class-two-factor-backup-codes.php

<?php
/**
 * Test Two Factor Backup Codes.
 *
 * @package Two_Factor
 */

/**
 * Class Tests_Two_Factor_Backup_Codes
 *
 * @package Two_Factor
 * @group providers
 * @group backup-codes
 */
class Tests_Two_Factor_Backup_Codes extends WP_UnitTestCase {

	/**
	 * Instance of our provider class.
	 *
	 * @var Two_Factor_Backup_Codes
	 */
	protected $provider;

	/**
	 * Set up a test case.
	 *
	 * @see WP_UnitTestCase_Base::set_up()
	 */
	public function set_up() {
		parent::set_up();

		$this->provider = Two_Factor_Backup_Codes::get_instance();
	}

	/**
	 * Verify an instance exists.
	 *
	 * @covers Two_Factor_Backup_Codes::get_instance
	 */
	public function test_get_instance() {
		$this->assertNotNull( $this->provider->get_instance() );
	}

	/**
	 * Verify the label value.
	 *
	 * @covers Two_Factor_Backup_Codes::get_label
	 */
	public function test_get_label() {
		$this->assertStringContainsString( 'Recovery Codes', $this->provider->get_label() );
	}

	/**
	 * Verify the contents of the authentication page.
	 *
	 * @covers Two_Factor_Backup_Codes::authentication_page
	 */
	public function test_authentication_page() {
		ob_start();
		$this->provider->authentication_page( false );
		$contents = ob_get_clean();

		$this->assertStringContainsString( 'Enter a recovery code.', $contents );
	}

	/**
	 * Verify that validation returns true.
	 *
	 * @covers Two_Factor_Backup_Codes::validate_authentication
	 */
	public function test_validate_authentication() {
		$user = new WP_User( self::factory()->user->create() );
		$code = $this->provider->generate_codes( $user, array( 'number' => 1 ) );

		// Verify authentication correctly fails without a set code.
		$this->assertFalse( $this->provider->validate_authentication( $user ) );

		// Set the code and verify it passes.
		$_REQUEST['two-factor-backup-code'] = $code[0];
		$this->assertTrue( $this->provider->validate_authentication( $user ) );

		unset( $_REQUEST['two-factor-backup-code'] );
	}

	/**
	 * Verify that codes are not available for the user.
	 *
	 * @covers Two_Factor_Backup_Codes::is_available_for_user
	 */
	public function test_is_available_for_user_false() {
		$user = new WP_User( self::factory()->user->create() );

		$this->assertFalse( $this->provider->is_available_for_user( $user ) );
	}

	/**
	 * Verify that codes are available for the user.
	 *
	 * @covers Two_Factor_Backup_Codes::is_available_for_user
	 */
	public function test_is_available_for_user() {
		$user  = new WP_User( self::factory()->user->create() );
		$codes = $this->provider->generate_codes( $user );

		$this->assertTrue( $this->provider->is_available_for_user( $user ) );
	}

	/**
	 * Verify that codes generate and validate.
	 *
	 * @covers Two_Factor_Backup_Codes::generate_codes
	 * @covers Two_Factor_Backup_Codes::validate_code
	 * @covers Two_Factor_Backup_Codes::codes_remaining_for_user
	 */
	public function test_generate_codes_and_validate_codes() {
		$user  = new WP_User( self::factory()->user->create() );
		$codes = $this->provider->generate_codes( $user );
		foreach ( $codes as $code ) {
			$this->assertTrue( $this->provider->validate_code( $user, $code ) );
		}
		$this->assertEquals( $this->provider->codes_remaining_for_user( $user ), 0 );
	}

	/**
	 * Verify that a validated code can't reused by a user.
	 *
	 * @covers Two_Factor_Backup_Codes::generate_codes
	 * @covers Two_Factor_Backup_Codes::validate_code
	 */
	public function test_generate_code_and_validate_code_false_revalidate() {
		$user     = new WP_User( self::factory()->user->create() );
		$codes    = $this->provider->generate_codes( $user, array( 'number' => 1 ) );
		$validate = $this->provider->validate_code( $user, $codes[0] );

