Add mandatory 2FA service/class

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

3 files changed, 224 insertions, 0 deletions

diff --git a/tests/Core/Command/TwoFactorAuth/EnforceTest.php b/tests/Core/Command/TwoFactorAuth/EnforceTest.php
new file mode 100644
index 00000000000..8d896f2f45c
--- /dev/null
+++ b/tests/Core/Command/TwoFactorAuth/EnforceTest.php
@@ -0,0 +1,110 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace Tests\Core\Command\TwoFactorAuth;
+
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
+use OC\Core\Command\TwoFactorAuth\Enforce;
+use PHPUnit\Framework\MockObject\MockObject;
+use Symfony\Component\Console\Tester\CommandTester;
+use Test\TestCase;
+
+class EnforceTest extends TestCase {
+
+	/** @var MandatoryTwoFactor|MockObject */
+	private $mandatoryTwoFactor;
+
+	/** @var CommandTester */
+	private $command;
+
+	protected function setUp() {
+		parent::setUp();
+
+		$this->mandatoryTwoFactor = $this->createMock(MandatoryTwoFactor::class);
+		$command = new Enforce($this->mandatoryTwoFactor);
+
+		$this->command = new CommandTester($command);
+	}
+
+	public function testEnforce() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('setEnforced')
+			->with(true);
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(true);
+
+		$rc = $this->command->execute([
+			'--on' => true,
+		]);
+
+		$this->assertEquals(0, $rc);
+		$display = $this->command->getDisplay();
+		$this->assertContains("Two-factor authentication is enforced for all users", $display);
+	}
+
+	public function testDisableEnforced() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('setEnforced')
+			->with(false);
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(false);
+
+		$rc = $this->command->execute([
+			'--off' => true,
+		]);
+
+		$this->assertEquals(0, $rc);
+		$display = $this->command->getDisplay();
+		$this->assertContains("Two-factor authentication is not enforced", $display);
+	}
+
+	public function testCurrentStateEnabled() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(true);
+
+		$rc = $this->command->execute([]);
+
+		$this->assertEquals(0, $rc);
+		$display = $this->command->getDisplay();
+		$this->assertContains("Two-factor authentication is enforced for all users", $display);
+	}
+
+	public function testCurrentStateDisabled() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(false);
+
+		$rc = $this->command->execute([]);
+
+		$this->assertEquals(0, $rc);
+		$display = $this->command->getDisplay();
+		$this->assertContains("Two-factor authentication is not enforced", $display);
+	}
+
+}
diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
index 301b4cc09db..acc0f0d3e92 100644
--- a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
+++ b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
@@ -26,6 +26,7 @@ use Exception;
 use OC;
 use OC\Authentication\Token\IProvider as TokenProvider;
 use OC\Authentication\TwoFactorAuth\Manager;
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
 use OC\Authentication\TwoFactorAuth\ProviderLoader;
 use OCP\Activity\IEvent;
 use OCP\Activity\IManager;
@@ -50,6 +51,9 @@ class ManagerTest extends TestCase {
 	/** @var IRegistry|\PHPUnit_Framework_MockObject_MockObject */
 	private $providerRegistry;
 
+	/** @var MandatoryTwoFactor|\PHPUnit_Framework_MockObject_MockObject */
+	private $mandatoryTwoFactor;
+
 	/** @var ISession|\PHPUnit_Framework_MockObject_MockObject */
 	private $session;
 
@@ -86,6 +90,7 @@ class ManagerTest extends TestCase {
 		$this->user = $this->createMock(IUser::class);
 		$this->providerLoader = $this->createMock(\OC\Authentication\TwoFactorAuth\ProviderLoader::class);
 		$this->providerRegistry = $this->createMock(IRegistry::class);
+		$this->mandatoryTwoFactor = $this->createMock(MandatoryTwoFactor::class);
 		$this->session = $this->createMock(ISession::class);
 		$this->config = $this->createMock(IConfig::class);
 		$this->activityManager = $this->createMock(IManager::class);
@@ -97,6 +102,7 @@ class ManagerTest extends TestCase {
 		$this->manager = new Manager(
 			$this->providerLoader,
 			$this->providerRegistry,
+			$this->mandatoryTwoFactor,
 			$this->session,
 			$this->config,
 			$this->activityManager,
@@ -142,7 +148,20 @@ class ManagerTest extends TestCase {
 			]);
 	}
 
