Add support for changing phone numbers

2026-04-27 01:13:21 +01:00 · 2021-08-02 16:41:10 -04:00
parent aa4bd92fee
commit ba58a95a0f
11 changed files with 947 additions and 66 deletions
--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
@@ -66,6 +66,7 @@ import org.whispersystems.textsecuregcm.controllers.RateLimitExceededException;
 import org.whispersystems.textsecuregcm.entities.AccountAttributes;
 import org.whispersystems.textsecuregcm.entities.AccountCreationResult;
 import org.whispersystems.textsecuregcm.entities.ApnRegistrationId;
+import org.whispersystems.textsecuregcm.entities.ChangePhoneNumberRequest;
 import org.whispersystems.textsecuregcm.entities.GcmRegistrationId;
 import org.whispersystems.textsecuregcm.entities.RegistrationLock;
 import org.whispersystems.textsecuregcm.entities.RegistrationLockFailure;
@@ -105,6 +106,7 @@ class AccountControllerTest {
  private static final String SENDER_TRANSFER    = "+14151111112";

  private static final UUID   SENDER_REG_LOCK_UUID = UUID.randomUUID();
+  private static final UUID   SENDER_TRANSFER_UUID = UUID.randomUUID();

  private static final String ABUSIVE_HOST             = "192.168.1.1";
  private static final String RESTRICTED_HOST          = "192.168.1.2";
@@ -200,6 +202,11 @@ class AccountControllerTest {
    when(senderRegLockAccount.getRegistrationLock()).thenReturn(new StoredRegistrationLock(Optional.of(registrationLockCredentials.getHashedAuthenticationToken()), Optional.of(registrationLockCredentials.getSalt()), System.currentTimeMillis()));
    when(senderRegLockAccount.getLastSeen()).thenReturn(System.currentTimeMillis());
    when(senderRegLockAccount.getUuid()).thenReturn(SENDER_REG_LOCK_UUID);
+    when(senderRegLockAccount.getNumber()).thenReturn(SENDER_REG_LOCK);
+
+    when(senderTransfer.getRegistrationLock()).thenReturn(new StoredRegistrationLock(Optional.empty(), Optional.empty(), System.currentTimeMillis()));
+    when(senderTransfer.getUuid()).thenReturn(SENDER_TRANSFER_UUID);
+    when(senderTransfer.getNumber()).thenReturn(SENDER_TRANSFER);

    when(pendingAccountsManager.getCodeForNumber(SENDER)).thenReturn(Optional.of(new StoredVerificationCode("1234", System.currentTimeMillis(), "1234-push", null)));
    when(pendingAccountsManager.getCodeForNumber(SENDER_OLD)).thenReturn(Optional.empty());
@@ -1124,6 +1131,203 @@ class AccountControllerTest {
    assertThat(response.getStatus()).isEqualTo(200);
  }

+  @Test
+  void testChangePhoneNumber() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(AuthHelper.VALID_ACCOUNT, number);
+  }
+
+  @Test
+  void testChangePhoneNumberSameNumber() throws InterruptedException {
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(AuthHelper.VALID_NUMBER, "567890", null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberNoPendingCode() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.empty());
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(403);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberIncorrectCode() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code + "-incorrect", null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(403);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockNotRequired() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(false);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredNotProvided() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(423);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredIncorrect() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+    final String reglock = "setec-astronomy";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+    when(existingRegistrationLock.verify(anyString())).thenReturn(false);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, reglock),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(423);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredCorrect() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+    final String reglock = "setec-astronomy";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+    when(existingRegistrationLock.verify(reglock)).thenReturn(true);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, reglock),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
  @Test
  void testSetRegistrationLock() {
    Response response =
--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/storage/AccountsManagerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/storage/AccountsManagerTest.java
@@ -7,6 +7,7 @@ package org.whispersystems.textsecuregcm.tests.storage;

 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.argThat;
@@ -27,7 +28,9 @@ import io.lettuce.core.cluster.api.sync.RedisAdvancedClusterCommands;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
 import java.util.function.Consumer;
+import java.util.function.Supplier;
 import java.util.stream.Stream;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -36,7 +39,6 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.stubbing.Answer;
-import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
 import org.whispersystems.textsecuregcm.entities.AccountAttributes;
 import org.whispersystems.textsecuregcm.entities.SignedPreKey;
 import org.whispersystems.textsecuregcm.push.ClientPresenceManager;
@@ -50,7 +52,6 @@ import org.whispersystems.textsecuregcm.storage.ContestedOptimisticLockException
 import org.whispersystems.textsecuregcm.storage.DeletedAccountsManager;
 import org.whispersystems.textsecuregcm.storage.Device;
 import org.whispersystems.textsecuregcm.storage.Device.DeviceCapabilities;
-import org.whispersystems.textsecuregcm.storage.DynamicConfigurationManager;
 import org.whispersystems.textsecuregcm.storage.KeysDynamoDb;
 import org.whispersystems.textsecuregcm.storage.MessagesManager;
 import org.whispersystems.textsecuregcm.storage.ProfilesManager;
@@ -63,7 +64,6 @@ class AccountsManagerTest {
  private Accounts accounts;
  private DeletedAccountsManager deletedAccountsManager;
  private DirectoryQueue directoryQueue;
-  private DynamicConfigurationManager dynamicConfigurationManager;
  private KeysDynamoDb keys;
  private MessagesManager messagesManager;
  private ProfilesManager profilesManager;
@@ -84,7 +84,6 @@ class AccountsManagerTest {
    accounts = mock(Accounts.class);
    deletedAccountsManager = mock(DeletedAccountsManager.class);
    directoryQueue = mock(DirectoryQueue.class);
-    dynamicConfigurationManager = mock(DynamicConfigurationManager.class);
    keys = mock(KeysDynamoDb.class);
    messagesManager = mock(MessagesManager.class);
    profilesManager = mock(ProfilesManager.class);
@@ -92,8 +91,14 @@ class AccountsManagerTest {
    //noinspection unchecked
    commands = mock(RedisAdvancedClusterCommands.class);

