class-two-factor-core.php

<?php
/**
 * Two Factor Core Class Tests.
 *
 * @package Two_Factor
 */

/**
 * Exception thrown when wp_redirect fires, to prevent exit() from terminating the test process.
 */
class Two_Factor_Redirect_Exception extends RuntimeException {}

/**
 * Class Test_ClassTwoFactorCore
 *
 * @package Two_Factor
 * @group core
 */
class Test_ClassTwoFactorCore extends WP_UnitTestCase {

	/**
	 * Original User ID set in set_up().
	 *
	 * @var int
	 */
	private $old_user_id;

	/**
	 * Set up error handling before test suite.
	 *
	 * @see WP_UnitTestCase_Base::set_up_before_class()
	 */
	public static function wpSetUpBeforeClass() {
		set_error_handler( array( 'Test_ClassTwoFactorCore', 'error_handler' ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_set_error_handler
		add_action( 'set_auth_cookie', array( __CLASS__, 'set_auth_cookie' ) );
		add_action( 'set_logged_in_cookie', array( __CLASS__, 'set_logged_in_cookie' ) );
	}

	/**
	 * Clean up error settings after test suite.
	 *
	 * @see WP_UnitTestCase_Base::tear_down_after_class()
	 */
	public static function wpTearDownAfterClass() {
		restore_error_handler();
		remove_action( 'set_auth_cookie', array( __CLASS__, 'set_auth_cookie' ) );
		remove_action( 'set_logged_in_cookie', array( __CLASS__, 'set_logged_in_cookie' ) );
	}

	/**
	 * Cleanup after each test.
	 */
	public function tearDown(): void {
		parent::tearDown();

		unset( $_COOKIE[ AUTH_COOKIE ], $_COOKIE[ LOGGED_IN_COOKIE ] );

		// Remove the plugin's send_auth_cookies block that filter_authenticate installs,
		// so it does not leak into subsequent tests that expect cookies to be settable.
		remove_filter( 'send_auth_cookies', '__return_false', PHP_INT_MAX );
	}

	/**
	 * Print error messages and return true if error is a notice
	 *
	 * @param integer $errno error number.
	 * @param string  $errstr error message text.
	 *
	 * @return boolean
	 */
	public static function error_handler( $errno, $errstr ) {
		if ( E_USER_NOTICE !== $errno ) {
			echo 'Received a non-notice error: ' . esc_html( $errstr );

			return false;
		}

		return true;
	}

	/**
	 * Simulate the auth cookie having being sent.
	 *
	 * @param string $auth_cookie Auth cookie value.
	 */
	public static function set_auth_cookie( $auth_cookie ) {
		$_COOKIE[ AUTH_COOKIE ] = $auth_cookie;
	}

	/**
	 * Simulate the logged_in cookie having being sent.
	 *
	 * @param string $logged_in_cookie Logged in cookie value.
	 */
	public static function set_logged_in_cookie( $logged_in_cookie ) {
		$_COOKIE[ LOGGED_IN_COOKIE ] = $logged_in_cookie;
	}

	/**
	 * Get a dummy user object.
	 *
	 * @param array $meta_key authentication method.
	 *
	 * @return WP_User
	 */
	public function get_dummy_user( $meta_key = array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) ) {
		$user              = new WP_User( self::factory()->user->create() );
		$this->old_user_id = get_current_user_id();
		wp_set_current_user( $user->ID );

		$key              = '_nonce_user_two_factor_options';
		$nonce            = wp_create_nonce( 'user_two_factor_options' );
		$_POST[ $key ]    = $nonce;
		$_REQUEST[ $key ] = $nonce;

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = $meta_key;

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		return $user;
	}

	/**
	 * Clean up the dummy user object data.
	 */
	public function clean_dummy_user() {
		unset( $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );

		$key = '_nonce_user_two_factor_options';
		unset( $_REQUEST[ $key ] );
		unset( $_POST[ $key ] );
	}

	/**
	 * Run a callable that may call wp_safe_redirect() + exit.
	 *
	 * Intercepts the redirect via the wp_redirect filter to throw a
	 * Two_Factor_Redirect_Exception, preventing exit() from terminating the
	 * test process. Also captures and discards any output produced.
	 *
	 * @param callable $callback Code that may trigger a redirect.
	 * @return string|null The intercepted redirect URL, or null if no redirect occurred.
	 */
	private function do_redirect_callable( $callback ) {
		$intercepted_url = null;
		$redirect_filter = function ( $location ) {
			throw new Two_Factor_Redirect_Exception( $location ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
		};
		add_filter( 'wp_redirect', $redirect_filter, PHP_INT_MAX );
		ob_start();
		try {
			$callback();
		} catch ( Two_Factor_Redirect_Exception $e ) {
			$intercepted_url = $e->getMessage();
		} finally {
			ob_end_clean();
			remove_filter( 'wp_redirect', $redirect_filter, PHP_INT_MAX );
		}
		return $intercepted_url;
	}

