From c1521c5b4c0bc4447b54603e64fde48b2610c522 Mon Sep 17 00:00:00 2001 From: Tanmay Deep Sharma Date: Tue, 21 Apr 2026 10:32:14 +0700 Subject: [PATCH] test(mfa): cover disabling 2FA with backup code --- .../api/v1/profile/mfa_controller_spec.rb | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/spec/requests/api/v1/profile/mfa_controller_spec.rb b/spec/requests/api/v1/profile/mfa_controller_spec.rb index 97a2e206f..eebd997ee 100644 --- a/spec/requests/api/v1/profile/mfa_controller_spec.rb +++ b/spec/requests/api/v1/profile/mfa_controller_spec.rb @@ -205,6 +205,23 @@ RSpec.describe 'MFA API', type: :request do expect(json_response['error']).to include('Invalid') end end + + context 'with valid password and backup code' do + it 'disables 2FA successfully' do + backup_code = user.otp_backup_codes.first + + delete '/api/v1/profile/mfa', + params: { password: 'Test@123456', backup_code: backup_code }, + headers: user.create_new_auth_token, + as: :json + + expect(response).to have_http_status(:success) + user.reload + expect(user.otp_required_for_login).to be_falsey + expect(user.otp_secret).to be_nil + expect(user.otp_backup_codes).to be_blank + end + end end context 'when 2FA is not enabled' do