-    final DynamicConfiguration dynamicConfiguration = new DynamicConfiguration();
-    when(dynamicConfigurationManager.getConfiguration()).thenReturn(dynamicConfiguration);
+    doAnswer((Answer<Void>) invocation -> {
+      final Account account = invocation.getArgument(0, Account.class);
+      final String number = invocation.getArgument(1, String.class);
+
+      account.setNumber(number);
+
+      return null;
+    }).when(accounts).changeNumber(any(), anyString());

    doAnswer(invocation -> {
      //noinspection unchecked
@@ -101,6 +106,12 @@ class AccountsManagerTest {
      return null;
    }).when(deletedAccountsManager).lockAndTake(anyString(), any());

+    final SecureStorageClient storageClient = mock(SecureStorageClient.class);
+    when(storageClient.deleteStoredData(any())).thenReturn(CompletableFuture.completedFuture(null));
+
+    final SecureBackupClient backupClient = mock(SecureBackupClient.class);
+    when(backupClient.deleteBackups(any())).thenReturn(CompletableFuture.completedFuture(null));
+
    accountsManager = new AccountsManager(
        accounts,
        RedisClusterHelper.buildMockRedisCluster(commands),
@@ -111,10 +122,9 @@ class AccountsManagerTest {
        mock(UsernamesManager.class),
        profilesManager,
        mock(StoredVerificationCodeManager.class),
-        mock(SecureStorageClient.class),
-        mock(SecureBackupClient.class),
-        mock(ClientPresenceManager.class)
-    );
+        storageClient,
+        backupClient,
+        mock(ClientPresenceManager.class));
  }

  @Test
@@ -159,7 +169,6 @@ class AccountsManagerTest {

  @Test
  void testGetAccountByNumberNotInCache() {
-    final boolean dynamoEnabled = true;
    UUID uuid = UUID.randomUUID();
    Account account = new Account("+14152222222", uuid, new HashSet<>(), new byte[16]);

@@ -182,7 +191,6 @@ class AccountsManagerTest {

  @Test
  void testGetAccountByUuidNotInCache() {
-    final boolean dynamoEnabled = true;
    UUID uuid = UUID.randomUUID();
    Account account = new Account("+14152222222", uuid, new HashSet<>(), new byte[16]);

@@ -458,4 +466,66 @@ class AccountsManagerTest {
        Arguments.of(false, 2, 1)
    );
  }
+
+  @Test
+  void testChangePhoneNumber() throws InterruptedException {
+    doAnswer(invocation -> invocation.getArgument(2, Supplier.class).get())
+        .when(deletedAccountsManager).lockAndPut(anyString(), anyString(), any());
+
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID uuid = UUID.randomUUID();
+
+    Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, targetNumber);
+
+    assertEquals(targetNumber, account.getNumber());
+
+    verify(directoryQueue).changePhoneNumber(argThat(a -> a.getUuid().equals(uuid)), eq(originalNumber), eq(targetNumber));
+  }
+
+  @Test
+  void testChangePhoneNumberSameNumber() throws InterruptedException {
+    final String number = "+14152222222";
+
+    Account account = new Account(number, UUID.randomUUID(), new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, number);
+
+    assertEquals(number, account.getNumber());
+    verify(deletedAccountsManager, never()).lockAndPut(anyString(), anyString(), any());
+    verify(directoryQueue, never()).changePhoneNumber(any(), any(), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccount() throws InterruptedException {
+    doAnswer(invocation -> invocation.getArgument(2, Supplier.class).get())
+        .when(deletedAccountsManager).lockAndPut(anyString(), anyString(), any());
+
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID existingAccountUuid = UUID.randomUUID();
+    final UUID uuid = UUID.randomUUID();
+
+    final Account existingAccount = new Account(targetNumber, existingAccountUuid, new HashSet<>(), new byte[16]);
+    when(accounts.get(targetNumber)).thenReturn(Optional.of(existingAccount));
+
+    Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, targetNumber);
+
+    assertEquals(targetNumber, account.getNumber());
+
+    verify(directoryQueue).changePhoneNumber(argThat(a -> a.getUuid().equals(uuid)), eq(originalNumber), eq(targetNumber));
+    verify(directoryQueue, never()).deleteAccount(any());
+  }
+
+  @Test
+  void testChangePhoneNumberViaUpdate() {
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID uuid = UUID.randomUUID();
+
+    final Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+
+    assertThrows(AssertionError.class, () -> accountsManager.update(account, a -> a.setNumber(targetNumber)));
+  }
 }