	/**
	 * Reset stored profile errors between tests.
	 */
	private function reset_profile_errors() {
		$reflection = new ReflectionClass( Two_Factor_Core::class );
		$prop       = $reflection->getProperty( 'profile_errors' );
		$prop->setAccessible( true );
		$prop->setValue( null, array() );
	}

	/**
	 * Render the user two-factor settings UI and return the markup.
	 *
	 * @param WP_User $user User instance.
	 * @return string
	 */
	private function render_user_two_factor_options( WP_User $user ) {
		$this->reset_profile_errors();

		ob_start();
		Two_Factor_Core::user_two_factor_options( $user );
		return ob_get_clean();
	}

	/**
	 * Verify adding hooks.
	 *
	 * @covers Two_Factor_Core::add_hooks
	 */
	public function test_add_hooks() {
		Two_Factor_Core::add_hooks( new Two_Factor_Compat() );

		$this->assertGreaterThan(
			0,
			has_action(
				'init',
				array( 'Two_Factor_Core', 'get_providers' )
			)
		);
		$this->assertGreaterThan(
			0,
			has_action(
				'login_form_validate_2fa',
				array( 'Two_Factor_Core', 'login_form_validate_2fa' )
			)
		);
	}

	/**
	 * Verify provider list is not empty.
	 *
	 * @covers Two_Factor_Core::get_providers
	 */
	public function test_get_providers_not_empty() {
		$this->assertNotEmpty( Two_Factor_Core::get_providers() );
	}

	/**
	 * Verify provider class exists.
	 *
	 * @covers Two_Factor_Core::get_providers
	 */
	public function test_get_providers_class_exists() {
		$result = Two_Factor_Core::get_providers();

		foreach ( array_keys( $result ) as $class ) {
			$this->assertNotNull( class_exists( $class ) );
		}
	}

	/**
	 * Test fetching user functionality.
	 *
	 * @covers Two_Factor_Core::fetch_user
	 */
	public function test_fetch_user() {
		$this->assertFalse( Two_Factor_Core::fetch_user( null ) );

		$logged_in = self::factory()->user->create_and_get();
		wp_set_current_user( $logged_in->ID );

		$fetched = Two_Factor_Core::fetch_user( null );
		$this->assertSame( $logged_in->ID, $fetched->ID );

		$logged_out = self::factory()->user->create_and_get();

		$fetched = Two_Factor_Core::fetch_user( $logged_out->ID );
		$this->assertSame( $logged_out->ID, $fetched->ID );

		$fetched = Two_Factor_Core::fetch_user( $logged_out );
		$this->assertSame( $logged_out->ID, $fetched->ID );
	}

	/**
	 * Verify enabled providers for non-logged-in user.
	 *
	 * @covers Two_Factor_Core::get_enabled_providers_for_user
	 */
	public function test_get_enabled_providers_for_user_not_logged_in() {
		$this->assertEmpty( Two_Factor_Core::get_enabled_providers_for_user() );
	}

	/**
	 * Verify enabled providers for logged-in user.
	 *
	 * @covers Two_Factor_Core::get_enabled_providers_for_user
	 */
	public function test_get_enabled_providers_for_user_logged_in() {
		$user        = new WP_User( self::factory()->user->create() );
		$old_user_id = get_current_user_id();
		wp_set_current_user( $user->ID );

		$this->assertEmpty( Two_Factor_Core::get_enabled_providers_for_user() );

		wp_set_current_user( $old_user_id );
	}

	/**
	 * Verify enabled providers for logged-in user and set provider.
	 *
	 * @covers Two_Factor_Core::get_enabled_providers_for_user
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 * @covers Two_Factor_Core::fetch_user
	 */
	public function test_get_enabled_providers_for_user_logged_in_and_set_provider() {
		$user = $this->get_dummy_user();

		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		// Revert back to the previous user.
		wp_set_current_user( $this->old_user_id );

		// Verify the counts are still correct for that user ID.
		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		$this->clean_dummy_user();
	}

	/**
	 * Verify enabled providers for invalid input is empty.
	 *
	 * @covers Two_Factor_Core::get_enabled_providers_for_user
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 * @covers Two_Factor_Core::fetch_user
	 */
	public function test_get_enabled_providers_for_user_bad_input() {
		$user = $this->get_dummy_user();

