1 files changed, 94 insertions, 12 deletions

diff --git a/spec/models/u2f_registration_spec.rb b/spec/models/u2f_registration_spec.rb
index 6bb9ccfcf35..1fab3882c2a 100644
--- a/spec/models/u2f_registration_spec.rb
+++ b/spec/models/u2f_registration_spec.rb
@@ -6,23 +6,68 @@ RSpec.describe U2fRegistration do
   let_it_be(:user) { create(:user) }
 
   let(:u2f_registration_name) { 'u2f_device' }
+  let(:app_id) { FFaker::BaconIpsum.characters(5) }
+  let(:device) { U2F::FakeU2F.new(app_id) }
 
-  let(:u2f_registration) do
-    device = U2F::FakeU2F.new(FFaker::BaconIpsum.characters(5))
-    create(:u2f_registration, name: u2f_registration_name,
-                              user: user,
-                              certificate: Base64.strict_encode64(device.cert_raw),
-                              key_handle: U2F.urlsafe_encode64(device.key_handle_raw),
-                              public_key: Base64.strict_encode64(device.origin_public_key_raw))
+  describe '.authenticate' do
+    context 'when registration is found' do
+      it 'returns true' do
+        create_u2f_registration
+        device_challenge = U2F.urlsafe_encode64(SecureRandom.random_bytes(32))
+        sign_response_json = device.sign_response(device_challenge)
+
+        response = U2fRegistration.authenticate(
+          user,
+          app_id,
+          sign_response_json,
+          device_challenge
+        )
+
+        expect(response).to eq true
+      end
+    end
+
+    context 'when registration not found' do
+      it 'returns nil' do
+        device_challenge = U2F.urlsafe_encode64(SecureRandom.random_bytes(32))
+        sign_response_json = device.sign_response(device_challenge)
+
+        # data is valid but user does not have any u2f_registrations
+        response = U2fRegistration.authenticate(
+          user,
+          app_id,
+          sign_response_json,
+          device_challenge
+        )
+
+        expect(response).to eq nil
+      end
+    end
+
+    context 'when args passed in are invalid' do
+      it 'returns false' do
+        some_app_id = 123
+        invalid_json = 'invalid JSON'
+        challenges = 'whatever'
+
+        response = U2fRegistration.authenticate(
+          user,
+          some_app_id,
+          invalid_json,
+          challenges
+        )
+
+        expect(response).to eq false
+      end
+    end
   end
 
   describe 'callbacks' do
-    describe '#create_webauthn_registration' do
+    describe 'after create' do
       shared_examples_for 'creates webauthn registration' do
         it 'creates webauthn registration' do
-          created_record = u2f_registration
-
-          webauthn_registration = WebauthnRegistration.where(u2f_registration_id: created_record.id)
+          u2f_registration = create_u2f_registration
+          webauthn_registration = WebauthnRegistration.where(u2f_registration_id: u2f_registration.id)
           expect(webauthn_registration).to exist
         end
       end
@@ -52,8 +97,45 @@ RSpec.describe U2fRegistration do
           receive(:track_exception).with(kind_of(StandardError),
                                              u2f_registration_id: 123))
 
-        u2f_registration
+        create_u2f_registration
       end
     end
+
+    describe 'after update' do
+      context 'when counter is updated' do
+        it 'updates the webauthn registration counter to be the same value' do
+          u2f_registration = create_u2f_registration
+          new_counter = u2f_registration.counter + 1
+          webauthn_registration = WebauthnRegistration.find_by(u2f_registration_id: u2f_registration.id)
+
+          u2f_registration.update!(counter: new_counter)
+
+          expect(u2f_registration.reload.counter).to eq(new_counter)
+          expect(webauthn_registration.reload.counter).to eq(new_counter)
+        end
+      end
+
+      context 'when sign count of registration is not updated' do
+        it 'does not update the counter' do
+          u2f_registration = create_u2f_registration
+          webauthn_registration = WebauthnRegistration.find_by(u2f_registration_id: u2f_registration.id)
+
+          expect do
+            u2f_registration.update!(name: 'a new name')
+          end.not_to change { webauthn_registration.counter }
+        end
+      end
+    end
+  end
+
+  def create_u2f_registration
+    create(
+      :u2f_registration,
+      name: u2f_registration_name,
+      user: user,
+      certificate: Base64.strict_encode64(device.cert_raw),
+      key_handle: U2F.urlsafe_encode64(device.key_handle_raw),
+      public_key: Base64.strict_encode64(device.origin_public_key_raw)
+    )
   end
 end