+	public function testIsTwoFactorAuthenticatedEnforced() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(true);
+
+		$enabled = $this->manager->isTwoFactorAuthenticated($this->user);
+
+		$this->assertTrue($enabled);
+	}
+
 	public function testIsTwoFactorAuthenticatedNoProviders() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(false);
 		$this->providerRegistry->expects($this->once())
 			->method('getProviderStates')
 			->willReturn([]); // No providers registered
@@ -154,6 +173,9 @@ class ManagerTest extends TestCase {
 	}
 
 	public function testIsTwoFactorAuthenticatedOnlyBackupCodes() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(false);
 		$this->providerRegistry->expects($this->once())
 			->method('getProviderStates')
 			->willReturn([
@@ -173,6 +195,9 @@ class ManagerTest extends TestCase {
 	}
 
 	public function testIsTwoFactorAuthenticatedFailingProviders() {
+		$this->mandatoryTwoFactor->expects($this->once())
+			->method('isEnforced')
+			->willReturn(false);
 		$this->providerRegistry->expects($this->once())
 			->method('getProviderStates')
 			->willReturn([
@@ -474,6 +499,7 @@ class ManagerTest extends TestCase {
 			->setConstructorArgs([
 				$this->providerLoader,
 				$this->providerRegistry,
+				$this->mandatoryTwoFactor,
 				$this->session,
 				$this->config,
 				$this->activityManager,
diff --git a/tests/lib/Authentication/TwoFactorAuth/MandatoryTwoFactorTest.php b/tests/lib/Authentication/TwoFactorAuth/MandatoryTwoFactorTest.php
new file mode 100644
index 00000000000..1cacbd5f787
--- /dev/null
+++ b/tests/lib/Authentication/TwoFactorAuth/MandatoryTwoFactorTest.php
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace Tests\Authentication\TwoFactorAuth;
+
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
+use OCP\IConfig;
+use PHPUnit\Framework\MockObject\MockObject;
+use Test\TestCase;
+
+class MandatoryTwoFactorTest extends TestCase {
+
+	/** @var IConfig|MockObject */
+	private $config;
+
+	/** @var MandatoryTwoFactor */
+	private $mandatoryTwoFactor;
+
+	protected function setUp() {
+		parent::setUp();
+
+		$this->config = $this->createMock(IConfig::class);
+
+		$this->mandatoryTwoFactor = new MandatoryTwoFactor($this->config);
+	}
+
+	public function testIsNotEnforced() {
+		$this->config->expects($this->once())
+			->method('getSystemValue')
+			->with('twofactor_enforced', 'false')
+			->willReturn('false');
+
+		$isEnforced = $this->mandatoryTwoFactor->isEnforced();
+
+		$this->assertFalse($isEnforced);
+	}
+
+	public function testIsEnforced() {
+		$this->config->expects($this->once())
+			->method('getSystemValue')
+			->with('twofactor_enforced', 'false')
+			->willReturn('true');
+
+		$isEnforced = $this->mandatoryTwoFactor->isEnforced();
+
+		$this->assertTrue($isEnforced);
+	}
+
+	public function testSetEnforced() {
+		$this->config->expects($this->once())
+			->method('setSystemValue')
+			->with('twofactor_enforced', 'true');
+
+		$this->mandatoryTwoFactor->setEnforced(true);
+	}
+
+	public function testSetNotEnforced() {
+		$this->config->expects($this->once())
+			->method('setSystemValue')
+			->with('twofactor_enforced', 'false');
+
+		$this->mandatoryTwoFactor->setEnforced(false);
+	}
+
+}