update location factor guards based on new proto (#1214)

* update location factor guards based on new proto

* Update mfa.test.ts

* review fixes

* Update TauriEventProvider.tsx

Author: filipslezaklab

new-ui/src/pages/full/ConfigureMfaPage/hooks/noVerificationMethodError.ts

@@ -0,0 +1,7 @@
+/** The session opened, but nothing it offers to verify with can run on this instance. */
+export class NoVerificationMethodError extends Error {
+  constructor() {
+    super('No MFA method available to verify the configuration session');
+    this.name = 'NoVerificationMethodError';
+  }
+}

new-ui/src/pages/full/ConfigureMfaPage/hooks/reportMfaConfigStartError.ts

@@ -6,10 +6,17 @@ import {
   isMfaConfigUnsupported,
 } from '../../../../shared/rust-api/mfaError';
 import { showEdgeComsError } from '../components/EdgeComsError/useEdgeComsErrorStore';
+import { NoVerificationMethodError } from './noVerificationMethodError';
 
 /** How a failed `startMfaConfiguration` is reported, shared by every entry point. */
 export const reportMfaConfigStartError = (err: unknown): void => {
   void logError(`MFA configuration start failed: ${err}`);
+  if (err instanceof NoVerificationMethodError) {
+    Snackbar.error(
+      'There is no method available to verify your identity on this Defguard instance. Contact your administrator.',
+    );
+    return;
+  }
   if (isMfaConfigUnsupported(err)) {
     Snackbar.error(
       'This Defguard instance does not support configuring MFA from the client.',

new-ui/src/pages/full/ConfigureMfaPage/hooks/useConfigureMfaStore.test.ts

@@ -5,7 +5,9 @@ import {
   type InstanceInfo,
   MfaMethod,
 } from '../../../../shared/rust-api/types';
+import { isMfaMethodAvailable } from '../../../../shared/utils/mfa';
 import { ConfigureMfaStep } from '../types';
+import { NoVerificationMethodError } from './noVerificationMethodError';
 import {
   applyAuthorization,
   discardMfaConfiguration,
@@ -32,6 +34,8 @@ const instance: InstanceInfo = {
   disable_tunnels: false,
   openid_display_name: null,
   openid_provider_kind: 'custom',
+  smtp_configured: null,
+  openid_available: null,
   mfa_configured_methods: [],
   mfa_capabilities: {
     setup_methods: [MfaMethod.Totp, MfaMethod.Fido2],
@@ -153,4 +157,69 @@ describe('startMfaConfiguration', () => {
     expect(state.configuredMethods).toContain(MfaMethod.Totp);
     expect(state.initialSelection).toEqual([]);
   });
+
+  it('trusts the email fallback over a snapshot that still reports no SMTP', async () => {
+    Object.assign(api, {
+      mfaConfigStart: vi.fn().mockResolvedValue({
+        ...startResult,
+        available_methods: [],
+        configured_methods: [],
+        email_fallback: true,
+      }),
+    });
+
+    await startMfaConfiguration({ ...instance, smtp_configured: false });
+
+    expect(useConfigureMfaStore.getState().verificationMethods).toEqual([
+      MfaMethod.Email,
+    ]);
+  });
+
+  it('reads email as available after the fallback, without offering it', async () => {
+    Object.assign(api, {
+      mfaConfigStart: vi.fn().mockResolvedValue({
+        ...startResult,
+        available_methods: [],
+        configured_methods: [],
+        email_fallback: true,
+      }),
+    });
+
+    await startMfaConfiguration(
+      {
+        ...instance,
+        smtp_configured: false,
+        mfa_capabilities: {
+          setup_methods: [MfaMethod.Totp, MfaMethod.Email],
+          authorize_methods: [MfaMethod.Totp],
+        },
+      },
+      { preselectedMethods: [MfaMethod.Email] },
+    );
+
+    const state = useConfigureMfaStore.getState();
+    expect(isMfaMethodAvailable(MfaMethod.Email, state.instance)).toBe(true);
+    expect(state.configuredMethods).toContain(MfaMethod.Email);
+    expect(state.initialSelection).toEqual([]);
+  });
+
+  it('refuses a session nothing can verify', async () => {
+    useConfigureMfaStore.getState().reset();
+    const mfaConfigCancel = vi.fn().mockResolvedValue(undefined);
+    Object.assign(api, {
+      mfaConfigCancel,
+      mfaConfigStart: vi.fn().mockResolvedValue({
+        ...startResult,
+        available_methods: [],
+        configured_methods: [],
+        email_fallback: false,
+      }),
+    });
+
+    await expect(startMfaConfiguration(instance)).rejects.toBeInstanceOf(
+      NoVerificationMethodError,
+    );
+    expect(mfaConfigCancel).toHaveBeenCalledWith('session-2');
+    expect(useConfigureMfaStore.getState().sessionId).toBeNull();
+  });
 });

