Taavi Väänänen 0dad2c7031 Fix disabling TOTP keys with scratch tokens ... The current implementation of OATHUserRepository::persist() causes every key to get a new ID when it's saved. This, combined with ::removeKey() which compares keys by ID, means that using recovery codes to disable TOTP is broken since TOTPKey calls persist() to mark the code as saved just before the key is deleted. In this patch I've chosen to add a new ::updateKey() method instead of fixing ::persist(). This is more in line with the other new APIs in OATHUserRepository (namely ::createKey() and ::removeKey()), and is something I've been planning to do eventually - this bug just made that a bit more urgent. ::persist() should be dropped once WebAuthn has been updated too. Tests are also updated - OATHUserRepositoryTest now updates the key before deleting it and there's a new TOTPDisableFormTest to test the entire disabling process. Bug: T363548 Change-Id: I86ddc8e5bfc9cf74c587ffdff523f559c5a3c08c		2024-04-26 16:29:25 +03:00
..
HTMLForm	Fix disabling TOTP keys with scratch tokens	2024-04-26 16:29:25 +03:00
OATHUserRepositoryTest.php	Fix disabling TOTP keys with scratch tokens	2024-04-26 16:29:25 +03:00