[IDP-1010] Add automated tests for trying to log in (authenticate) while WebAuthn MFA API is unusable #346
Conversation
|
I'm working on fixing the failed test. |
Our MFA APIs use bcrypt for that, and at some point the `PASSWORD_DEFAULT` may change for PHP. This commit's code change protects this code from breaking when the default PHP password hashing algorithm does change.
Fixed |
|
|
||
| Examples: | ||
| | rightOrWrongPassword | containPublicKeyOrNot | | ||
| | wrong password | not contain "publicKey" | |
There was a problem hiding this comment.
Is there a way to write this with a positive test? Verifying that the response body does not contain something is, to me, more fragile. Some unrelated failure could happen and we wouldn't know about it because many possible responses could not contain the token. I suppose the real test is the previous line ("response status code should be 200") so this may not be a big deal.
There was a problem hiding this comment.
Yeah, the 200 response code is the main test. The "doesn't contain publicKey" is sort of to verify that the WebAuthn MFA API call did in fact fail. I could revise it to specifically look for the WebAuthn MFA API entry, and verify that it doesn't have the publicKey, but this seemed sufficient to be effective.
Backlog issue: IDP-1010
Added
Changed (non-breaking)
Fixed
Feature PR Checklist
make composershowmake psr2