)).willReturn(20);
given(passwordSecurity.computeHash(anyString(), eq(name)))
.willAnswer(invocation -> new HashedPassword((String) invocation.getArguments()[0]));
// when
command.executeCommand(sender, Arrays.asList(email, "bogus"));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource, only()).getEmailRecoveryData(name);
verify(sender).sendMessage(argThat(containsString("The recovery code is not correct")));
verifyNoMoreInteractions(sendMailSsl);
}
@Test
public void shouldResetPasswordAndSendEmail() {
// given
@@ -165,36 +218,36 @@ public class RecoverEmailCommandTest {
given(sendMailSsl.hasAllInformation()).willReturn(true);
given(playerCache.isAuthenticated(name)).willReturn(false);
String email = "vulture@example.com";
PlayerAuth auth = authWithEmail(email);
given(dataSource.getAuth(name)).willReturn(auth);
String code = "A6EF3AC8";
EmailRecoveryData recoveryData = newEmailRecoveryData(email, code);
given(dataSource.getEmailRecoveryData(name)).willReturn(recoveryData);
given(commandService.getProperty(EmailSettings.RECOVERY_PASSWORD_LENGTH)).willReturn(20);
given(passwordSecurity.computeHash(anyString(), eq(name)))
.willAnswer(new Answer<HashedPassword>() {
@Override
public HashedPassword answer(InvocationOnMock invocationOnMock) {
return new HashedPassword((String) invocationOnMock.getArguments()[0]);
}
});
.willAnswer(invocation -> new HashedPassword((String) invocation.getArguments()[0]));
// when
command.executeCommand(sender, Collections.singletonList(email.toUpperCase()));
command.executeCommand(sender, Arrays.asList(email, code));
// then
verify(sendMailSsl).hasAllInformation();
verify(dataSource).getAuth(name);
verify(passwordSecurity).computeHash(anyString(), eq(name));
verify(dataSource).updatePassword(auth);
assertThat(auth.getPassword().getHash(), stringWithLength(20));
verify(sendMailSsl).sendPasswordMail(eq(auth), argThat(stringWithLength(20)));
verify(dataSource).getEmailRecoveryData(name);
ArgumentCaptor<String> passwordCaptor = ArgumentCaptor.forClass(String.class);
verify(passwordSecurity).computeHash(passwordCaptor.capture(), eq(name));
String generatedPassword = passwordCaptor.getValue();
assertThat(generatedPassword, stringWithLength(20));
verify(dataSource).updatePassword(eq(name), any(HashedPassword.class));
verify(dataSource).removeRecoveryCode(name);
verify(sendMailSsl).sendPasswordMail(name, email, generatedPassword);
verify(commandService).send(sender, MessageKey.RECOVERY_EMAIL_SENT_MESSAGE);
}
private static PlayerAuth authWithEmail(String email) {
return PlayerAuth.builder()
.name("tester")
.email(email)
.build();
private static EmailRecoveryData newEmailRecoveryData(String email) {
return new EmailRecoveryData(email, null, 0L);
}
private static EmailRecoveryData newEmailRecoveryData(String email, String code) {
return new EmailRecoveryData(email, code, System.currentTimeMillis() + 10_000);
}
}
src/test/java/fr/xephi/authme/datasource/AbstractDataSourceIntegrationTest.java
+21 -5
View File
@@ -1,5 +1,6 @@
package fr.xephi.authme.datasource;
import fr.xephi.authme.cache.auth.EmailRecoveryData;
import fr.xephi.authme.cache.auth.PlayerAuth;
import fr.xephi.authme.security.crypts.HashedPassword;
import org.junit.Test;
@@ -393,7 +394,7 @@ public abstract class AbstractDataSourceIntegrationTest {
dataSource.setRecoveryCode(name, code, System.currentTimeMillis() + 100_000L);
// then
assertThat(dataSource.getRecoveryCode(name), equalTo(code));
assertThat(dataSource.getEmailRecoveryData(name).getRecoveryCode(), equalTo(code));
}
@Test
@@ -407,8 +408,10 @@ public abstract class AbstractDataSourceIntegrationTest {
dataSource.removeRecoveryCode(name);
// then
assertThat(dataSource.getRecoveryCode(name), nullValue());
assertThat(dataSource.getRecoveryCode("bobby"), nullValue());
EmailRecoveryData recoveryData = dataSource.getEmailRecoveryData(name);
assertThat(recoveryData.getRecoveryCode(), nullValue());
assertThat(recoveryData.getEmail(), equalTo("user@example.org"));
assertThat(dataSource.getEmailRecoveryData("bobby").getRecoveryCode(), nullValue());
}
@Test
@@ -419,10 +422,23 @@ public abstract class AbstractDataSourceIntegrationTest {
dataSource.setRecoveryCode(name, "123456", System.currentTimeMillis() - 2_000L);
// when
String code = dataSource.getRecoveryCode(name);
EmailRecoveryData recoveryData = dataSource.getEmailRecoveryData(name);
// then
assertThat(code, nullValue());
assertThat(recoveryData.getEmail(), equalTo("user@example.org"));
assertThat(recoveryData.getRecoveryCode(), nullValue());
}
@Test
public void shouldReturnNullForNoAvailableUser() {
// given
DataSource dataSource = getDataSource();
// when
EmailRecoveryData result = dataSource.getEmailRecoveryData("does-not-exist");
// then
assertThat(result, nullValue());
}
}