1# An enrollment link works once and for ten minutes: a second passkey can't2# use it, a link nobody used is dead after ten minutes, and a link of a user3# whose keys were removed adds nothing. Without FORGE_BASE_URL there is no4# sign-in at all.5. "$(dirname "$0")/../lib.sh"6user dami7user ana8export FORGE_BASE_URL=https://forge.test9private_server10auth() { node "$T_HOME/test/authenticator.ts" "$@"; }11link() { ssh_as "$1" passkey | sed -n 's/^ .*#enroll=//p'; }1213code=$(link dami)14ok auth enroll "$PRIV" "$code" "$T/one.key"15fails_with 'HTTP 400: .*expired or has been used' auth enroll "$PRIV" "$code" "$T/two.key"16missing "$T/two.key"17# The same answer sent twice: the second finds its challenge used up.18code=$(link dami)19fails_with 'HTTP 400: .*challenge' auth enroll "$PRIV" "$code" "$T/three.key" --replay20ok ssh_as dami passkeys21eq "$(grep -c '^[0-9a-f]\{8\} ' "$T_LOG")" 22223# Ten minutes and a second later, an unused link is dead; at ten minutes less a second it works.24late=$(link dami)25early=$(link dami)26stop_servers27export FORGE_NOW=$((T_NOW + 599))28private_server29ok auth enroll "$PRIV" "$early" "$T/early.key"30stop_servers31export FORGE_NOW=$((T_NOW + 601))32private_server33fails_with 'HTTP 400: .*expired or has been used' auth enroll "$PRIV" "$late" "$T/late.key"34export FORGE_NOW=$T_NOW3536# A link of a user who is gone.37code=$(link ana)38ok forge user rm ana39fails_with 'HTTP 400: .*expired or has been used' auth enroll "$PRIV" "$code" "$T/ana.key"40eq "$(http -s -o /dev/null -w '%{http_code}' -X POST -H 'Origin: https://forge.test' -d '{"code":"nonsense"}' "$PRIV/login/enroll/options")" 4004142# No FORGE_BASE_URL, no sign-in: the page says why, and posts are refused.43stop_servers44unset FORGE_BASE_URL45private_server46http -s "$PRIV/login/" >"$T/page"47has "$T/page" "Sign-in isn't set up here"48eq "$(http -s -o /dev/null -w '%{http_code}' -X POST -H 'Origin: http://localhost' -d '{}' "$PRIV/login/options")" 403