new-ui/src/pages/full/ConfigureMfaPage/hooks/useConfigureMfaStore.tsx

@@ -26,8 +26,9 @@ import {
   isMfaFactorOfferable,
   isMfaSetupStep,
   mfaFactorStep,
-  verificationMethodsOf,
+  sessionVerificationMethodsOf,
 } from '../utils';
+import { NoVerificationMethodError } from './noVerificationMethodError';
 
 type StoreValues = {
   activeStep: ConfigureMfaStepValue;
@@ -151,11 +152,8 @@ export const useConfigureMfaStore = create<Store>()(
     (set, get) => ({
       ...defaults,
       start: (instance, response, origin) => {
-        // The fallback mails a code to the address on file, registering email along the way.
-        const sessionMethods = response.email_fallback
-          ? [MfaMethod.Email]
-          : response.available_methods;
-        // a factor the instance cannot authorize with is still configured
+        // The fallback registers email as it mails the code. A factor the instance cannot
+        // authorize with is still configured.
         const sessionConfiguredMethods = response.email_fallback
           ? [MfaMethod.Email]
           : response.configured_methods;
@@ -170,10 +168,13 @@ export const useConfigureMfaStore = create<Store>()(
         ];
         set({
           ...defaults,
-          instance,
+          // The fallback just mailed a code, so SMTP works whatever the snapshot says.
+          instance: response.email_fallback
+            ? { ...instance, smtp_configured: true }
+            : instance,
           sessionId: response.session_id,
           configuredMethods,
-          verificationMethods: verificationMethodsOf(sessionMethods),
+          verificationMethods: sessionVerificationMethodsOf(response),
           emailFallback: response.email_fallback,
           deadline: dayjs.unix(response.deadline_timestamp).toISOString(),
           ...origin,
@@ -287,6 +288,11 @@ export const startMfaConfiguration = async (
   await pendingEnd;
   const response = await api.mfaConfigStart(instance.id);
   dismissEdgeComsError();
+  if (sessionVerificationMethodsOf(response).length === 0) {
+    pendingEnd = endSession(response.session_id);
+    await pendingEnd;
+    throw new NoVerificationMethodError();
+  }
   useConfigureMfaStore.getState().start(instance, response, { source, location });
   // Only pre-ticks, the user still confirms in the selection step.
   const { configuredMethods } = useConfigureMfaStore.getState();

new-ui/src/pages/full/ConfigureMfaPage/utils.ts

@@ -1,4 +1,8 @@
-import { MfaMethod, type MfaMethodValue } from '../../../shared/rust-api/types';
+import {
+  type MfaConfigStartResult,
+  MfaMethod,
+  type MfaMethodValue,
+} from '../../../shared/rust-api/types';
 import {
   CLIENT_CONFIGURABLE_METHODS,
   type ClientConfigurableMethod,
@@ -62,3 +66,11 @@ export const verificationMethodsOf = (
   availableMethods: MfaMethodValue[],
 ): MfaVerificationMethod[] =>
   mfaVerificationMethods.filter((method) => availableMethods.includes(method));
+
+/** The fallback mails a code to the address on file, so email is the only way in. */
+export const sessionVerificationMethodsOf = (
+  response: Pick<MfaConfigStartResult, 'email_fallback' | 'available_methods'>,
+): MfaVerificationMethod[] =>
+  verificationMethodsOf(
+    response.email_fallback ? [MfaMethod.Email] : response.available_methods,
+  );

new-ui/src/pages/full/ConfigureMfaPage/verify/ConfigureMfaVerify.tsx

@@ -28,7 +28,7 @@ export const ConfigureMfaVerify = ({ onCancel, onSessionExpired }: Props) => {
     return <ConfigureSelectVerificationStep />;
   }
 
-  // for the type only, a session always offers a method or falls back to email
+  // for the type only, a session with nothing to verify with is refused at start
   const method: MfaVerificationMethod =
     verificationMethod ?? candidates[0] ?? MfaMethod.Email;
 

new-ui/src/pages/full/ConfigureMfaPage/verify/ConfigureSelectMethodsStep/ConfigureSelectMethodsStep.tsx

@@ -18,6 +18,7 @@ import {
   CLIENT_CONFIGURABLE_METHODS,
   isClientConfigurableMethod,
   isDesktopDrivableMethod,
+  isMfaMethodAvailable,
   mfaStepsOf as locationMfaSteps,
   mfaToText,
   setupMethodsOf,
@@ -63,16 +64,17 @@ export const ConfigureSelectMethodsStep = ({ onCancel }: Props) => {
     return configuredMethods.filter((method) => method !== MfaMethod.Email);
   }, [emailFallback, configuredMethods]);
 
