Rochamarcelo issue/google two factor auth

src/Controller/Traits/LoginTrait.php

@@ -218,20 +218,15 @@ public function verify()
             return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        // storing user's session in the temporary one
-        // until the GA verification is checked
-        $temporarySession = $this->Auth->user();
-        $this->request->getSession()->delete('Auth.User');
+        $temporarySession = $this->request->getSession()->read('temporarySession');
+        if (!is_array($temporarySession) || empty($temporarySession)) {
+            $this->Flash->error(__d('CakeDC/Users', 'Invalid request.'), 'default', [], 'auth');
 
-        if (!empty($temporarySession)) {
-            $this->request->getSession()->write('temporarySession', $temporarySession);
-        }
-
-        if (array_key_exists('secret', $temporarySession)) {
-            $secret = $temporarySession['secret'];
+            return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        $secretVerified = Hash::get((array)$temporarySession, 'secret_verified');
+        $secret = Hash::get($temporarySession, 'secret');
+        $secretVerified = Hash::get($temporarySession, 'secret_verified');
 
         // showing QR-code until shared secret is verified
         if (!$secretVerified) {
@@ -322,14 +317,16 @@ protected function _checkReCaptcha()
     protected function _afterIdentifyUser($user, $socialLogin = false, $googleAuthenticatorLogin = false)
     {
         if (!empty($user)) {
-            $this->Auth->setUser($user);
-
             if ($googleAuthenticatorLogin) {
+                // storing user's session in the temporary one
+                // until the GA verification is checked
+                $this->request->getSession()->write('temporarySession', $user);
                 $url = Configure::read('GoogleAuthenticator.verifyAction');
 
                 return $this->redirect($url);
             }
 
+            $this->Auth->setUser($user);
             $event = $this->dispatchEvent(UsersAuthComponent::EVENT_AFTER_LOGIN, ['user' => $user]);
             if (is_array($event->result)) {
                 return $this->redirect($event->result);

tests/TestCase/Controller/Component/GoogleAuthenticatorComponentTest.php

@@ -44,7 +44,6 @@ public function setUp()
         $this->backupUsersConfig = Configure::read('Users');
 
         Router::reload();
-        Plugin::routes('CakeDC/Users');
         Router::connect('/route/*', [
             'plugin' => 'CakeDC/Users',
             'controller' => 'Users',

tests/TestCase/Controller/Component/UsersAuthComponentTest.php

@@ -53,7 +53,6 @@ public function setUp()
         $this->backupUsersConfig = Configure::read('Users');
 
         Router::reload();
-        Plugin::routes('CakeDC/Users');
         Router::connect('/route/*', [
             'plugin' => 'CakeDC/Users',
             'controller' => 'Users',

tests/TestCase/Controller/Traits/LoginTraitTest.php

@@ -391,24 +391,43 @@ public function testFailedSocialUserAccount()
     public function testVerifyHappy()
     {
         Configure::write('Users.GoogleAuthenticator.login', true);
-        $this->Trait->Auth = $this->getMockBuilder('Cake\Controller\Component\AuthComponent')
-            ->setMethods(['user', ])
-            ->disableOriginalConstructor()
-            ->getMock();
-        $user = [
-            'id' => 1,
-            'secret_verified' => 1,
-        ];
-        $this->Trait->Auth->expects($this->at(0))
-            ->method('user')
-            ->will($this->returnValue($user));
+
         $this->Trait->request = $this->getMockBuilder('Cake\Network\Request')
-            ->setMethods(['is', 'getData', 'allow'])
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
             ->getMock();
-        $this->Trait->request->expects($this->at(0))
+        $this->Trait->request->expects($this->once())
             ->method('is')
             ->with('post')
             ->will($this->returnValue(false));
+
+        $this->_mockSession([
+            'temporarySession' => [
+                'id' => 1,
+                'secret_verified' => 1,
+            ]
+        ]);
+        $this->Trait->verify();
+    }
+
+    /**
+     * testVerifyNoUser
+     *
+     */
+    public function testVerifyNoUser()
+    {
+        Configure::write('Users.GoogleAuthenticator.login', true);
+
+        $this->Trait->request = $this->getMockBuilder('Cake\Network\Request')
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
+            ->getMock();
+        $this->Trait->request->expects($this->never())
+            ->method('is')
+            ->with('post');
+        $this->_mockSession([]);
+        $this->_mockFlash();
+        $this->Trait->Flash->expects($this->once())
+            ->method('error')
+            ->with('Invalid request.');
         $this->Trait->verify();
     }
 
