
Hartmutandclaude-flow
d3bfa8ca98
test(mfa): full MFA test coverage — unit + E2E
Unit tests (packages/api — 13 tests):
- generateTotpSecret: DB write, returns secret + uri
- verifyAndEnableTotp: valid token enables; invalid/already-enabled/no-secret guards
- verifyTotp (login): valid → ok; invalid → UNAUTHORIZED; not-enabled → BAD_REQUEST
- getCurrentMfaStatus: reads totpEnabled flag
E2E tests (apps/web/e2e/dev-system/mfa.spec.ts — 7 scenarios):
- Setup flow: generate secret, enable with valid code, reject invalid code, UI QR check
- Login flow: MFA prompt appears, valid code logs in, wrong code shows error + stays on prompt
- Login without MFA: no TOTP prompt for users without MFA enabled
Also: start.sh health-check timeout 30s → 90s (container startup can exceed 30s)
Co-Authored-By: claude-flow <ruv@ruv.net>
2026-04-01 22:30:36 +02:00
..
2026-04-01 22:30:36 +02:00
2026-03-29 12:47:12 +02:00
2026-04-01 22:14:20 +02:00
2026-04-01 19:09:49 +02:00
2026-04-01 07:42:03 +02:00
2026-04-01 22:14:20 +02:00
2026-04-01 18:19:21 +02:00
2026-03-28 22:49:28 +01:00
2026-04-01 19:09:49 +02:00
2026-03-14 14:31:09 +01:00
2026-03-22 18:38:27 +01:00
2026-03-22 18:38:27 +01:00
2026-03-22 18:38:27 +01:00
2026-03-22 20:39:08 +01:00
2026-03-28 22:49:28 +01:00
2026-04-01 07:42:03 +02:00
2026-04-01 07:42:03 +02:00
2026-04-01 07:42:03 +02:00