		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		// Check that checking for an invalid input returns 0.
		$this->assertCount( 0, Two_Factor_Core::get_available_providers_for_user( 'bad-input' ) );
		$this->assertCount( 0, Two_Factor_Core::get_enabled_providers_for_user( 'bad-input' ) );

		$this->clean_dummy_user();
	}

	/**
	 * Verify enabled providers for logged-in user and set incorrect provider.
	 *
	 * @covers Two_Factor_Core::get_enabled_providers_for_user
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 */
	public function test_get_enabled_providers_for_user_logged_in_and_set_provider_bad_enabled() {
		$user = $this->get_dummy_user( 'test_badness' );

		$this->assertEmpty( Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertEmpty( Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		wp_set_current_user( $this->old_user_id );
		$this->clean_dummy_user();
	}

	/**
	 * Verify available providers for not-logged-in user.
	 *
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 */
	public function test_get_available_providers_for_user_not_logged_in() {
		$this->assertEmpty( Two_Factor_Core::get_available_providers_for_user() );
	}

	/**
	 * Verify available providers for logged-in user.
	 *
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 */
	public function test_get_available_providers_for_user_logged_in() {
		$user        = new WP_User( self::factory()->user->create() );
		$old_user_id = get_current_user_id();
		wp_set_current_user( $user->ID );

		$this->assertEmpty( Two_Factor_Core::get_available_providers_for_user() );

		wp_set_current_user( $old_user_id );
	}

	/**
	 * Verify that if a user has a non-existent provider set, that it
	 * swaps to email instead, rather than treating the user as having
	 * no methods enabled.
	 */
	public function test_deprecated_provider_for_user() {
		$user = $this->get_dummy_user();

		// Set the dummy user with a non-existent provider.
		update_user_meta(
			$user->ID,
			Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY,
			array(
				'Two_Factor_Deprecated',
			)
		);

		// This should fail back to `Two_Factor_Email` then.
		$this->assertEquals(
			array(
				'Two_Factor_Email',
			),
			array_keys( Two_Factor_Core::get_available_providers_for_user( $user ) )
		);

		// Set the dummy user with a non-existent provider and a valid one.
		update_user_meta(
			$user->ID,
			Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY,
			array(
				'Two_Factor_Deprecated',
				'Two_Factor_Dummy',
			)
		);

		// This time it should just strip out the invalid one, and not inject a new one.
		$this->assertEquals(
			array(
				'Two_Factor_Dummy',
			),
			array_keys( Two_Factor_Core::get_available_providers_for_user( $user ) )
		);

		$this->clean_dummy_user();
	}

	/**
	 * Verify primary provider for not-logged-in user.
	 *
	 * @covers Two_Factor_Core::get_primary_provider_for_user
	 */
	public function test_get_primary_provider_for_user_not_logged_in() {
		$this->assertEmpty( Two_Factor_Core::get_primary_provider_for_user() );
	}

	/**
	 * Verify not-logged-in-user is using two facator.
	 *
	 * @covers Two_Factor_Core::is_user_using_two_factor
	 */
	public function test_is_user_using_two_factor_not_logged_in() {
		$this->assertFalse( Two_Factor_Core::is_user_using_two_factor() );
	}

	/**
	 * Verify the login URL.
	 *
	 * @covers Two_Factor_Core::login_url
	 */
	public function test_login_url() {
		$this->assertStringContainsString( 'wp-login.php', Two_Factor_Core::login_url() );

		$this->assertStringContainsString(
			'paramencoded=%2F%3D1',
			Two_Factor_Core::login_url(
				array(
					'paramencoded' => '/=1',
				)
			)
		);
	}

	/**
	 * Verify user API log is enabled (when disabled by default).
	 *
	 * @covers Two_Factor_Core::is_user_api_login_enabled
	 */
	public function test_user_api_login_is_disabled_by_default() {
		$user_id = self::factory()->user->create();

		$this->assertFalse( Two_Factor_Core::is_user_api_login_enabled( $user_id ) );
	}

	/**
	 * Verify user API log is can be enabled by filter.
	 *
	 * @covers Two_Factor_Core::is_user_api_login_enabled
	 */
	public function test_user_api_login_can_be_enabled_via_filter() {
		$user_id_default = self::factory()->user->create();
		$user_id_enabled = self::factory()->user->create();

		add_filter(
			'two_factor_user_api_login_enable',
			function ( $enabled, $user_id ) use ( $user_id_enabled ) {
				return ( $user_id === $user_id_enabled );
			},
			10,
			2
		);

		$this->assertTrue(
			Two_Factor_Core::is_user_api_login_enabled( $user_id_enabled ),
			'Filters allows specific users to enable API login'
		);