-  /** A step the user is already past: it offers a factor the desktop can drive and the account
-   *  holds. Mirrors `usableMfaMethods`, on the session's fresher list of configured factors. */
+  /** A step the user is already past: it offers a factor the desktop can drive, the account
+   *  holds and the instance runs. Mirrors usableMfaMethods, on the session's fresher list. */
   const isStepSatisfied = useCallback(
     (step: MfaStep): boolean =>
       step.methods.some(
         (entry) =>
           isDesktopDrivableMethod(entry.method) &&
-          configuredMethods.includes(entry.method),
+          configuredMethods.includes(entry.method) &&
+          isMfaMethodAvailable(entry.method, instance),
       ),
-    [configuredMethods],
+    [configuredMethods, instance],
   );
 
   const groups = useMemo(() => {
@@ -99,10 +101,13 @@ export const ConfigureSelectMethodsStep = ({ onCancel }: Props) => {
       // A repeatable factor stays offerable once configured, keeping its badge and its pick.
       const disabled = !isMfaFactorOfferable(method, configuredMethods, setupMethods);
       const configured = accountConfigured.includes(method);
-      const satisfied = configuredMethods.includes(method);
+      const available = isMfaMethodAvailable(method, instance);
+      const satisfied = configuredMethods.includes(method) && available;
 
       let hint: string | null = null;
-      if (disabled && !configured) {
+      if (!available) {
+        hint = `${mfaToText(method, instance ?? undefined)} is not available on this Defguard instance.`;
+      } else if (disabled && !configured) {
         if (satisfied) {
           // Reached only via the email fallback, which registers the factor as it verifies.
           hint = `${mfaToText(method)} is required to continue.`;
@@ -125,7 +130,7 @@ export const ConfigureSelectMethodsStep = ({ onCancel }: Props) => {
         hint,
       };
     },
-    [accountConfigured, configuredMethods, setupMethods, selected],
+    [accountConfigured, configuredMethods, setupMethods, selected, instance],
   );
 
   const { mutate: cancel, isPending: isCancelling } = useMutation({

new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModal.tsx

@@ -4,8 +4,6 @@ import {
   MfaMethod,
   type MfaMethodValue,
 } from '../../../../../../shared/rust-api/types';
-import { isPresent } from '../../../../../../shared/utils/isPresent';
-import { resolveMfaStepPlan } from '../../../../../../shared/utils/mfa';
 import { type ConnectModalViewValue, mfaMethodToConnectModalView } from './types';
 
 interface StoreValues {
@@ -50,9 +48,7 @@ export const useConnectModal = create<Store>((set, get) => ({
     set(defaults);
   },
   open: (init) => {
-    const location = init?.location ?? null;
-    const stepPlan = isPresent(location) ? resolveMfaStepPlan(location) : [];
-    set({ ...defaults, ...init, stepPlan, visible: true });
+    set({ ...defaults, ...init, visible: true });
   },
   setMfaToken: (token) => {
     set({ mfaToken: token });

new-ui/src/pages/playground/components/PlaygroundTestMfaSettingsSection/PlaygroundTestMfaSettingsSection.tsx

@@ -59,6 +59,8 @@ const instance: MfaSettingsInstance = {
   },
   openid_display_name: null,
   openid_provider_kind: 'custom',
+  smtp_configured: null,
+  openid_available: null,
 };
 
 const Demo = ({

new-ui/src/shared/components/LocationCard/components/ConnectButton/ConnectButton.tsx

@@ -1,3 +1,6 @@
+import { TooltipContent } from '../../../../providers/tooltip/TooltipContent';
+import { TooltipProvider } from '../../../../providers/tooltip/TooltipContext';
+import { TooltipTrigger } from '../../../../providers/tooltip/TooltipTrigger';
 import { isPresent } from '../../../../utils/isPresent';
 import { Icon, type IconKindValue } from '../../../Icon';
 import './style.scss';
@@ -9,30 +12,47 @@ interface Props {
   disabled?: boolean;
   icon?: IconKindValue | null;
   text?: string | null;
+  tooltip?: string | null;
 }
 
 export const ConnectButton = ({
   active,
   onClick,
   icon,
   text,
+  tooltip,
   disabled = false,
 }: Props) => {
   const label = isPresent(text) ? text : active ? 'Disconnect' : 'Connect VPN';
 
-  return (
+  const button = (
+    // aria-disabled instead of disabled, a disabled button gets no hover to open the tooltip
     <button
       type="button"
       className={clsx('connect-button', {
         connected: active,
         disconnected: !active,
         icon: isPresent(icon),
+        disabled,
       })}
-      disabled={disabled}
-      onClick={onClick}
+      aria-disabled={disabled}
+      onClick={() => {
+        if (!disabled) onClick();
+      }}
     >
       {isPresent(icon) && <Icon icon={icon} size={20} />}
       <p>{label}</p>
     </button>
   );
+
+  if (!isPresent(tooltip)) return button;
+
+  return (
+    <TooltipProvider placement="top">
+      <TooltipTrigger>{button}</TooltipTrigger>
+      <TooltipContent>
+        <p>{tooltip}</p>
+      </TooltipContent>
+    </TooltipProvider>
+  );
 };