mirror of
https://github.com/go-gitea/gitea.git
synced 2026-06-17 19:10:22 +03:00
bircni
68692e19d4
- Enforce org visibility on organization label read endpoints (private org labels no longer leak to non-members). - Block fork sync (`merge-upstream`) when the base repo is no longer readable (stops pulling commits after a parent goes private). - Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from the Docker `app.ini` templates (the `= *` default allowed `X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and admin-configured). - Enforce single-use TOTP passcodes across web login, password-reset, and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless replay). - Re-check branch write permission for every ref in a push (the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repo write). --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
48 lines
1.4 KiB
Go
48 lines
1.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth_test
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
|
|
"github.com/pquerna/otp/totp"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
key, err := totp.Generate(totp.GenerateOpts{SecretSize: 40, Issuer: "gitea-test", AccountName: "consume"})
|
|
require.NoError(t, err)
|
|
|
|
tfa := &auth_model.TwoFactor{UID: 1}
|
|
require.NoError(t, tfa.SetSecret(key.Secret()))
|
|
require.NoError(t, auth_model.NewTwoFactor(t.Context(), tfa))
|
|
|
|
passcode, err := totp.GenerateCode(key.Secret(), time.Now())
|
|
require.NoError(t, err)
|
|
|
|
// first use of a valid passcode succeeds
|
|
ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
|
|
require.NoError(t, err)
|
|
assert.True(t, ok)
|
|
|
|
// replaying the same passcode is refused, even when still inside the TOTP validity window
|
|
reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
|
|
require.NoError(t, err)
|
|
ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
|
|
require.NoError(t, err)
|
|
assert.False(t, ok)
|
|
|
|
// an invalid passcode is rejected without consuming anything
|
|
ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
|
|
require.NoError(t, err)
|
|
assert.False(t, ok)
|
|
}
|