		$this->assertFalse(
			Two_Factor_Core::is_user_api_login_enabled( $user_id_default ),
			'Filter doesnot impact other users'
		);

		// Undo all filters.
		remove_all_filters( 'two_factor_user_api_login_enable', 10 );
	}

	/**
	 * Verify request is not an API request.
	 *
	 * @covers Two_Factor_Core::is_api_request
	 */
	public function test_is_api_request() {
		$this->assertFalse( Two_Factor_Core::is_api_request() );
	}

	/**
	 * Verify authentication filters.
	 *
	 * @covers Two_Factor_Core::filter_authenticate
	 */
	public function test_filter_authenticate() {
		$user_default     = new WP_User( self::factory()->user->create() );
		$user_2fa_enabled = $this->get_dummy_user(); // User with a dummy two-factor method enabled.

		$this->assertFalse( Two_Factor_Core::is_api_request(), 'Is not an API request by default' );

		// The WP test framework registers __return_false on send_auth_cookies at priority 10 to
		// prevent real cookies from being set during tests. Check for the plugin's specific
		// __return_false callback at PHP_INT_MAX (see Two_Factor_Core::filter_authenticate).
		$has_plugin_cookie_block = function () {
			global $wp_filter;

			if (
				! isset( $wp_filter['send_auth_cookies'] ) ||
				! $wp_filter['send_auth_cookies'] instanceof WP_Hook ||
				empty( $wp_filter['send_auth_cookies']->callbacks[ PHP_INT_MAX ] )
			) {
				return false;
			}

			foreach ( $wp_filter['send_auth_cookies']->callbacks[ PHP_INT_MAX ] as $cb ) {
				if ( '__return_false' === $cb['function'] ) {
					return true;
				}
			}
			return false;
		};

		$this->assertFalse(
			$has_plugin_cookie_block(),
			'Auth cookie block not registered before the `authenticate` filter has run.'
		);

		Two_Factor_Core::filter_authenticate( $user_default );

		$this->assertFalse(
			$has_plugin_cookie_block(),
			'User login without 2fa should not block auth cookies.'
		);

		Two_Factor_Core::filter_authenticate( $user_2fa_enabled );

		$this->assertTrue(
			$has_plugin_cookie_block(),
			'User login with 2fa should block auth cookies.'
		);
	}

	/**
	 * Verify authentication filters.
	 *
	 * @covers Two_Factor_Core::filter_authenticate
	 * @covers Two_Factor_Core::is_api_request
	 * @runInSeparateProcess
	 * @preserveGlobalState disabled
	 */
	public function test_filter_authenticate_api() {
		$user_default     = new WP_User( self::factory()->user->create() );
		$user_2fa_enabled = $this->get_dummy_user(); // User with a dummy two-factor method enabled.

		// TODO: Get Two_Factor_Core away from static methods to allow mocking this.
		// Guard against re-definition if the constant is already set in this process.
		if ( ! defined( 'XMLRPC_REQUEST' ) ) {
			define( 'XMLRPC_REQUEST', true );
		}

		$this->assertTrue( Two_Factor_Core::is_api_request(), 'Can detect an API request' );

		$this->assertInstanceOf(
			WP_User::class,
			Two_Factor_Core::filter_authenticate( $user_default ),
			'Non-2FA user should be able to authenticate during API requests'
		);

		$this->assertInstanceOf(
			WP_Error::class,
			Two_Factor_Core::filter_authenticate( $user_2fa_enabled ),
			'2FA user should not be able to authenticate during API requests'
		);
	}

	/**
	 * Verify destruction of auth session.
	 *
	 * @covers Two_Factor_Core::destroy_current_session_for_user
	 * @covers Two_Factor_Core::collect_auth_cookie_tokens
	 */
	public function test_can_distroy_auth_sessions() {
		$user_id = self::factory()->user->create(
			array(
				'user_login' => 'username',
				'user_pass'  => 'password',
			)
		);

		$user = new WP_User( $user_id );

		$session_manager = WP_Session_Tokens::get_instance( $user_id );

		$this->assertCount( 0, $session_manager->get_all(), 'No user sessions are present first' );

		$user_authenticated = wp_signon(
			array(
				'user_login'    => 'username',
				'user_password' => 'password',
			)
		);

		$this->assertEquals( $user_authenticated, $user, 'User can authenticate' );
		$this->assertCount( 1, $session_manager->get_all(), 'Can fetch the authenticated session' );

		// Create one extra session which shouldn't be destroyed.
		$session_manager->create( time() + 60 * 60 );
		$this->assertCount( 2, $session_manager->get_all(), 'Can fetch active sessions' );

