Something went wrong
+{% endif %}
{% endblock form %}
diff --git a/bid_main/templates/bid_main/mfa/delete_device.html b/bid_main/templates/bid_main/mfa/delete_device.html
new file mode 100644
index 0000000..5837909
--- /dev/null
+++ b/bid_main/templates/bid_main/mfa/delete_device.html
@@ -0,0 +1,20 @@
+{% extends 'layout.html' %}
+{% load pipeline static %}
+{% load add_form_classes from forms %}
+{% block page_title %}
+Delete {{ object.name }}
+{% endblock %}
+
+{% block body %}
+
+
{% else %}
Delete {{ object.name }}?
+ +{% endblock %} diff --git a/bid_main/templates/bid_main/mfa/disable.html b/bid_main/templates/bid_main/mfa/disable.html new file mode 100644 index 0000000..ef04bf6 --- /dev/null +++ b/bid_main/templates/bid_main/mfa/disable.html @@ -0,0 +1,23 @@ +{% extends 'layout.html' %} +{% load pipeline static %} +{% load add_form_classes from forms %} +{% block page_title %} +Disable Multi-factor Authentication +{% endblock %} + +{% block body %} +
+
+
+ {% if with_help_text and field.help_text %}
+ {{ field.help_text|safe }}
{% endif %}
+ You are going to disable multi-factor authentication (MFA). + You can always configure MFA again. +
+ +{% endblock %} diff --git a/bid_main/templates/bid_main/mfa/setup.html b/bid_main/templates/bid_main/mfa/setup.html new file mode 100644 index 0000000..3a1e499 --- /dev/null +++ b/bid_main/templates/bid_main/mfa/setup.html @@ -0,0 +1,116 @@ +{% extends 'layout.html' %} +{% load humanize pipeline static %} +{% block page_title %} +Multi-factor Authentication Setup +{% endblock %} + +{% block body %} +
+
+
+Multi-factor Authentication (MFA) Setup
+ {% if user_has_mfa_configured %} ++ You have configured MFA for your account. + You can disable MFA at any time, but you have to pass the verification using your authentication device or a recovery code. +
+ {% if show_missing_recovery_codes_warning %} ++ Please make sure that you do not lock yourself out: + generate and store recovery codes as a backup verification method. + If you lose your authenticator device or a security key you can use a recovery code to login and reconfigure your MFA methods. +
+ {% endif %} ++ Every time you sign-in on a new device you will be asked to pass the MFA verification. + If you use the "remember this device" option, you won't be prompted for MFA verification for that device in the next {{ agent_trust_days }} days. + Verification also expires after {{ agent_inactivity_days }} days of inactivity. +
+
+ Disable MFA
+
+ {% else %}
+ + MFA makes your account more secure against account takeover attacks. + You can read more in a guide from Electronic Frontier Foundation. +
++ If you have privileged access (admin or moderator) on any of Blender websites, you should setup MFA to avoid potential harm done to other community members through misuse of your account. +
+ {% endif %} +
+
+
+Time-based one-time password (TOTP)
++ Also known as authenticator application. +
++ If you don't have an authenticator application, you can choose one from a list of TOTP applications. +
+-
+ {% for d in devices_per_type.totp %}
+
- + {{ d.name }} + {% if d.last_used_at %}(Last used {{ d.last_used_at|naturaltime }}){% endif %} + + {% endfor %} +
+
+
+{% if user_can_setup_recovery %}
+Security keys (U2F, WebAuthn, FIDO2)
++ Hardware security keys, e.g. Yubikeys. +
++ Blender ID supports these keys only as a second factor and does not provide a passwordless sign-in. +
+-
+ {% for d in devices_per_type.u2f %}
+
- + {{ d.name }} + {% if d.last_used_at %}(Last used {{ d.last_used_at|naturaltime }}){% endif %} + + {% endfor %} +
+
+{% endif %}
+{% endblock %}
diff --git a/bid_main/templates/bid_main/mfa/totp_register.html b/bid_main/templates/bid_main/mfa/totp_register.html
new file mode 100644
index 0000000..0d1bb94
--- /dev/null
+++ b/bid_main/templates/bid_main/mfa/totp_register.html
@@ -0,0 +1,54 @@
+{% extends 'layout.html' %}
+{% load pipeline static %}
+{% load add_form_classes from forms %}
+{% block page_title %}
+Multi-factor Authentication Setup
+{% endblock %}
+
+{% block body %}
+Recovery codes
++ Store your recovery codes safely (e.g. in a password manager or use a printed copy) and don't share them. + Each code can be used only once. + You can generate a new set of recovery codes at any time, any remaining old codes will be invalidated. +
