Taavi Väänänen 2832e97046 Fix disabling TOTP keys with scratch tokens ... The current implementation of OATHUserRepository::persist() causes every key to get a new ID when it's saved. This, combined with ::removeKey() which compares keys by ID, means that using recovery codes to disable TOTP is broken since TOTPKey calls persist() to mark the code as saved just before the key is deleted. In this patch I've chosen to add a new ::updateKey() method instead of fixing ::persist(). This is more in line with the other new APIs in OATHUserRepository (namely ::createKey() and ::removeKey()), and is something I've been planning to do eventually - this bug just made that a bit more urgent. ::persist() should be dropped once WebAuthn has been updated too. Tests are also updated - OATHUserRepositoryTest now updates the key before deleting it and there's a new TOTPDisableFormTest to test the entire disabling process. Bug: T363548 Change-Id: I86ddc8e5bfc9cf74c587ffdff523f559c5a3c08c (cherry picked from commit 0dad2c7031)		2024-04-26 18:11:56 +00:00
..
TOTPDisableFormTest.php	Fix disabling TOTP keys with scratch tokens	2024-04-26 18:11:56 +00:00