		// Now clear all active password-based sessions.
		Two_Factor_Core::destroy_current_session_for_user( $user );
		$this->assertCount( 1, $session_manager->get_all(), 'All known authentication sessions have been destroyed' );

		// Cleanup for the rest.
		$session_manager->destroy_all();
	}

	/**
	 * Test invalid hash input fails.
	 *
	 * @covers Two_Factor_Core::create_login_nonce()
	 * @covers Two_Factor_Core::hash_login_nonce()
	 */
	public function test_invalid_hash_input_fails() {
		$nonce = Two_Factor_Core::create_login_nonce( NAN );

		$this->assertFalse( $nonce );
		$this->assertNotEmpty( json_last_error() );
	}

	/**
	 * Test create login nonce.
	 *
	 * @covers Two_Factor_Core::create_login_nonce()
	 * @covers Two_Factor_Core::hash_login_nonce()
	 */
	public function test_create_login_nonce() {
		$user              = self::factory()->user->create_and_get();
		$plain_nonce       = Two_Factor_Core::create_login_nonce( $user->ID );
		$hashed_nonce      = get_user_meta( $user->ID, Two_Factor_Core::USER_META_NONCE_KEY, true );
		$plain_key_length  = strlen( $plain_nonce['key'] );
		$hashed_key_length = strlen( $hashed_nonce['key'] );

		$this->assertSame( $user->ID, $plain_nonce['user_id'] );
		$this->assertGreaterThan( time() + ( 9 * MINUTE_IN_SECONDS ), $plain_nonce['expiration'] );
		$this->assertIsString( $plain_nonce['key'] );
		$this->assertTrue( 64 === $plain_key_length || 32 === $plain_key_length );

		$this->assertSame( $plain_nonce['expiration'], $hashed_nonce['expiration'] );
		$this->assertIsString( $hashed_nonce['key'] );
		$this->assertTrue( 32 === $hashed_key_length );
		$this->assertNotEquals( $plain_nonce['key'], $hashed_nonce['key'] );
	}

	/**
	 * Check if nonce can be verified.
	 *
	 * @covers Two_Factor_Core::create_login_nonce()
	 * @covers Two_Factor_Core::verify_login_nonce()
	 */
	public function test_can_verify_login_nonce() {
		$user_id = 123456;
		$nonce   = Two_Factor_Core::create_login_nonce( $user_id );

		$this->assertNotEmpty( $nonce['key'], 'Nonce key is present' );
		$this->assertNotEmpty( $nonce['expiration'], 'Nonce expiration is set' );

		$this->assertGreaterThan( time(), $nonce['expiration'], 'Nonce expiration is in the future' );
		$this->assertLessThan( time() + ( 10 * MINUTE_IN_SECONDS ) + 1, $nonce['expiration'], 'Nonce expiration is not more than 10 minutes' );

		$this->assertTrue(
			Two_Factor_Core::verify_login_nonce( $user_id, $nonce['key'] ),
			'Can verify login nonce'
		);

		$this->assertFalse(
			Two_Factor_Core::verify_login_nonce( $user_id, '1234' ),
			'Invalid nonce is invalid'
		);

		// Must create a new one since incorrect nonces deletes them.
		$nonce = Two_Factor_Core::create_login_nonce( $user_id );

		// Mark the nonce as expired.
		$nonce_in_meta               = get_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, true );
		$nonce_in_meta['expiration'] = time() - 1;
		update_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, $nonce_in_meta );

		$this->assertFalse(
			Two_Factor_Core::verify_login_nonce( $user_id, $nonce['key'] ),
			'Expired nonce is invalid'
		);
	}

	/**
	 * Invalid nonce deletes the valid nonce.
	 *
	 * @covers Two_Factor_Core::verify_login_nonce()
	 */
	public function test_invalid_nonce_deletes_valid_nonce() {
		$user_id = 123456;
		$nonce   = Two_Factor_Core::create_login_nonce( $user_id );

		$this->assertFalse(
			Two_Factor_Core::verify_login_nonce( $user_id, '1234' ),
			'Invalid nonce is invalid'
		);

		$this->assertFalse(
			Two_Factor_Core::verify_login_nonce( $user_id, $nonce['key'] ),
			'The correct nonce is not accepted after an invalid has been attempted'
		);
	}

	/**
	 * Test that the lockout time delay for two factor attempts is respected.
	 *
	 * @covers Two_Factor_Core::get_user_time_delay()
	 */
	public function test_get_user_time_delay() {
		$user = $this->get_dummy_user();

		// Default values, sans filters.
		$rate_limit     = 1;
		$max_rate_limit = 15 * MINUTE_IN_SECONDS;