+ {% with recovery=devices_per_type.recovery.0 %} + {% if recovery %} +
+ {% with code_count=recovery_codes|length %}
+ {{ code_count }} recovery code{{ code_count|pluralize }} remaining
+ {% if display_recovery_codes %}
+ Hide
+ {% else %}
+ Display
+ {% endif %}
+
+ {% if display_recovery_codes %}
+
+ {% endif %}
+
+ {% endwith %}
+-
+ {% for code in recovery_codes %}
+
{{ code }}
+ {% endfor %}
+
+
+{% endblock %}
diff --git a/bid_main/templates/bid_main/mfa/u2f_register.html b/bid_main/templates/bid_main/mfa/u2f_register.html
new file mode 100644
index 0000000..7ce4c36
--- /dev/null
+++ b/bid_main/templates/bid_main/mfa/u2f_register.html
@@ -0,0 +1,56 @@
+{% extends 'layout.html' %}
+{% load pipeline static %}
+{% load add_form_classes from forms %}
+{% block page_title %}
+Multi-factor Authentication Setup
+{% endblock %}
+
+{% block body %}
+New TOTP device
+
+
+
+
+ 
+
+
+
+ show secret key for manual entry
{{ manual_secret_key }}
+
+ -
+
- + Open your authenticator app and add a new entry by scanning the QR code from this page. + If you can't scan the QR code, you can enter the secret key manually. + +
- Enter a 6-digit code shown in the authenticator. +
- Pick any device name for your authenticator that you would recognize (e.g. "FreeOTP on my phone") and submit the form. + {% if first_device %} +
- Since this is your first MFA device, you will be promted to enter a new code once more to sign-in using MFA. + {% endif %} +
+
+
+ {% with form=form|add_form_classes %}
+
+ {% endwith %}
+
+
+
+
+
+{% endblock %}
diff --git a/bid_main/templates/components/forms/field.html b/bid_main/templates/components/forms/field.html
index 5d05c08..6854628 100644
--- a/bid_main/templates/components/forms/field.html
+++ b/bid_main/templates/components/forms/field.html
@@ -4,12 +4,13 @@
{{ field }}
{% if not field.is_hidden %}
{% include 'components/forms/label.html' with label_class="form-check-label" %}
- {% if with_help_text and field.help_text %}
- {{ form.new_password1.help_text|safe }}
{% endif %}
+ New U2F device
+
+
+
+
+ Please watch setup video if you are not familiar with yubikeys.
+ {% if first_device %} +Since this is your first MFA device, you will be promted to use your security key immediately after setup to sign-in using MFA.
+ {% endif %} +
+
+
+ {% with form=form|add_form_classes %}
+
+ {% endwith %}
+
+ {{ field.errors }}
-
{% if not field.is_hidden %}
@@ -18,7 +19,7 @@
{{ field }}
{% endif %}
diff --git a/bid_main/templatetags/common.py b/bid_main/templatetags/common.py
new file mode 100644
index 0000000..b779b89
--- /dev/null
+++ b/bid_main/templatetags/common.py
@@ -0,0 +1,12 @@
+from django import template
+
+register = template.Library()
+
+
+# Credit: https://stackoverflow.com/questions/46026268/
+@register.simple_tag(takes_context=True)
+def query_transform(context, **kwargs):
+ query = context['request'].GET.copy()
+ for k, v in kwargs.items():
+ query[k] = v
+ return query.urlencode()
diff --git a/bid_main/tests/test_mfa.py b/bid_main/tests/test_mfa.py
new file mode 100644
index 0000000..8bee3aa
--- /dev/null
+++ b/bid_main/tests/test_mfa.py
@@ -0,0 +1,245 @@
+from unittest.mock import patch
+import re
+
+from django.test.client import Client
+from django.test import TestCase
+from django.urls import reverse
+from django.utils import timezone
+
+from bid_main.tests.factories import UserFactory
+from mfa.models import EncryptedTOTPDevice, devices_for_user
+
+
+@patch(
+ 'django.contrib.auth.base_user.AbstractBaseUser.check_password',
+ new=lambda _, pwd: pwd == 'hunter2',
+)
+@patch(
+ 'django_otp.oath.TOTP.verify',
+ new=lambda _, token, *args, **kwargs: int(token) == 123456,
+)
+class TestMfa(TestCase):
+ def setUp(self):
+ self.user = UserFactory(
+ confirmed_email_at=timezone.now(),
+ privacy_policy_agreed=timezone.now(),
+ )
+
+ def test_no_mfa(self):
+ client = Client()
+ response = client.post(
+ '/login',
+ {'username': self.user.email, 'password': 'hunter2'},
+ follow=True,
+ )
+ # showing account page, after a redirect
+ self.assertEqual(response.status_code, 200)
+ self.assertContains(response, '{{ field.errors }}
{% if with_help_text and field.help_text %}
- {{ form.new_password1.help_text|safe }}
+ {{ field.help_text|safe }}
{% endif %}
Account