@@ -433,30 +452,26 @@ public function testVerifyNotEnabled()
     public function testVerifyGetShowQR()
     {
         Configure::write('Users.GoogleAuthenticator.login', true);
-        $this->Trait->Auth = $this->getMockBuilder('Cake\Controller\Component\AuthComponent')
-            ->setMethods(['user', ])
-            ->disableOriginalConstructor()
-            ->getMock();
-        $user = [
-            'id' => '00000000-0000-0000-0000-000000000001',
-            'email' => 'email@example.com',
-            'secret_verified' => 0,
-        ];
-        $this->Trait->Auth->expects($this->at(0))
-            ->method('user')
-            ->will($this->returnValue($user));
+
         $this->Trait->GoogleAuthenticator = $this->getMockBuilder(GoogleAuthenticatorComponent::class)
             ->disableOriginalConstructor()
             ->setMethods(['createSecret', 'getQRCodeImageAsDataUri'])
             ->getMock();
 
         $this->Trait->request = $this->getMockBuilder(ServerRequest::class)
-            ->setMethods(['is', 'getData', 'allow'])
+            ->setMethods(['is', 'getData', 'allow', 'getSession'])
             ->getMock();
-        $this->Trait->request->expects($this->at(0))
+        $this->Trait->request->expects($this->once())
             ->method('is')
             ->with('post')
             ->will($this->returnValue(false));
+        $this->_mockSession([
+            'temporarySession' => [
+                'id' => '00000000-0000-0000-0000-000000000001',
+                'email' => 'email@example.com',
+                'secret_verified' => 0,
+            ]
+        ]);
         $this->Trait->GoogleAuthenticator->expects($this->at(0))
             ->method('createSecret')
             ->will($this->returnValue('newSecret'));
@@ -469,4 +484,23 @@ public function testVerifyGetShowQR()
             ->with(['secretDataUri' => 'newDataUriGenerated']);
         $this->Trait->verify();
     }
+
+    /**
+     * Mock session and mock session attributes
+     *
+     * @return void
+     */
+    protected function _mockSession($attributes)
+    {
+        $session = new \Cake\Http\Session();
+
+        foreach ($attributes as $field => $value) {
+            $session->write($field, $value);
+        }
+
+        $this->Trait->request
+            ->expects($this->any())
+            ->method('getSession')
+            ->willReturn($session);
+    }
 }

tests/TestCase/Controller/Traits/RegisterTraitTest.php

@@ -31,8 +31,6 @@ public function setUp()
         $this->traitMockMethods = ['validate', 'dispatchEvent', 'set', 'validateReCaptcha', 'redirect'];
         $this->mockDefaultEmail = true;
         parent::setUp();
-
-        Plugin::routes('CakeDC/Users');
     }
 
     /**

tests/TestCase/Model/Table/UsersTableTest.php

@@ -56,7 +56,6 @@ public function setUp()
             'transport' => 'test',
             'from' => 'cakedc@example.com'
         ]);
-        Plugin::routes('CakeDC/Users');
     }
 
     /**

tests/TestCase/View/Helper/UserHelperTest.php

@@ -57,7 +57,6 @@ public function setUp()
         }
 
         parent::setUp();
-        Plugin::routes('CakeDC/Users');
         $this->View = $this->getMockBuilder('Cake\View\View')
                 ->setMethods(['append'])
                 ->getMock();