		// User has never logged in, validate the minimum time delay is in play.
		$this->assertEquals( $rate_limit, Two_Factor_Core::get_user_time_delay( $user ) );

		// Simulate 5 failed login attempts, and validate that the lockout is as expected.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 5 );
		$this->assertEquals( pow( 2, 5 ) * $rate_limit, Two_Factor_Core::get_user_time_delay( $user ) );

		// Simulate 100 failed login attempts, validate that the lockout is not greater than $max_rate_limit.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 100 );
		$this->assertEquals( $max_rate_limit, Two_Factor_Core::get_user_time_delay( $user ) );
	}

	/**
	 * Test that the user rate limit functions return as expected.
	 *
	 * @covers Two_Factor_Core::is_user_rate_limited()
	 */
	public function test_is_user_rate_limited() {
		$user = $this->get_dummy_user();

		// User has never logged in, validate they're not rate limited.
		$this->assertFalse( Two_Factor_Core::is_user_rate_limited( $user ) );

		// Failed login attempt at time(), user should be rate limited.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 1 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() );
		$this->assertTrue( Two_Factor_Core::is_user_rate_limited( $user ) );

		// 8 failed logins a minite ago, user should be rate limited.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 8 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() - MINUTE_IN_SECONDS );
		$this->assertTrue( Two_Factor_Core::is_user_rate_limited( $user ) );

		// 8 failed logins an hour ago, user should not be rate limited.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 8 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() - HOUR_IN_SECONDS );
		$this->assertFalse( Two_Factor_Core::is_user_rate_limited( $user ) );
	}

	/**
	 * Test that clearing the login rate limit removes the throttle state.
	 *
	 * @covers Two_Factor_Core::clear_login_rate_limit
	 */
	public function test_clear_login_rate_limit() {
		$user = $this->get_dummy_user();

		// Put the user into a rate-limited state.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 5 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() );
		$this->assertTrue( Two_Factor_Core::is_user_rate_limited( $user ) );

		Two_Factor_Core::clear_login_rate_limit( $user );

		$this->assertFalse( Two_Factor_Core::is_user_rate_limited( $user ) );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, true ) );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, true ) );

		// Clearing an already-clean user is a harmless no-op.
		Two_Factor_Core::clear_login_rate_limit( $user );
		$this->assertFalse( Two_Factor_Core::is_user_rate_limited( $user ) );
	}

	/**
	 * Test that the "invalid login attempts have occurred" login notice works as expected.
	 *
	 * @covers Two_Factor_Core::maybe_show_last_login_failure_notice()
	 */
	public function test_maybe_show_last_login_failure_notice() {
		$user = $this->get_dummy_user();

		// User has never logged in, validate they're not rate limited.
		ob_start();
		Two_Factor_Core::maybe_show_last_login_failure_notice( $user );
		$contents = ob_get_clean();

		$this->assertEmpty( $contents );

		// A failed login attempts 5 seconds ago.
		// Should throw a notice, even though it's the current user, it will only be displayed if there's no other 2FA errors.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 1 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() - 5 );
		ob_start();
		Two_Factor_Core::maybe_show_last_login_failure_notice( $user );
		$contents = ob_get_clean();

		$this->assertNotEmpty( $contents );
		$this->assertStringNotContainsString( '1 times', $contents );
		$this->assertStringContainsString( 'attempted to login', $contents );
		$this->assertStringContainsString( 'without providing a valid two factor token', $contents );

		// 5 failed login attempts 5 hours ago - User should be informed.
		$five_hours_ago = time() - 5 * HOUR_IN_SECONDS;
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 5 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, $five_hours_ago );
		ob_start();
		Two_Factor_Core::maybe_show_last_login_failure_notice( $user );
		$contents = ob_get_clean();

		$this->assertNotEmpty( $contents );
		$this->assertStringContainsString( '5 times', $contents );
		$this->assertStringContainsString( human_time_diff( $five_hours_ago ), $contents );
	}

	/**
	 * Test no reset notice when no errors.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_no_reset_notice_when_no_errors() {
		$errors = new WP_Error();
		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 0, $errors->get_error_codes() );
	}

	/**
	 * Test no reset notice when different error.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_no_reset_notice_when_different_error() {
		$errors = new WP_Error( 'foo_bar', 'Foo Bar' );
		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 1, $errors->get_error_codes() );
		$this->assertSame( 'foo_bar', $errors->get_error_code() );
	}

	/**
	 * Test no reset notice when password not reset.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_no_reset_notice_when_password_not_reset() {
		$user         = self::factory()->user->create_and_get();
		$errors       = new WP_Error( 'incorrect_password', 'Incorrect password' );
		$_POST['log'] = $user->user_login;

