From 3cca8efa1b8a32424e1815fb3612365f613f70be Mon Sep 17 00:00:00 2001 From: kameshsr <47484458+kameshsr@users.noreply.github.com> Date: Mon, 12 Feb 2024 18:56:24 +0530 Subject: [PATCH] MOSIP-31314 OTP validation security fix (#1197) Signed-off-by: kameshsr --- .../service/integration/OTPManager.java | 27 ++-- .../service/integration/OTPManagerTest.java | 144 +++++++++--------- 2 files changed, 87 insertions(+), 84 deletions(-) diff --git a/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/integration/OTPManager.java b/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/integration/OTPManager.java index 9ab2ad23395..e5e2b4787ad 100644 --- a/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/integration/OTPManager.java +++ b/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/integration/OTPManager.java @@ -39,7 +39,7 @@ /** * OTPManager handling with OTP-Generation and OTP-Validation. - * + * * @author Rakesh Roshan * @author Dinesh Karuppiah.T * @author Manoj SP @@ -76,11 +76,11 @@ public class OTPManager { /** The notification service. */ @Autowired private NotificationService notificationService; - + /** The number of validation attempts allowed. */ @Value("${mosip.ida.otp.validation.attempt.count.threshold:5}") private int numberOfValidationAttemptsAllowed; - + /** The otp frozen time minutes. */ @Value("${mosip.ida.otp.frozen.duration.minutes:30}") private int otpFrozenTimeMinutes; @@ -103,7 +103,7 @@ public class OTPManager { */ public boolean sendOtp(OtpRequestDTO otpRequestDTO, String idvid, String idvidType, Map valueMap, List templateLanguages) throws IdAuthenticationBusinessException { - + String refIdHash = securityManager.hash(idvid); Optional otpEntityOpt = otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(refIdHash, QUERIED_STATUS_CODES); @@ -111,13 +111,13 @@ public boolean sendOtp(OtpRequestDTO otpRequestDTO, String idvid, String idvidTy OtpTransaction otpEntity = otpEntityOpt.get(); requireOtpNotFrozen(otpEntity, false); } - + String otp = generateOTP(otpRequestDTO.getIndividualId()); LocalDateTime otpGenerationTime = DateUtils.getUTCCurrentDateTime(); String otpHash = IdAuthSecurityManager.digestAsPlainText((otpRequestDTO.getIndividualId() + EnvUtil.getKeySplitter() + otpRequestDTO.getTransactionID() + EnvUtil.getKeySplitter() + otp).getBytes()); - + OtpTransaction otpTxn; if (otpEntityOpt.isPresent() && (otpTxn = otpEntityOpt.get()).getStatusCode().equals(IdAuthCommonConstants.ACTIVE_STATUS)) { @@ -141,7 +141,7 @@ public boolean sendOtp(OtpRequestDTO otpRequestDTO, String idvid, String idvidTy txn.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpRepo.save(txn); } - + String notificationProperty = null; notificationProperty = otpRequestDTO .getOtpChannel().stream().map(channel -> NotificationType.getNotificationTypeForChannel(channel) @@ -219,18 +219,18 @@ public boolean validateOtp(String pinValue, String otpKey, String individualId) if (otpEntityOpt.isEmpty()) { throw new IdAuthenticationBusinessException(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED); } - + OtpTransaction otpEntity = otpEntityOpt.get(); requireOtpNotFrozen(otpEntity, true); - + if(otpEntity.getStatusCode().equals(IdAuthCommonConstants.UNFROZEN)) { throw new IdAuthenticationBusinessException(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED); } - + // At this point it should be active status alone. // Increment the validation attempt count. int attemptCount = otpEntity.getValidationRetryCount() == null ? 1 : otpEntity.getValidationRetryCount() + 1; - + String otpHash = getOtpHash(pinValue, otpKey); if (otpEntity.getOtpHash().equals(otpHash)) { otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime()); @@ -247,6 +247,9 @@ public boolean validateOtp(String pinValue, String otpKey, String individualId) otpEntity.setValidationRetryCount(attemptCount); if (attemptCount >= numberOfValidationAttemptsAllowed) { otpEntity.setStatusCode(IdAuthCommonConstants.FROZEN); + otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime()); + otpRepo.save(otpEntity); + throw createOTPFrozenException(); } otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime()); otpRepo.save(otpEntity); @@ -294,5 +297,5 @@ private String getOtpHash(String pinValue, String otpKey) { return IdAuthSecurityManager.digestAsPlainText( (otpKey + EnvUtil.getKeySplitter() + pinValue).getBytes()); } - + } diff --git