@@ -246,6 +306,44 @@ class OrganizationMemberDetail extends AsyncView {
+ {showAuth && (
+
+ {t('Authentication')}
+
+
+
+
+
+
+
+
+
+
+
+
+ )}
+
{
+ expect(wrapper.find(button).text()).toEqual('Reset two-factor authentication');
+ expect(wrapper.find(button).prop('disabled')).toBe(false);
+
+ expect(wrapper.find(tooltip).prop('title')).toEqual('');
+ expect(wrapper.find(tooltip).prop('disabled')).toBe(true);
+ };
+
+ const expectButtonDisabled = title => {
+ expect(wrapper.find(button).text()).toEqual('Reset two-factor authentication');
+ expect(wrapper.find(button).prop('disabled')).toBe(true);
+
+ expect(wrapper.find(tooltip).prop('title')).toEqual(title);
+ expect(wrapper.find(tooltip).prop('disabled')).toBe(false);
+ };
+
+ it('does not show for pending member', function() {
+ wrapper = mount(
+ ,
+ routerContext
+ );
+ expect(wrapper.find(button)).toHaveLength(0);
+ });
+
+ it('shows tooltip for joined member without permission to edit', function() {
+ wrapper = mount(
+ ,
+ routerContext
+ );
+ expectButtonDisabled('You do not have permission to perform this action');
+ });
+
+ it('shows tooltip for member without 2fa', function() {
+ wrapper = mount(
+ ,
+ routerContext
+ );
+ expectButtonDisabled('Not enrolled in two-factor authentication');
+ });
+
+ it('can reset member 2FA', function() {
+ let deleteMocks = has2fa.user.authenticators.map(auth => {
+ return MockApiClient.addMockResponse({
+ url: `/users/${has2fa.user.id}/authenticators/${auth.id}/`,
+ method: 'DELETE',
+ });
+ });
+
+ wrapper = mount(
+ ,
+ routerContext
+ );
+
+ expectButtonEnabled();
+ wrapper.find(button).simulate('click');
+ wrapper.find('Button[data-test-id="confirm-modal"]').simulate('click');
+ deleteMocks.map(deleteMock => {
+ expect(deleteMock).toHaveBeenCalled();
+ });
+ });
+
+ it('shows tooltip for member in multiple orgs', function() {
+ wrapper = mount(
+ ,
+ routerContext
+ );
+ expectButtonDisabled('Cannot be reset since user is in more than one organization');
+ });
+
+ it('shows tooltip for member in 2FA required org', function() {
+ organization.require2FA = true;
+ MockApiClient.addMockResponse({
+ url: `/organizations/${organization.slug}/members/${has2fa.id}/`,
+ body: has2fa,
+ });
+
+ wrapper = mount(
+ ,
+ routerContext
+ );
+ expectButtonDisabled(
+ 'Cannot be reset since two-factor is required for this organization'
+ );
+ });
+ });
});
diff --git a/tests/sentry/api/endpoints/test_organization_member_details.py b/tests/sentry/api/endpoints/test_organization_member_details.py
index 0f94d68b4e5fa6..71f3d5f1fcef0e 100644
--- a/tests/sentry/api/endpoints/test_organization_member_details.py
+++ b/tests/sentry/api/endpoints/test_organization_member_details.py
@@ -2,10 +2,13 @@
from django.core import mail
from django.core.urlresolvers import reverse
+from django.db.models import F
from mock import patch
from sentry.models import (
- AuthProvider, OrganizationMember, OrganizationMemberTeam)
+ Authenticator, AuthProvider, Organization, OrganizationMember, OrganizationMemberTeam,
+ RecoveryCodeInterface, TotpInterface
+)
from sentry.testutils import APITestCase
@@ -466,6 +469,166 @@ def test_cannot_lower_superior_role(self):
assert owner_om.role == 'owner'
+class ResetOrganizationMember2faTest(APITestCase):
+ def setUp(self):
+ self.owner = self.create_user()
+ self.org = self.create_organization(owner=self.owner)
+
+ self.member = self.create_user()
+ self.member_om = self.create_member(
+ organization=self.org,
+ user=self.member,
+ role='member',
+ teams=[],
+ )
+ self.login_as(self.member)
+ totp = TotpInterface()
+ totp.enroll(self.member)
+ self.interface_id = totp.authenticator.id
+ assert Authenticator.objects.filter(user=self.member).exists()
+
+ def assert_can_get_authenticators(self):
+ path = reverse(
+ 'sentry-api-0-organization-member-details', args=[self.org.slug, self.member_om.id]
+ )
+ resp = self.client.get(path)
+ assert resp.status_code == 200
+ data = resp.data
+
+ assert len(data['user']['authenticators']) == 1
+ assert data['user']['has2fa'] is True
+ assert data['user']['canReset2fa'] is True
+
+ def assert_cannot_get_authenticators(self):
+ path = reverse(
+ 'sentry-api-0-organization-member-details', args=[self.org.slug, self.member_om.id]