		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 1, $errors->get_error_codes() );
		$this->assertSame( 'incorrect_password', $errors->get_error_code() );
	}

	/**
	 * Test reset notice when password was reset.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_reset_notice_when_password_was_reset() {
		$user         = self::factory()->user->create_and_get();
		$errors       = new WP_Error( 'incorrect_password', 'Incorrect password' );
		$_POST['log'] = $user->user_login;

		update_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true );
		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 1, $errors->get_error_codes() );
		$this->assertSame( 'two_factor_password_reset', $errors->get_error_code() );
	}

	/**
	 * Test no reset notice when _wpnonce is present but invalid.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_no_reset_notice_when_wpnonce_invalid() {
		$user              = self::factory()->user->create_and_get();
		$errors            = new WP_Error( 'incorrect_password', 'Incorrect password' );
		$_POST['log']      = $user->user_login;
		$_POST['_wpnonce'] = 'invalid-nonce';

		update_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true );
		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 1, $errors->get_error_codes() );
		$this->assertSame( 'incorrect_password', $errors->get_error_code() );
		unset( $_POST['_wpnonce'] );
	}

	/**
	 * Test reset notice when _wpnonce is present and valid for log-in.
	 *
	 * @covers Two_Factor_Core::maybe_show_reset_password_notice()
	 */
	public function test_reset_notice_when_wpnonce_valid() {
		$user              = self::factory()->user->create_and_get();
		$errors            = new WP_Error( 'incorrect_password', 'Incorrect password' );
		$_POST['log']      = $user->user_login;
		$_POST['_wpnonce'] = wp_create_nonce( 'log-in' );

		update_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true );
		Two_Factor_Core::maybe_show_reset_password_notice( $errors );
		$this->assertCount( 1, $errors->get_error_codes() );
		$this->assertSame( 'two_factor_password_reset', $errors->get_error_code() );
		unset( $_POST['_wpnonce'] );
	}

	/**
	 * Test clear password reset notice.
	 *
	 * @covers Two_Factor_Core::clear_password_reset_notice()
	 */
	public function test_clear_password_reset_notice() {
		$user = self::factory()->user->create_and_get();
		update_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true );

		Two_Factor_Core::clear_password_reset_notice( $user );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true ) );
	}

	/**
	 * Test should reset password.
	 *
	 * @covers Two_Factor_Core::should_reset_password()
	 */
	public function test_should_reset_password() {
		$user = self::factory()->user->create_and_get();

		// Test default limit.
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 29 );
		$this->assertFalse( Two_Factor_Core::should_reset_password( $user->ID ) );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 30 );
		$this->assertTrue( Two_Factor_Core::should_reset_password( $user->ID ) );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 31 );
		$this->assertTrue( Two_Factor_Core::should_reset_password( $user->ID ) );

		// Test filtered limit.
		$strict_limit = function () {
			return 7;
		};

		add_filter( 'two_factor_failed_attempt_limit', $strict_limit );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 6 );
		$this->assertFalse( Two_Factor_Core::should_reset_password( $user->ID ) );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 7 );
		$this->assertTrue( Two_Factor_Core::should_reset_password( $user->ID ) );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 8 );
		$this->assertTrue( Two_Factor_Core::should_reset_password( $user->ID ) );
		remove_filter( 'two_factor_failed_attempt_limit', $strict_limit );
	}

	/**
	 * Resetting a password should change the password and notify the user and admin.
	 *
	 * @covers Two_Factor_Core::reset_compromised_password()
	 */
	public function test_reset_compromised_password() {
		$user     = self::factory()->user->create_and_get();
		$old_hash = $user->user_pass;

		// Simulate entered password but failed 2FA too many times.
		Two_Factor_Core::create_login_nonce( $user->ID );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() );
		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 30 );

		Two_Factor_Core::reset_compromised_password( $user );
		$user = get_user_by( 'id', $user->ID );
		$this->assertNotSame( $old_hash, $user->user_pass );
		$this->assertSame( '1', get_user_meta( $user->ID, Two_Factor_Core::USER_PASSWORD_WAS_RESET_KEY, true ) );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_META_NONCE_KEY, true ) );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, false ) );
		$this->assertEmpty( get_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, false ) );
	}

	/**
	 * Test both password reset notifications sent.
	 *
	 * @covers Two_Factor_Core::send_password_reset_emails()
	 * @covers Two_Factor_Core::notify_user_password_reset()
	 * @covers Two_Factor_Core::notify_admin_user_password_reset()
	 */
	public function test_both_password_reset_notifications_sent() {
		$user        = self::factory()->user->create_and_get();
		$mailer      = tests_retrieve_phpmailer_instance();
		$admin_email = get_option( 'admin_email' );