') + + def test_setup_totp(self): + client = Client() + response = client.post( + '/login', + {'username': self.user.email, 'password': 'hunter2'}, + follow=True, + ) + self.assertEqual(response.status_code, 200) + response = client.get(reverse('bid_main:mfa_totp')) + match = re.search( + r'input type="hidden" name="key" value="([^"]+)"', str(response.content) + ) + key = match.group(1) + match = re.search( + r'input type="hidden" name="signature" value="([^"]+)"', str(response.content) + ) + signature = match.group(1) + response = client.post( + reverse('bid_main:mfa_totp'), + {'name': 'test totp device', 'code': '123456', 'key': key, 'signature': signature}, + follow=True + ) + self.assertEqual(response.status_code, 200) + self.assertEqual(devices_for_user(self.user)[0].name, 'test totp device') + + # emulating a different browser + client = Client() + response = client.post( + '/login', + {'username': self.user.email, 'password': 'hunter2'}, + follow=True, + ) + self.assertEqual(response.status_code, 200) + # haven't reached the account page + self.assertNotContains(response, 'Account
') + self.assertContains(response, 'autocomplete="one-time-code"') + match = re.search( + r'input type="hidden" name="otp_device" value="([^"]+)"', str(response.content) + ) + otp_device = match.group(1) + + response = client.post( + '/login', + {'otp_device': otp_device, 'otp_token': '123456'}, + follow=True, + ) + # have reached the account page + self.assertEqual(response.status_code, 200) + self.assertContains(response, 'Account
') + + def test_recovery_codes(self): + # shortcut: create a totp device via a model + EncryptedTOTPDevice.objects.create(encrypted_key='00', key='', name='totp', user=self.user) + + client = Client() + response = client.post( + '/login', + {'username': self.user.email, 'password': 'hunter2'}, + follow=True, + ) + match = re.search( + r'input type="hidden" name="otp_device" value="([^"]+)"', str(response.content) + ) + otp_device = match.group(1) + response = client.post( + '/login', + {'otp_device': otp_device, 'otp_token': '123456'}, + follow=True, + ) + self.assertContains(response, 'Account
') + + response = client.post(reverse('bid_main:mfa_generate_recovery'), follow=True) + self.assertContains(response, '10 recovery codes remaining') + + # hope that we don't add any other code elements + match = re.search( + r'([0-9A-F]{16})', str(response.content)
+ )
+ recovery_code = match.group(1)
+
+ client = Client()
+ response = client.post(
+ '/login',
+ {'username': self.user.email, 'password': 'hunter2'},
+ follow=True,
+ )
+ response = client.get('/login?mfa_device_type=recovery')
+ match = re.search(
+ r'input type="hidden" name="otp_device" value="([^"]+)"', str(response.content)
+ )
+ otp_device = match.group(1)
+ response = client.post(
+ '/login?mfa_device_type=recovery',
+ {'otp_device': otp_device, 'otp_token': recovery_code},
+ )
+ self.assertEqual(response.status_code, 302)
+ response = client.get(reverse('bid_main:mfa'))
+ self.assertContains(response, '9 recovery codes remaining')
+
+ # test that can't reuse the same code, repeating the steps
+ client = Client()
+ response = client.post(
+ '/login',
+ {'username': self.user.email, 'password': 'hunter2'},
+ follow=True,
+ )
+ response = client.get('/login?mfa_device_type=recovery')
+ match = re.search(
+ r'input type="hidden" name="otp_device" value="([^"]+)"', str(response.content)
+ )
+ otp_device = match.group(1)
+ response = client.post(
+ '/login?mfa_device_type=recovery',
+ {'otp_device': otp_device, 'otp_token': recovery_code},
+ )
+ self.assertEqual(response.status_code, 200)
+
+ def test_disable_mfa(self):
+ # shortcut: create a totp device via a model
+ EncryptedTOTPDevice.objects.create(encrypted_key='00', key='', name='totp', user=self.user)
+
+ client = Client()
+ response = client.post(
+ '/login',
+ {'username': self.user.email, 'password': 'hunter2'},
+ follow=True,
+ )
+ match = re.search(
+ r'input type="hidden" name="otp_device" value="([^"]+)"', str(response.content)
+ )
+ otp_device = match.group(1)
+ response = client.post(
+ '/login',
+ {'otp_device': otp_device, 'otp_token': '123456'},
+ follow=True,
+ )
+
+ client.post(reverse('bid_main:mfa_disable'), {'disable_mfa_confirm': 'True'})
+
+ # no mfa requried now
+ client = Client()
+ response = client.post(
+ '/login',
+ {'username': self.user.email, 'password': 'hunter2'},
+ follow=True,
+ )
+ self.assertContains(response, '