You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
gcgj-dify-1.7.0/web/docs/MFA_TESTING.md

3.1 KiB

MFA Testing Summary

Frontend Testing

Current State

  • Jest is configured in package.json but dependencies are not properly installed in the Docker container
  • Created a sample test file: /home/webapp/dify/web/app/components/header/account-setting/mfa-page.test.tsx
  • The test file demonstrates how to test the MFA component with proper mocking

Test Coverage

The test file covers:

  1. Loading state display
  2. Enable/Disable button rendering based on MFA status
  3. Setup modal opening
  4. Successful MFA setup flow
  5. Error handling during setup
  6. MFA disable functionality

To Run Frontend Tests

When dependencies are properly installed:

npm test -- mfa-page.test.tsx

Backend Testing

Current State

  • Pytest is installed and working in the API container
  • Test file exists at: /home/webapp/dify/api/tests/unit_tests/controllers/console/auth/test_mfa.py
  • Some tests have mock configuration issues due to the application's initialization complexity

Test Coverage

The test file covers:

  1. MFA setup initialization
  2. Setup completion with valid/invalid tokens
  3. MFA disable with password verification
  4. MFA status retrieval
  5. MFA verification during login
  6. Error cases (missing parameters, wrong credentials)

Working Tests

  • test_mfa_verify_missing_parameters - PASSED

To Run Backend Tests

docker exec docker-api-1 python -m pytest tests/unit_tests/controllers/console/auth/test_mfa.py -v -o addopts=

Manual Testing Scenarios

Based on the implementation, here are the key scenarios to test manually:

1. MFA Setup Flow

  • Navigate to Account page
  • Click MFA button
  • Verify QR code displays
  • Scan QR code with authenticator app
  • Enter TOTP code
  • Verify backup codes are displayed
  • Confirm MFA is enabled

2. MFA Login Flow

  • Log out
  • Log in with email/password
  • Verify MFA prompt appears
  • Enter TOTP code
  • Verify successful login

3. MFA Disable Flow

  • Navigate to Account page with MFA enabled
  • Click disable MFA
  • Enter account password
  • Verify MFA is disabled

4. Backup Code Usage

  • During login, use backup code instead of TOTP
  • Verify backup code works only once

5. Error Cases

  • Try invalid TOTP during setup
  • Try wrong password during disable
  • Try expired TOTP code
  • Try reused backup code

6. UI/UX Verification

  • Verify Japanese translations work (no "operation.cancel" errors)
  • Verify modal displays correctly (no z-index issues)
  • Verify loading states during API calls
  • Verify error messages display properly

Known Issues

  1. Frontend test environment requires proper npm dependency installation
  2. Backend tests have complex mocking requirements due to Flask app initialization
  3. Coverage tools (pytest-cov) not installed in Docker container

Recommendations

  1. Install test dependencies in Docker containers during build
  2. Add test commands to Makefile for easier execution
  3. Consider using Flask test client fixtures for better test isolation
  4. Add integration tests that test the full MFA flow end-to-end