a/authentication/authentication-common/src/test/java/io/mosip/authentication/common/service/integration/OTPManagerTest.java b/authentication/authentication-common/src/test/java/io/mosip/authentication/common/service/integration/OTPManagerTest.java index 15cde441316..b569ba19928 100644 --- a/authentication/authentication-common/src/test/java/io/mosip/authentication/common/service/integration/OTPManagerTest.java +++ b/authentication/authentication-common/src/test/java/io/mosip/authentication/common/service/integration/OTPManagerTest.java @@ -148,7 +148,7 @@ public void sendOtpTest() throws RestServiceException, IdAuthenticationBusinessE fail(); } } - + @Test public void sendOtpTest_frozen_within30mins() throws RestServiceException, IdAuthenticationBusinessException { OtpGeneratorRequestDto otpGeneratorRequestDto = getOtpGeneratorRequestDto(); @@ -176,7 +176,7 @@ public void sendOtpTest_frozen_within30mins() throws RestServiceException, IdAut assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void sendOtpTest_frozen_In31mins() throws RestServiceException, IdAuthenticationBusinessException { OtpGeneratorRequestDto otpGeneratorRequestDto = getOtpGeneratorRequestDto(); @@ -208,7 +208,7 @@ public void sendOtpTest_frozen_In31mins() throws RestServiceException, IdAuthent fail(); } } - + @Test public void sendOtpTest_USED_entry() throws RestServiceException, IdAuthenticationBusinessException { OtpGeneratorRequestDto otpGeneratorRequestDto = getOtpGeneratorRequestDto(); @@ -240,7 +240,7 @@ public void sendOtpTest_USED_entry() throws RestServiceException, IdAuthenticati fail(); } } - + @Test public void sendOtpTest_frozen_within25mins() throws RestServiceException, IdAuthenticationBusinessException { OtpGeneratorRequestDto otpGeneratorRequestDto = getOtpGeneratorRequestDto(); @@ -307,7 +307,7 @@ public void sendOtpTest_existingEntry() throws RestServiceException, IdAuthentic boolean sendOtpResponse = otpManager.sendOtp(otpRequestDTO, "426789089018", "UIN", valueMap, templateLanguages); assertEquals(sendOtpResponse, true); } - + @Test public void sendOtpTest_blockedStatus() throws RestServiceException, IdAuthenticationBusinessException { OtpGeneratorRequestDto otpGeneratorRequestDto = getOtpGeneratorRequestDto(); @@ -542,9 +542,9 @@ public void TestOtpAuthFailure() OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + boolean expactedOTP = otpManager.validateOtp("Test123", "123456", "426789089018"); assertFalse(expactedOTP); } @@ -736,7 +736,7 @@ public void TestResponseBodyisEmpty() throws RestServiceException, IdAuthenticat valueMap.put("nameSec", "Name in SecondaryLang"); otpManager.sendOtp(otpRequestDTO, "123456", "UIN", valueMap, templateLanguages); } - + @Test public void TestInvalidAttemptWith_noEntity() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -745,14 +745,14 @@ public void TestInvalidAttemptWith_noEntity() .thenReturn(restRequestDTO); Mockito.when(securityManager.hash(Mockito.anyString())).thenReturn("hash"); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { assertEquals(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED.getErrorCode(), ex.getErrorCode()); } } - + @Test public void TestInvalidAttemptWith_UsedEntity() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -764,16 +764,16 @@ public void TestInvalidAttemptWith_UsedEntity() OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setStatusCode(IdAuthCommonConstants.USED_STATUS); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { assertEquals(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED.getErrorCode(), ex.getErrorCode()); } } - + @Test public void TestInvalidAttemptWith_nullUpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -785,9 +785,9 @@ public void TestInvalidAttemptWith_nullUpdateCount() OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); assertFalse(result); @@ -798,7 +798,7 @@ public void TestInvalidAttemptWith_nullUpdateCount() fail(); } } - + @Test public void TestInvalidAttemptWith_1UpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -811,9 +811,9 @@ public void TestInvalidAttemptWith_1UpdateCount() otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setValidationRetryCount(1); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); assertFalse(result); @@ -824,7 +824,7 @@ public void TestInvalidAttemptWith_1UpdateCount() fail(); } } - + @Test public void TestInvalidAttemptWith_4UpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -837,20 +837,20 @@ public void TestInvalidAttemptWith_4UpdateCount() otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setValidationRetryCount(4); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { - boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); - assertFalse(result); + otpManager.validateOtp("Test123", "123456", "426789089018"); + } catch (IdAuthenticationBusinessException ex) { assertEquals((long)5, (long)otpEntity.getValidationRetryCount()); assertEquals(IdAuthCommonConstants.FROZEN, otpEntity.getStatusCode()); verify(otpRepo, times(1)).save(otpEntity); - } catch (IdAuthenticationBusinessException ex) { - fail(); + assertEquals(IdAuthenticationErrorConstants.OTP_FROZEN.getErrorCode(), ex.getErrorCode()); + assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestInvalidAttemptWith_FrozenStatus() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -864,9 +864,9 @@ public void TestInvalidAttemptWith_FrozenStatus() otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(25, ChronoUnit.MINUTES)); otpEntity.setValidationRetryCount(5); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -878,7 +878,7 @@ public void TestInvalidAttemptWith_FrozenStatus() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestInvalidAttemptWith_FrozenStatusWithin25Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -892,9 +892,9 @@ public void TestInvalidAttemptWith_FrozenStatusWithin25Mins() otpEntity.setValidationRetryCount(5); otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(25, ChronoUnit.MINUTES)); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -906,7 +906,7 @@ public void TestInvalidAttemptWith_FrozenStatusWithin25Mins() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestInvalidAttemptWith_FrozenStatusWithin29Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -920,9 +920,9 @@ public void TestInvalidAttemptWith_FrozenStatusWithin29Mins() otpEntity.setValidationRetryCount(5); otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(29, ChronoUnit.MINUTES)); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -934,7 +934,7 @@ public void TestInvalidAttemptWith_FrozenStatusWithin29Mins() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestInvalidAttemptWith_FrozenStatusWithin31Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -948,9 +948,9 @@ public void TestInvalidAttemptWith_FrozenStatusWithin31Mins() otpEntity.setValidationRetryCount(5); otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(31, ChronoUnit.MINUTES)); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { @@ -960,8 +960,8 @@ public void TestInvalidAttemptWith_FrozenStatusWithin31Mins() assertEquals(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED.getErrorCode(), ex.getErrorCode()); } } - - + + @Test public void TestValidAttemptWith_nullUpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -974,9 +974,9 @@ public void TestValidAttemptWith_nullUpdateCount() otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); assertTrue(result); @@ -986,7 +986,7 @@ public void TestValidAttemptWith_nullUpdateCount() fail(); } } - + @Test public void TestValidAttemptWith_1UpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1000,9 +1000,9 @@ public void TestValidAttemptWith_1UpdateCount() otpEntity.setValidationRetryCount(1); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); assertTrue(result); @@ -1012,7 +1012,7 @@ public void TestValidAttemptWith_1UpdateCount() fail(); } } - + @Test public void TestValidAttemptWith_4UpdateCount() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1026,9 +1026,9 @@ public void TestValidAttemptWith_4UpdateCount() otpEntity.setValidationRetryCount(4); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { boolean result = otpManager.validateOtp("Test123", "123456", "426789089018"); assertTrue(result); @@ -1038,7 +1038,7 @@ public void TestValidAttemptWith_4UpdateCount() fail(); } } - + @Test public void TestValidAttemptWith_FrozenStatus() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1053,9 +1053,9 @@ public void TestValidAttemptWith_FrozenStatus() otpEntity.setValidationRetryCount(5); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -1067,7 +1067,7 @@ public void TestValidAttemptWith_FrozenStatus() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestValidAttemptWith_FrozenStatusWithin25Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1082,9 +1082,9 @@ public void TestValidAttemptWith_FrozenStatusWithin25Mins() otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(25, ChronoUnit.MINUTES)); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -1096,7 +1096,7 @@ public void TestValidAttemptWith_FrozenStatusWithin25Mins() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestValidAttemptWith_FrozenStatusWithin29Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1111,9 +1111,9 @@ public void TestValidAttemptWith_FrozenStatusWithin29Mins() otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(29, ChronoUnit.MINUTES)); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); fail(); @@ -1125,7 +1125,7 @@ public void TestValidAttemptWith_FrozenStatusWithin29Mins() assertEquals(FROZEN_ERROR_MESSAGE, ex.getErrorText()); } } - + @Test public void TestValidAttemptWith_FrozenStatusWithin31Mins() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1140,9 +1140,9 @@ public void TestValidAttemptWith_FrozenStatusWithin31Mins() otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(31, ChronoUnit.MINUTES)); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().plus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { @@ -1152,7 +1152,7 @@ public void TestValidAttemptWith_FrozenStatusWithin31Mins() assertEquals(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED.getErrorCode(), ex.getErrorCode()); } } - + @Test public void TestValidAttemptWith_FrozenStatusWithin31Mins_expiredOtp() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1167,9 +1167,9 @@ public void TestValidAttemptWith_FrozenStatusWithin31Mins_expiredOtp() otpEntity.setUpdDTimes(DateUtils.getUTCCurrentDateTime().minus(31, ChronoUnit.MINUTES)); otpEntity.setOtpHash("313233343536234B45595F53504C49545445522354657374313233"); otpEntity.setExpiryDtimes(DateUtils.getUTCCurrentDateTime().minus(1, ChronoUnit.MINUTES)); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { @@ -1179,7 +1179,7 @@ public void TestValidAttemptWith_FrozenStatusWithin31Mins_expiredOtp() assertEquals(IdAuthenticationErrorConstants.OTP_REQUEST_REQUIRED.getErrorCode(), ex.getErrorCode()); } } - + @Test public void TestThrowOtpException_UINLocked() throws RestServiceException, IdAuthUncheckedException, IdAuthenticationBusinessException { @@ -1195,14 +1195,14 @@ public void TestThrowOtpException_UINLocked() Mockito.when(restHelper.requestSync(Mockito.any())).thenThrow(new RestServiceException( IdRepoErrorConstants.CLIENT_ERROR, responseMap.toString(), (Object) responseMap)); - + Mockito.when(securityManager.hash(Mockito.anyString())).thenReturn("hash"); OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setOtpHash("otphash"); otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { @@ -1223,14 +1223,14 @@ public void TestThrowOtpException_OtpExpired() throws RestServiceException, IdAu responseMap.put("response", valueMap); Mockito.when(restHelper.requestSync(Mockito.any())).thenThrow(new RestServiceException( IdRepoErrorConstants.CLIENT_ERROR, responseMap.toString(), (Object) responseMap)); - + Mockito.when(securityManager.hash(Mockito.anyString())).thenReturn("hash"); OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); - + try { otpManager.validateOtp("Test123", "123456", "426789089018"); } catch (IdAuthenticationBusinessException ex) { @@ -1256,7 +1256,7 @@ public void TestThrowOtpException_ValidationUnsuccessful() OtpTransaction otpEntity = new OtpTransaction(); otpEntity.setStatusCode(IdAuthCommonConstants.ACTIVE_STATUS); otpEntity.setOtpHash("otphash"); - + Mockito.when(otpRepo.findFirstByRefIdAndStatusCodeInAndGeneratedDtimesNotNullOrderByGeneratedDtimesDesc(Mockito.anyString(), Mockito.anyList())).thenReturn(Optional.of(otpEntity )); try { otpManager.validateOtp("Test123", "123456", "426789089018"); @@ -1265,7 +1265,7 @@ public void TestThrowOtpException_ValidationUnsuccessful() assertEquals(IdAuthenticationErrorConstants.INVALID_OTP.getErrorMessage(), ex.getErrorText()); } } - + @Test public void TestThrowOtpException_OtpPresent_Expired() throws RestServiceException, IdAuthenticationBusinessException { @@ -1292,7 +1292,7 @@ public void TestThrowOtpException_OtpPresent_Expired() assertEquals(IdAuthenticationErrorConstants.EXPIRED_OTP.getErrorMessage(), ex.getErrorText()); } } - + @Test public void TestThrowOtpException_OtpPresent_NotExpired_Valid() throws RestServiceException, IdAuthenticationBusinessException {