+ )
+ resp = self.client.get(path)
+ assert resp.status_code == 200
+ data = resp.data
+
+ assert 'authenticators' not in data['user']
+ assert 'canReset2fa' not in data['user']
+
+ def assert_can_remove_authenticators(self):
+ path = reverse(
+ 'sentry-api-0-user-authenticator-details', args=[self.member.id, self.interface_id]
+ )
+ resp = self.client.delete(path)
+ assert resp.status_code == 204
+ assert not Authenticator.objects.filter(user=self.member).exists()
+
+ def assert_cannot_remove_authenticators(self):
+ path = reverse(
+ 'sentry-api-0-user-authenticator-details', args=[self.member.id, self.interface_id]
+ )
+ resp = self.client.delete(path)
+ assert resp.status_code == 403
+ assert Authenticator.objects.filter(user=self.member).exists()
+
+ def test_org_owner_can_reset_member_2fa(self):
+ self.login_as(self.owner)
+
+ self.assert_can_get_authenticators()
+ self.assert_can_remove_authenticators()
+
+ def test_owner_must_have_org_membership(self):
+ owner = self.create_user()
+ self.create_organization(owner=owner)
+ self.login_as(owner)
+
+ path = reverse(
+ 'sentry-api-0-organization-member-details', args=[self.org.slug, self.member_om.id]
+ )
+ resp = self.client.get(path)
+ assert resp.status_code == 403
+
+ self.assert_cannot_remove_authenticators()
+
+ def test_org_manager_can_reset_member_2fa(self):
+ manager = self.create_user()
+ self.create_member(
+ organization=self.org,
+ user=manager,
+ role='manager',
+ teams=[],
+ )
+ self.login_as(manager)
+
+ self.assert_can_get_authenticators()
+ self.assert_can_remove_authenticators()
+
+ def test_org_admin_cannot_reset_member_2fa(self):
+ admin = self.create_user()
+ self.create_member(
+ organization=self.org,
+ user=admin,
+ role='admin',
+ teams=[],
+ )
+ self.login_as(admin)
+
+ self.assert_cannot_get_authenticators()
+ self.assert_cannot_remove_authenticators()
+
+ def test_org_member_cannot_reset_member_2fa(self):
+ member = self.create_user()
+ self.create_member(
+ organization=self.org,
+ user=member,
+ role='member',
+ teams=[],
+ )
+ self.login_as(member)
+
+ self.assert_cannot_get_authenticators()
+ self.assert_cannot_remove_authenticators()
+
+ def test_cannot_reset_member_2fa__has_multiple_org_membership(self):
+ self.create_organization(owner=self.member)
+ self.login_as(self.owner)
+
+ path = reverse(
+ 'sentry-api-0-organization-member-details', args=[self.org.slug, self.member_om.id]
+ )
+ resp = self.client.get(path)
+ assert resp.status_code == 200
+ data = resp.data
+
+ assert len(data['user']['authenticators']) == 1
+ assert data['user']['has2fa'] is True
+ assert data['user']['canReset2fa'] is False
+
+ self.assert_cannot_remove_authenticators()
+
+ def test_cannot_reset_member_2fa__org_requires_2fa(self):
+ self.login_as(self.owner)
+ TotpInterface().enroll(self.owner)
+
+ self.org.update(flags=F('flags').bitor(Organization.flags.require_2fa))
+ assert self.org.flags.require_2fa.is_set is True
+
+ self.assert_cannot_remove_authenticators()
+
+ def test_owner_can_only_reset_member_2fa(self):
+ self.login_as(self.owner)
+
+ path = reverse(
+ 'sentry-api-0-user-authenticator-details', args=[self.member.id, self.interface_id]
+ )
+ resp = self.client.get(path)
+ assert resp.status_code == 403
+
+ # cannot regenerate recovery codes
+ recovery = RecoveryCodeInterface()
+ recovery.enroll(self.user)
+ path = reverse(
+ 'sentry-api-0-user-authenticator-details', args=[self.member.id, recovery.authenticator.id]
+ )
+ resp = self.client.put(path)
+ assert resp.status_code == 403
+
+
class DeleteOrganizationMemberTest(APITestCase):
def test_simple(self):
self.login_as(user=self.user)
diff --git a/tests/sentry/api/serializers/test_user.py b/tests/sentry/api/serializers/test_user.py
index 564b541563ebdd..3db705608288cf 100644
--- a/tests/sentry/api/serializers/test_user.py
+++ b/tests/sentry/api/serializers/test_user.py
@@ -84,3 +84,8 @@ def test_simple(self):
assert len(result['authenticators']) == 1
assert result['authenticators'][0]['id'] == six.text_type(auth.id)
assert result['permissions'] == ['foo']
+ assert result['canReset2fa'] is True
+
+ self.create_organization(owner=user)
+ result = serialize(user, user, DetailedUserSerializer())
+ assert result['canReset2fa'] is False