		$this->assertFalse( $this->provider->validate_code( $user, $codes[0] ) );
	}

	/**
	 * Show that validate_code fails for a different user's code.
	 *
	 * @covers Two_Factor_Backup_Codes::generate_codes
	 * @covers Two_Factor_Backup_Codes::validate_code
	 */
	public function test_generate_code_and_validate_code_false_different_users() {
		$user  = new WP_User( self::factory()->user->create() );
		$codes = $this->provider->generate_codes( $user, array( 'number' => 1 ) );

		$user2  = new WP_User( self::factory()->user->create() );
		$codes2 = $this->provider->generate_codes( $user2, array( 'number' => 1 ) );

		$this->assertFalse( $this->provider->validate_code( $user2, $codes[0] ) );
	}

	/**
	 * Verify some of the markup for the user_options method.
	 *
	 * @covers Two_Factor_Backup_Codes::user_options
	 */
	public function test_user_options() {
		$user = new WP_User( self::factory()->user->create() );

		ob_start();
		$this->provider->user_options( $user );
		$buffer = ob_get_clean();

		$this->assertStringContainsString( '<div id="two-factor-backup-codes">', $buffer );
		$this->assertStringContainsString( '<div class="two-factor-backup-codes-wrapper" style="display:none;">', $buffer );
		$this->assertStringContainsString( "user_id: {$user->ID}", $buffer );
	}

	/**
	 * Verify that a code is generated & deleted.
	 *
	 * @covers Two_Factor_Backup_Codes::generate_codes
	 * @covers Two_Factor_Backup_Codes::delete_code
	 * @covers Two_Factor_Backup_Codes::codes_remaining_for_user
	 */
	public function test_delete_code() {
		$user = new WP_User( self::factory()->user->create() );

		$this->provider->generate_codes( $user, array( 'number' => 1 ) );
		$this->assertEquals( 1, $this->provider->codes_remaining_for_user( $user ) );

		$this->provider->generate_codes(
			$user,
			array(
				'number' => 1,
				'method' => 'append',
			)
		);
		$this->assertEquals( 2, $this->provider->codes_remaining_for_user( $user ) );

		$backup_codes = get_user_meta( $user->ID, Two_Factor_Backup_Codes::BACKUP_CODES_META_KEY, true );
		$this->provider->delete_code( $user, $backup_codes[0] );
		$this->assertEquals( 1, $this->provider->codes_remaining_for_user( $user ) );
	}

	/**
	 * Test backup code length filter.
	 */
	public function test_backup_code_length_filter() {
		$user = new WP_User( self::factory()->user->create() );

		$code_default = $this->provider->generate_codes( $user, array( 'number' => 1 ) );

		add_filter(
			'two_factor_backup_code_length',
			function () {
				return 7;
			}
		);

		$code_custom_length = $this->provider->generate_codes( $user, array( 'number' => 1 ) );

		$this->assertNotEquals( strlen( $code_custom_length[0] ), strlen( $code_default[0] ), 'Backup code length can be adjusted via filter' );

		$this->assertEquals( 7, strlen( $code_custom_length[0] ), 'Backup code length matches the filtered length' );

		remove_all_filters( 'two_factor_backup_code_length' );
	}

	/**
	 * Test that the two_factor_autosubmit_length filter changes the data-digits attribute on the authentication page.
	 *
	 * @covers Two_Factor_Backup_Codes::authentication_page
	 */
	public function test_autosubmit_length_filter_affects_authentication_page() {
		// Default: data-digits should reflect the default backup code length (8).
		// Pass false as the user since no user-specific code length is needed for this test.
		ob_start();
		$this->provider->authentication_page( false );
		$default_output = ob_get_clean();
		$this->assertStringContainsString( 'data-digits="8"', $default_output );

		// With filter: data-digits should be overridden to 0 (disables autosubmit).
		add_filter( 'two_factor_autosubmit_length', '__return_zero' );
		ob_start();
		$this->provider->authentication_page( false );
		$filtered_output = ob_get_clean();
		remove_filter( 'two_factor_autosubmit_length', '__return_zero' );

		$this->assertStringContainsString( 'data-digits="0"', $filtered_output );
	}
}