二段階認証

seto1 · Jul 8, 2024 · cea1ed3 · cea1ed3
1 parent 1f12b05
commit cea1ed3
Show file tree

Hide file tree

Showing 3 changed files with 45 additions and 17 deletions.
diff --git a/plugins/baser-core/src/Controller/Admin/UsersController.php b/plugins/baser-core/src/Controller/Admin/UsersController.php
@@ -139,8 +139,7 @@ public function login_code(UsersServiceInterface $usersService, TwoFactorAuthent
             }
 
             // 認証コードチェック
-            if (!$twoFactorAuthenticationsService->verify($userId, $this->request->getData('code'))
-            ) {
+            if (!$twoFactorAuthenticationsService->verify($userId, $this->request->getData('code'))) {
                 $this->BcMessage->setError(__d('baser_core', '認証コードが間違っているか有効期限切れです。'));
                 return $this->render();
             }

diff --git a/plugins/baser-core/src/Event/BcAuthenticationEventListener.php b/plugins/baser-core/src/Event/BcAuthenticationEventListener.php
@@ -17,6 +17,7 @@
 use BaserCore\Utility\BcUtil;
 use Cake\Event\Event;
 use Cake\Event\EventListenerInterface;
+use Cake\Http\Exception\HttpException;
 use Cake\Http\Exception\RedirectException;
 use Cake\Http\Exception\UnauthorizedException;
 use Cake\Routing\Router;
@@ -65,20 +66,24 @@ public function afterIdentify(Event $event)
             return;
         }
 
-        if ($request->getData('code')) {
-            if ($twoFactorAuthenticationsService->verify($loginUser->id, $request->getData('code'))) {
-                return;
+        // API対応
+        if ($prefix === 'Api/Admin') {
+            if ($request->getData('code')) {
+                if ($twoFactorAuthenticationsService->verify($loginUser->id, $request->getData('code'))) {
+                    return;
+                }
+                throw new UnauthorizedException(__d('baser', '認証コードが間違っているか有効期限切れです。'));
+            } else if ($request->getData('send_code')) {
+                $twoFactorAuthenticationsService->send($loginUser->id, $loginUser->email);
+                throw new HttpException(__d('baser', 'メールで受信した認証コードをcodeキーの値として送信してください。'), 200);
+            } else {
+                throw new UnauthorizedException(__d('baser', 'send_codeキーを付与すると認証コードをメールで送信します。'));
             }
-            throw new UnauthorizedException(__d('baser', '認証コードが間違っているか有効期限切れです。'));
         }
 
         // 認証コード送信
         $twoFactorAuthenticationsService->send($loginUser->id, $loginUser->email);
 
-        if ($prefix === 'Api/Admin') {
-            throw new UnauthorizedException(__d('baser', 'メールで受信した認証コードをcodeキーの値として送信してください。'));
-        }
-
         // 認証コード入力画面にリダイレクト
         $session->write('TwoFactorAuth.' . $prefix, [
             'user_id' => $loginUser->id,

diff --git a/plugins/baser-core/tests/TestCase/Event/BcAuthenticationEventListenerTest.php b/plugins/baser-core/tests/TestCase/Event/BcAuthenticationEventListenerTest.php
@@ -16,6 +16,7 @@
 use BaserCore\TestSuite\BcTestCase;
 use BaserCore\Test\Scenario\InitAppScenario;
 use Cake\Event\Event;
+use Cake\Http\Exception\HttpException;
 use Cake\Http\Exception\RedirectException;
 use Cake\Http\Exception\UnauthorizedException;
 use Cake\TestSuite\EmailTrait;
@@ -75,23 +76,22 @@ public function testImplementedEvents()
     }
 
     /**
-     * test afterIdentify
+     * test afterIdentify 管理画面
      */
     public function testAfterIdentify()
     {
         $this->loadFixtureScenario(InitAppScenario::class);
         $siteConfigsService = $this->getService(SiteConfigsServiceInterface::class);
         $event = new Event('Authentication.afterIdentify', null, []);
 
-        // 管理画面
         $request = $this->getRequest('/baser/admin/baser-core/users/login');
         $this->loginAdmin($request);
 
-        // - 二段階認証無効時
+        // 二段階認証無効時
         $siteConfigsService->setValue('use_two_factor_authentication', 0);
         $this->assertNull($this->BcAuthenticationEventListener->afterIdentify($event));
 
-        // - 二段階認証有効時
+        // 二段階認証有効時
         $siteConfigsService->setValue('use_two_factor_authentication', 1);
         $siteConfigsService->setValue('email', '[email protected]');
 
@@ -103,21 +103,45 @@ public function testAfterIdentify()
             $this->assertMailSentTo('[email protected]');
             $this->assertMailContainsText('認証コード');
         }
+    }
+
+    /**
+     * test afterIdentify API
+     */
+    public function testAfterIdentifyApi()
+    {
+        $this->loadFixtureScenario(InitAppScenario::class);
+        $siteConfigsService = $this->getService(SiteConfigsServiceInterface::class);
+        $event = new Event('Authentication.afterIdentify', null, []);
 
-        // API
         $request = $this->getRequest('/baser/api/admin/baser-core/users/login.json');
         $this->loginAdmin($request);
 
-        // - 二段階認証無効時
+        // 二段階認証無効時
         $siteConfigsService->setValue('use_two_factor_authentication', 0);
         $this->assertNull($this->BcAuthenticationEventListener->afterIdentify($event));
 
-        // - 二段階認証有効時
+        // 二段階認証有効時
         $siteConfigsService->setValue('use_two_factor_authentication', 1);
+        $siteConfigsService->setValue('email', '[email protected]');
+
         try {
             $this->BcAuthenticationEventListener->afterIdentify($event);
             throw new \Exception();
         } catch (UnauthorizedException $e) {
+            $this->assertEquals('send_codeキーを付与すると認証コードをメールで送信します。', $e->getMessage());
+            $this->assertNoMailSent();
+        }
+
+        // 認証コード送信要求
+        $request = $this->getRequest('/baser/api/admin/baser-core/users/login.json',
+            ['send_code' => '1']);
+        $this->loginAdmin($request);
+
+        try {
+            $this->BcAuthenticationEventListener->afterIdentify($event);
+            throw new \Exception();
+        } catch (HttpException $e) {
             $this->assertEquals('メールで受信した認証コードをcodeキーの値として送信してください。', $e->getMessage());
             $this->assertMailSentTo('[email protected]');
             $this->assertMailContainsText('認証コード');