tests: add edge-case tests for TOTP, registry, and MFA negative flows

Author: anwarx4u

tests/ChannelRegistryEdgeTest.php

@@ -0,0 +1,32 @@
+<?php
+
+use CodingLibs\MFA\ChannelRegistry;
+use CodingLibs\MFA\Contracts\MfaChannel;
+use Illuminate\Contracts\Auth\Authenticatable;
+
+class RegistryDummy implements MfaChannel
+{
+	public function __construct(public string $name) {}
+	public function getName(): string { return $this->name; }
+	public function send(Authenticatable $user, string $code, array $options = []): void {}
+}
+
+it('returns null for missing channels', function () {
+	$registry = new ChannelRegistry();
+	expect($registry->get('unknown'))->toBeNull();
+});
+
+it('all returns lowercase keys and latest wins on duplicates', function () {
+	$registry = new ChannelRegistry();
+	$first = new RegistryDummy('Email');
+	$second = new RegistryDummy('EMAIL');
+
+	$registry->register($first);
+	$registry->register($second);
+
+	$all = $registry->all();
+	expect(array_keys($all))->toBe(['email']);
+	expect($registry->get('email'))->toBe($second);
+});
+
+

tests/Feature/MFANegativeTest.php

@@ -0,0 +1,36 @@
+<?php
+
+use CodingLibs\MFA\MFA;
+use Illuminate\Contracts\Auth\Authenticatable;
+
+class MFANegFakeUser implements Authenticatable
+{
+	public function __construct(public int|string $id) {}
+	public function getAuthIdentifierName() { return 'id'; }
+	public function getAuthIdentifier() { return $this->id; }
+	public function getAuthPassword() { return ''; }
+	public function getAuthPasswordName() { return 'password'; }
+	public function getRememberToken() { return null; }
+	public function setRememberToken($value): void {}
+	public function getRememberTokenName() { return 'remember_token'; }
+}
+
+it('verifyTotp returns false when method not set', function () {
+	$user = new MFANegFakeUser(9001);
+	$mfa = app(MFA::class);
+	expect($mfa->verifyTotp($user, '000000'))->toBeFalse();
+});
+
+it('issueChallenge returns null for unknown channel', function () {
+	$user = new MFANegFakeUser(9002);
+	$mfa = app(MFA::class);
+	expect($mfa->issueChallenge($user, 'unknown'))->toBeNull();
+});
+
+it('verifyChallenge returns false when no active challenge', function () {
+	$user = new MFANegFakeUser(9003);
+	$mfa = app(MFA::class);
+	expect($mfa->verifyChallenge($user, 'email', '123456'))->toBeFalse();
+});
+
+

tests/GoogleTotpEdgeTest.php

@@ -0,0 +1,58 @@
+<?php
+
+use CodingLibs\MFA\Totp\GoogleTotp;
+
+it('rejects invalid code formats', function () {
+	$secret = GoogleTotp::generateSecret();
+	// Non-numeric and wrong length
+	expect(GoogleTotp::verifyCode($secret, 'abcdef', 6, 30, 1))->toBeFalse();
+	expect(GoogleTotp::verifyCode($secret, '123', 6, 30, 1))->toBeFalse();
+	// Very long string
+	expect(GoogleTotp::verifyCode($secret, str_repeat('9', 20), 6, 30, 1))->toBeFalse();
+});
+
+it('supports 4 and 8 digit OTPs using exact slice', function () {
+	$secret = GoogleTotp::generateSecret();
+	$ref = new ReflectionClass(GoogleTotp::class);
+	$base32Decode = $ref->getMethod('base32Decode');
+	$base32Decode->setAccessible(true);
+	$hotp = $ref->getMethod('hotp');
+	$hotp->setAccessible(true);
+	$truncate = $ref->getMethod('truncateToDigits');
+	$truncate->setAccessible(true);
+
+	$period = 30;
+	$timeSlice = (int) floor(time() / $period);
+	$key = $base32Decode->invoke(null, $secret);
+
+	$hash = $hotp->invoke(null, $key, $timeSlice);
+	$code4 = $truncate->invoke(null, $hash, 4);
+	$code8 = $truncate->invoke(null, $hash, 8);
+
+	expect(GoogleTotp::verifyCode($secret, $code4, 4, $period, 0))->toBeTrue();
+	expect(GoogleTotp::verifyCode($secret, $code8, 8, $period, 0))->toBeTrue();
+});
+
+it('respects zero window (adjacent slice fails)', function () {
+	$secret = GoogleTotp::generateSecret();
+	$ref = new ReflectionClass(GoogleTotp::class);
+	$base32Decode = $ref->getMethod('base32Decode');
+	$base32Decode->setAccessible(true);
+	$hotp = $ref->getMethod('hotp');
+	$hotp->setAccessible(true);
+	$truncate = $ref->getMethod('truncateToDigits');
+	$truncate->setAccessible(true);
+
+	$period = 30;
+	$digits = 6;
+	$timeSlice = (int) floor(time() / $period);
+	$key = $base32Decode->invoke(null, $secret);
+
+	$prev = $truncate->invoke(null, $hotp->invoke(null, $key, $timeSlice - 1), $digits);
+	$curr = $truncate->invoke(null, $hotp->invoke(null, $key, $timeSlice), $digits);
+
+	expect(GoogleTotp::verifyCode($secret, $prev, $digits, $period, 0))->toBeFalse();
+	expect(GoogleTotp::verifyCode($secret, $curr, $digits, $period, 0))->toBeTrue();
+});
+
+