fix(mfa): show enrolled methods as Enabled, not Set up - #73
Merged
Conversation
AuthorizerMFASetup only knew about passkey enrolment, so a user with TOTP (or email/SMS OTP) already verified saw "Set up" on every tile and was walked into a fresh enrolment. The server exposes the truth as User.enrolled_mfa_methods; take it as a prop and badge each tile. passkeyRegistered stays honoured so existing hosts keep working. Also adds vitest (no test runner existed) and bumps authorizer-js to 3.3.0.
size-limit report 📦
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A user with TOTP already verified opened Manage MFA and saw Set up on the Authenticator app tile, as if nothing was enrolled — same for email/SMS OTP. Only the passkey tile ever reflected enrolment, via the
passkeyRegisteredboolean.Backend was never the issue:
User.enrolled_mfa_methodsreports exactly what is verified, and authorizer-js already fetches it in the user fragment. The picker just had no way to receive it.Change
AuthorizerMFASetupgainsenrolledMethods?: string[]— takesuser.enrolled_mfa_methodsverbatim (totp,webauthn,email_otp,sms_otp). Every tile now computesenabled, so enrolled methods render "Enabled" / "Manage".normalizeEnrolledMethods()mapswebauthnonto thepasskeytile key.passkeyRegisteredstill honoured (OR'd in) — existing hosts keep working, hosts can drop their extrawebauthnCredentials()call.3.3.0-rc.5→3.3.0.2.2.0-rc.6.Tests
Repo had no test runner (
npm testwastsc --noEmit). Added vitest + jsdom + Testing Library andsrc/__tests__/AuthorizerMFASetup.test.tsx(5 tests): enrolled → Enabled/Manage, nothing enrolled → Set up, deprecatedpasskeyRegisteredpath, and thewebauthn→passkeymapping. Verified they fail against the pre-fix component.npm testadded to CI.Verified
npm run type-check,npm test(5/5),npm run buildall pass.npm run lintis broken on main already (eslint flat-config rejects therootkey ineslint.config.js) — untouched here.Consumed by authorizerdev/authorizer
web/appsettings page, which is pinned to2.2.0-rc.6.