Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Numberverify verify Test definition #124

Merged
merged 28 commits into from
Aug 27, 2024
Merged

Numberverify verify Test definition #124

Changes from 8 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
a03682d
initial commit
AxelNennker Jul 24, 2024
849e20d
use Scenario Outline for common tests
AxelNennker Jul 26, 2024
6e52ca9
new case access token expired
AxelNennker Jul 26, 2024
bcc87e9
rename NumberVerification.feature to NumberVerification_verify.feature
AxelNennker Jul 26, 2024
cfe09c0
add verify
AxelNennker Jul 26, 2024
564359d
remove x-correlator format test
AxelNennker Jul 26, 2024
9fe46ce
remove CIBA
AxelNennker Jul 26, 2024
79181e6
some lines about testing environment and assets
AxelNennker Jul 26, 2024
da3c3bb
single cause of failure
AxelNennker Jul 26, 2024
d012be8
better text if phone number from access token and from parameter do n…
AxelNennker Jul 26, 2024
82f02e9
And the request body does not have the field phoneNumber
AxelNennker Jul 26, 2024
ada4a18
NumberVerificationMatchResponse
AxelNennker Jul 26, 2024
2c488bf
remove over a mobile connection
AxelNennker Jul 26, 2024
fc899f8
remove mobile connection
AxelNennker Jul 26, 2024
e0e2c58
initial commit of "share" test definitions
AxelNennker Jul 26, 2024
fcea400
add hashed numbers test definitions
AxelNennker Jul 26, 2024
50949f4
re-added "And the connection the request is sent over originates from…
AxelNennker Jul 27, 2024
796b9c6
Update NumberVerification_device_phone_number_share.feature
AxelNennker Aug 2, 2024
414a57f
Update NumberVerification_verify.feature
AxelNennker Aug 2, 2024
6d6d58f
added test NumberVerification_verify203_both_phone_number_and_hashed_…
AxelNennker Aug 8, 2024
f8513aa
missing scope error is 403
AxelNennker Aug 21, 2024
4c775ca
missing scope is error code 403
AxelNennker Aug 21, 2024
81072eb
Update code/Test_Definitions/NumberVerification_verify.feature
AxelNennker Aug 21, 2024
f3fbd39
added NumberVerification_phone_number_share203_no_phonenumber_associa…
AxelNennker Aug 22, 2024
fa334b2
addedd NumberVerification_phone_number_verify204_no_phonenumber_assoc…
AxelNennker Aug 22, 2024
393d7da
added @NumberVerification_phone_number_verify205_must_have_used_netwo…
AxelNennker Aug 24, 2024
a61b1c4
fix indentation
AxelNennker Aug 24, 2024
5b35bde
added @NumberVerification_phone_number_share205_must_have_used_networ…
AxelNennker Aug 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
132 changes: 132 additions & 0 deletions code/Test_Definitions/NumberVerification_verify.feature
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test included for veryfy operation:

  1. ✅ @NumberVerification_verify0_phoneNumber_does_not_match_schema --> Invalid phone number
  2. ✅ @NumberVerification_verify100_match_true -->Token associated with phoneNumber1 matches phoneNumber1 sent in the body
  3. ✅ @NumberVerification_verify300_match_hashed_true --> Token associated with phoneNumber1 matches hashedPhoneNumber1 sent in the body
  4. ✅ @NumberVerification_verify101_match_false --> Token associated with phoneNumber2 doesn't match phoneNumber1 in the body
  5. ⚠️ @NumberVerification_verify301_match_ hashed _false --> Token associated with phoneNumber2 doesn't match hashedPhoneNumber1 in the body
  6. ⚠️ @NumberVerification_verify200_missing_phone_number_in_request --> neither phoneNumber nor hashedPhoneNumber
  7. ⚠️ @NumberVerification_verify201_missing_scope
  8. ⚠️ @NumberVerification_verify202_expired_access_token
  9. ✅ @NumberVerification_verify203_both_phone_number_and_hashed_in_request

Pending test to be included:

