test(e2e): cover the TOTP modal flow through ddpOverREST

Merged
GG
6mo ago
+93-0

Summary

Stacked on top of #40430 — adds a regression test for the ddpOverREST catch handler that PR fixes.

The test mocks /api/v1/method.call/<name> instead of enabling real TOTP on a user. process.env.TEST_MODE short-circuits 2FA in CI except for requireSecondFactor: true, and the only method using that flag (saveUserProfileWithTwoFactor) is not registered as a Meteor method — only the typed REST endpoint exposes it. Replaying the exact mountResult({ id, error }) envelope the server produces hits the catch we changed without depending on TOTP being enforceable end-to-end.

What it asserts:

  • Meteor.callAsync against a method whose REST response is a 400 with a DDP result frame carrying error.error === 'totp-required' opens the Enter TOTP password modal.
  • After the user submits a code, the retry includes { twoFactorCode, twoFactorMethod: 'totp' } and the call resolves with the result the mock returns.
  • The mocked endpoint is hit exactly twice (challenge + retry).

Verified locally: with the fix the test passes in ~3.5s; reverting the catch handler to the synthetic-error rebuild times out at the modal-visible expect.

Test plan

Task: ARCH-2130

Summary by CodeRabbit

  • Tests
    • Added end-to-end coverage for the TOTP two-factor flow: verifies the app preserves server TOTP-required responses, displays the “Enter TOTP password” dialog, accepts a verification code, retries the call, and hides the dialog on success. Confirms the retry succeeds and that the REST interaction occurs the expected number of times.