test: cover recovery-code redemption, re-enrollment, and the real request layer

Three gaps mapped to the riskiest parts of this PR were unpinned:

1. Nothing proved a code returned as XXXX-XXXX actually redeems through
   AbstractMFAChallengeStrategy::verifyRecoveryCode() - the hash is of the
   dash-less string, so the generate->display->redeem contract (including
   the dash normalization) was untested.
2. enableTwoFactor()'s already-enrolled guard (412) had no regression test.
3. Every JS test mocked profile/actions, so nothing exercised the real
   request layer - exactly where the missing postRawRequestFull export
   lived. tests/js/profile/actions.test.js only stubs the transport
   (superagent) and calls the real enableTwoFactor/regenerateRecoveryCodes;
   verified it reproduces the original "postRawRequestFull is not a
   function" TypeError when that export is removed.

Author: romanetar

tests/RecoveryCodeRegenerationTest.php

@@ -18,6 +18,7 @@
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 use LaravelDoctrine\ORM\Facades\EntityManager;
+use Strategies\MFA\MFAChallengeStrategyFactory;
 
 /**
  * Integration tests for regenerating recovery codes from the user profile
@@ -123,6 +124,51 @@ public function testEnableTwoFactorGeneratesRecoveryCodes(): void
         $this->assertCount($expectedCount, $remaining);
     }
 
+    public function testDisplayedRecoveryCodeRedeemsThroughVerifyRecoveryCode(): void
+    {
+        $admin = $this->admin();
+
+        $response = $this->regenerate(self::SEED_PASSWORD);
+        $this->assertResponseStatus(200);
+        $payload = json_decode($response->getContent(), true);
+        $displayedCode = $payload['recovery_codes'][0];
+        $this->assertMatchesRegularExpression('/^[A-Z0-9]+-[A-Z0-9]+$/', $displayedCode);
+
+        EntityManager::clear();
+        $admin = EntityManager::getRepository(User::class)->find($admin->getId());
+        $unusedBefore = EntityManager::getRepository(UserRecoveryCode::class)
+            ->findBy(['user' => $admin->getId(), 'used_at' => null]);
+
+        // The hash was generated over the dash-less string; redeeming the code
+        // exactly as it was displayed (with its "-" separator) must still work.
+        $strategy = MFAChallengeStrategyFactory::create(User::MFAMethod_OTP);
+        $strategy->verifyRecoveryCode($admin, $displayedCode);
+
+        EntityManager::clear();
+        $unusedAfter = EntityManager::getRepository(UserRecoveryCode::class)
+            ->findBy(['user' => $admin->getId(), 'used_at' => null]);
+
+        $this->assertCount(
+            count($unusedBefore) - 1,
+            $unusedAfter,
+            'the code redeemed exactly as displayed must be consumed exactly once'
+        );
+    }
+
+    public function testEnableTwoFactorRejectsWhenAlreadyEnabled(): void
+    {
+        $this->enableTwoFactor('email_otp');
+        $this->assertResponseStatus(200);
+
+        $response = $this->enableTwoFactor('email_otp');
+
+        $this->assertResponseStatus(412);
+
+        EntityManager::clear();
+        $admin = $this->admin();
+        $this->assertTrue($admin->isTwoFactorEnabled(), '2FA must remain enabled after the rejected second call');
+    }
+
     public function testEnableTwoFactorRejectsUnavailableMethod(): void
     {
         // sms_otp is a stub in Phase I (isPhoneNumberVerified() is hardcoded false),

tests/js/profile/actions.test.js

@@ -0,0 +1,57 @@
+// Unlike the RecoveryCodesPanel/TwoFactorSection tests, this suite does NOT
+// mock "profile/actions" - it exercises the real enableTwoFactor()/
+// regenerateRecoveryCodes() against the real base_actions.js request layer,
+// only stubbing the transport (superagent) itself. This is the layer where a
+// broken import (e.g. a named export that doesn't exist) actually blows up -
+// a test that mocks profile/actions can never catch that.
+jest.mock("superagent", () => ({
+    post: jest.fn(),
+}));
+
+import request from "superagent";
+import { enableTwoFactor, regenerateRecoveryCodes } from "profile/actions";
+
+function makeChainableRequest({ body = {}, error = null } = {}) {
+    const req = {};
+    req.set = jest.fn(() => req);
+    req.send = jest.fn(() => req);
+    req.timeout = jest.fn(() => req);
+    req.then = (onFulfilled, onRejected) =>
+        (error ? Promise.reject(error) : Promise.resolve({ body })).then(onFulfilled, onRejected);
+    req.catch = (onRejected) => req.then(undefined, onRejected);
+    return req;
+}
+
+describe("profile/actions (unmocked request layer)", () => {
+    beforeEach(() => {
+        request.post.mockReset();
+        window.ENABLE_TWO_FACTOR_ENDPOINT = "https://idp.test/api/v2/users/me/2fa/enable";
+        window.REGENERATE_RECOVERY_CODES_ENDPOINT = "https://idp.test/api/v2/users/me/2fa/recovery-codes";
+        window.CSFR_TOKEN = "test-csrf-token";
+    });
+
+    it("enableTwoFactor resolves the recovery codes through postRawRequestFull", async () => {
+        const req = makeChainableRequest({ body: { recovery_codes: ["ABCD-1234"] } });
+        request.post.mockReturnValue(req);
+
+        const { response } = await enableTwoFactor("email_otp");
+
+        expect(request.post).toHaveBeenCalledWith(window.ENABLE_TWO_FACTOR_ENDPOINT);
+        expect(req.send).toHaveBeenCalledWith({ method: "email_otp" });
+        expect(req.set).toHaveBeenCalledWith({ "X-CSRF-TOKEN": "test-csrf-token" });
+        expect(response.recovery_codes).toEqual(["ABCD-1234"]);
+    });
+
+    it("regenerateRecoveryCodes sends current_password only in the request body, never in the URL", async () => {
+        const req = makeChainableRequest({ body: { recovery_codes: ["WXYZ-5678"] } });
+        request.post.mockReturnValue(req);
+
+        const { response } = await regenerateRecoveryCodes("super-secret-password");
+
+        const calledUrl = request.post.mock.calls[0][0];
+        expect(calledUrl).toBe(window.REGENERATE_RECOVERY_CODES_ENDPOINT);
+        expect(calledUrl).not.toContain("super-secret-password");
+        expect(req.send).toHaveBeenCalledWith({ current_password: "super-secret-password" });
+        expect(response.recovery_codes).toEqual(["WXYZ-5678"]);
+    });
+});