  1. ❌ The access token is valid but it has been generated with an auth method other than network auth (user/password, otp-sms, etc) --> error NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK
  2. ❌ The phone number cannot be deducted from access token --> error INVALID_TOKEN_CONTEXT

cc: @bigludo7 @AxelNennker

Original file line number Diff line number Diff line change
@@ -0,0 +1,132 @@


@NumberVerification_verify
Feature: Camara Number Verification API verify

# Input to be provided by the implementation to the tests
# References to OAS spec schemas refer to schemas specified in
# https://raw.githubusercontent.com/camaraproject/NumberVerification/main/code/API_definitions/number_verification.yaml
#
# Implementation indications:
# * api_root: API root of the server URL
#
# Testing assets:
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2



Background: Common Number Verification verify setup
Given the resource "/number-verification/v0" as base url
And the header "Content-Type" is set to "application/json"
And the header "Authorization" is set to a valid access token
And the header "x-correlator" is set to a UUID value
And the request body is compliant with the schema NumberVerificationRequestBody
And the response body is compliant with the schema NumberVerificationMatchResponse
And the header "x-correlator" is set to a UUID value
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 is compliant with the schema DevicePhoneNumber
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2 is compliant with the schema DevicePhoneNumber
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 is different to NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2

@NumberVerification_verify0_phoneNumber_does_not_match_schema
Scenario Outline: phoneNumber value does not comply with the schema
Given the request body property "$.phoneNumber" is set to: <phone_number_value>
When the HTTP "POST" request is sent
Then the response status code is 400
And the response property "$.status" is 400
And the response property "$.code" is "INVALID_ARGUMENT"
And the response property "$.message" contains a user friendly text

Examples:
| phone_number_value |
| string_value |
| 1234567890 |
| +12334foo22222 |
| +00012230304913849 |
| 123 |
| ++49565456787 |


@NumberVerification_verify100_match_true
Scenario: verify phone number NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1, network connection and access token matches NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
Given they use the base url over a mobile connection
Copy link
Collaborator

@trehman-gsma trehman-gsma Jul 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's just the first step of the Authorization Code flow (/auth) that requires a mobile connection, right?

The /token request and the /verify request can be executed from a backend? Flow diagram here.

If so, what do you think about moving the mobile connection requirement to the Background section?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think about that. Usually, it is a security issue if several requests are not bound together and/or come from different sources.
https://www.rfc-editor.org/rfc/rfc7636
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-sender-constrained-access-t
https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html

I wanted to add sender-constrained tokens to Camara, but I was told that operators have never heard of that and too few implemented it, so ICM should not demand it.
Same with DPoP.
The slowest boot determines the speed of the convoy.

Thanks for the comment.

And the resource is "/verify"
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the mobile connection is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/SendCodeResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is true


@NumberVerification_verify101_match_false
Scenario: verify phone number NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1, network connection and access token matches NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
Given they use the base url over a mobile connection
And the resource is "/verify"
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the mobile connection is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/SendCodeResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is false

@NumberVerification_verify200_missing_phone_number_in_request
Scenario: verify phone number but no phonenumber in request
Given they use the base url over a mobile connection
And the resource is "/verify"
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the mobile connection is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has NO the field phoneNumber
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/SendCodeResponse"
Then the response property "$.status" is 400
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And the response property "$.code" is "INVALID_ARGUMENT"
And the response property "$.message" contains a user friendly text

@NumberVerification_verify201_missing_scope
Scenario: verify phone number with valid access token but scope number-verification:verify is missing
Given they use the base url over a mobile connection
And the resource is "/verify"
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow
And none of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the mobile connection is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has NO the field phoneNumber
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/SendCodeResponse"
Then the response property "$.status" is 401
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And the response property "$.code" is "UNAUTHENTICATED"
And the response property "$.message" is "Request not authenticated due to missing, invalid, or expired credentials."

@NumberVerification_verify202_expired_access_token
Scenario: verify phone number with expired access token
Given they use the base url over a mobile connection
And the resource is "/verify"
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow or CIBA
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the access token has expired
And the mobile connection is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has NO the field phoneNumber
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/SendCodeResponse"
Then the response property "$.status" is 401
And the response property "$.code" is "AUTHENTICATION_REQUIRED"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or UNAUTHENTICATED, still don't know which one should apply in this case

And the response property "$.message" is "New authentication is required."
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved