[MM-14081] Disable checkMFA Endpoint by default and add tests for MFA login (#10356)

api4/user.go

@@ -915,7 +915,15 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte(user.ToJson()))
 }
 
+// Deprecated: checkUserMfa is deprecated and should not be used anymore, starting with version 6.0 it will be disabled.
+//			   Clients should attempt a login without MFA and will receive a MFA error when it's required.
 func checkUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
+
+	if *c.App.Config().ServiceSettings.DisableLegacyMFA {
+		http.NotFound(w, r)
+		return
+	}
+
 	props := model.MapFromJson(r.Body)
 
 	loginId := props["login_id"]

api4/user_test.go

@@ -4,6 +4,7 @@
 package api4
 
 import (
+	"github.com/dgryski/dgoogauth"
 	"net/http"
 	"strconv"
 	"strings"
@@ -1804,6 +1805,7 @@ func TestUpdateUserMfa(t *testing.T) {
 	CheckForbiddenStatus(t, resp)
 }
 
+// CheckUserMfa is deprecated and should not be used anymore, it will be disabled by default in version 6.0
 func TestCheckUserMfa(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()
@@ -1847,6 +1849,68 @@ func TestCheckUserMfa(t *testing.T) {
 	if required {
 		t.Fatal("should be false - mfa not active")
 	}
+
+	th.App.UpdateConfig(func (c *model.Config){
+		*c.ServiceSettings.DisableLegacyMFA = true
+	})
+
+	_, resp = th.Client.CheckUserMfa(th.BasicUser.Email)
+	CheckNotFoundStatus(t, resp)
+}
+
+func TestUserLoginMFAFlow(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	th.App.UpdateConfig(func (c *model.Config){
+		*c.ServiceSettings.DisableLegacyMFA = true
+		*c.ServiceSettings.EnableMultifactorAuthentication = true
+	})
+
+	secret, err := th.App.GenerateMfaSecret(th.BasicUser.Id)
+	assert.Nil(t, err)
+
+	t.Run("WithoutMFA", func (t *testing.T){
+		_, resp := th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
+		CheckNoError(t, resp)
+	})
+
+	// Fake user has MFA enabled
+	if result := <-th.Server.Store.User().UpdateMfaActive(th.BasicUser.Id, true); result.Err != nil {
+		t.Fatal(result.Err)
+	}
+
+	if result := <-th.Server.Store.User().UpdateMfaSecret(th.BasicUser.Id, secret.Secret); result.Err != nil {
+		t.Fatal(result.Err)
+	}
+
+	t.Run("WithInvalidMFA", func (t *testing.T){
+		user, resp := th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
+		CheckErrorMessage(t, resp, "mfa.validate_token.authenticate.app_error")
+		assert.Nil(t, user)
+
+		user, resp = th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, "")
+		CheckErrorMessage(t, resp, "mfa.validate_token.authenticate.app_error")
+		assert.Nil(t, user)
+
+		user, resp = th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, "abcdefgh")
+		CheckErrorMessage(t, resp, "mfa.validate_token.authenticate.app_error")
+		assert.Nil(t, user)
+
+		secret2, err := th.App.GenerateMfaSecret(th.BasicUser2.Id)
+		assert.Nil(t, err)
+		user, resp = th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, secret2.Secret)
+		CheckErrorMessage(t, resp, "mfa.validate_token.authenticate.app_error")
+		assert.Nil(t, user)
+	})
+
+	t.Run("WithCorrectMFA", func (t *testing.T){
+		code := dgoogauth.ComputeCode(secret.Secret, time.Now().UTC().Unix() / 30)
+
+		user, resp := th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, strconv.Itoa(code))
+		CheckNoError(t, resp)
+		assert.NotNil(t, user)
+	})
 }
 
 func TestGenerateMfaSecret(t *testing.T) {