		Two_Factor_Core::send_password_reset_emails( $user );

		$this->assertCount( 2, $mailer->mock_sent );
		$this->assertContains( $user->user_email, $mailer->mock_sent[0]['to'][0] );
		$this->assertContains( $admin_email, $mailer->mock_sent[1]['to'][0] );

		reset_phpmailer_instance();
	}

	/**
	 * Test single email sent when admin password reset.
	 *
	 * @covers Two_Factor_Core::send_password_reset_emails()
	 * @covers Two_Factor_Core::notify_user_password_reset()
	 */
	public function test_single_email_sent_when_admin_password_reset() {
		$admin       = get_user_by( 'id', 1 );
		$mailer      = tests_retrieve_phpmailer_instance();
		$admin_email = get_option( 'admin_email' );

		Two_Factor_Core::send_password_reset_emails( $admin );

		$this->assertSame( $admin->user_email, $admin_email );
		$this->assertCount( 1, $mailer->mock_sent );
		$this->assertContains( $admin_email, $mailer->mock_sent[0]['to'][0] );
		$this->assertStringStartsWith( 'Your password was compromised', $mailer->mock_sent[0]['subject'] );

		reset_phpmailer_instance();
	}

	/**
	 * Test dont notify admin when filter disabled.
	 *
	 * @covers Two_Factor_Core::send_password_reset_emails()
	 * @covers Two_Factor_Core::notify_user_password_reset()
	 */
	public function test_dont_notify_admin_when_filter_disabled() {
		$user        = self::factory()->user->create_and_get();
		$mailer      = tests_retrieve_phpmailer_instance();
		$admin_email = get_option( 'admin_email' );

		add_filter( 'two_factor_notify_admin_user_password_reset', '__return_false' );
		Two_Factor_Core::send_password_reset_emails( $user );
		remove_filter( 'two_factor_notify_admin_user_password_reset', '__return_false' );

		$this->assertNotSame( $user->user_email, $admin_email );
		$this->assertCount( 1, $mailer->mock_sent );
		$this->assertContains( $user->user_email, $mailer->mock_sent[0]['to'][0] );
		$this->assertNotContains( $admin_email, $mailer->mock_sent[0]['to'][0] );

		reset_phpmailer_instance();
	}

	/**
	 * Test show password reset error.
	 *
	 * @covers Two_Factor_Core::show_password_reset_error
	 */
	public function test_show_password_reset_error() {
		ob_start();
		Two_Factor_Core::show_password_reset_error();
		$contents = ob_get_clean();

		$this->assertStringContainsString( 'check your email for instructions on regaining access', $contents );
	}

	/**
	 * Test enable disable provider for user.
	 *
	 * @covers Two_Factor_Core::enable_provider_for_user()
	 * @covers Two_Factor_Core::disable_provider_for_user()
	 */
	public function test_enable_disable_provider_for_user() {
		$user              = self::factory()->user->create_and_get();
		$enabled_providers = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertEmpty( $enabled_providers, 'No providers are enabled by default' );

		// Disabling one that's already disabled should succeed.
		$totp_disabled = Two_Factor_Core::disable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
		$this->assertTrue( $totp_disabled, 'Disabling something that wasn\'t enabled should succeed' );

		// Disabling one that doesn't exist should fail.
		$nonexistent_enabled = Two_Factor_Core::enable_provider_for_user( $user->ID, 'Nonexistent_Provider' );
		$enabled_providers   = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertFalse( $nonexistent_enabled, 'Nonexistent shouldn\'t be allowed to be enabled' );
		$this->assertEmpty( $enabled_providers, 'Nonexistent wasn\'t enabled' );
		$this->assertNull( Two_Factor_Core::get_primary_provider_for_user( $user->ID ), 'Nonexistent wasn\'t set as primary' );

		// Enabling a valid one should succeed. The first one that's enabled and configured should be the default primary.
		$totp = Two_Factor_Totp::get_instance();
		$totp->set_user_totp_key( $user->ID, 'foo' );
		$totp_enabled      = Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
		$enabled_providers = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertTrue( $totp_enabled, 'Can enable a valid provider' );
		$this->assertSame( array( 'Two_Factor_Totp' ), $enabled_providers, 'Enabled provider is now listed as enabled' );
		$this->assertSame( 'Two_Factor_Totp', Two_Factor_Core::get_primary_provider_for_user( $user->ID )->get_key(), 'Primary is now the only enabled provider' );

		// Enabling one that's already enabled should succeed.
		$totp_enabled = Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
		$this->assertTrue( $totp_enabled, 'Can enable a provider that is already enabled' );

		// Enabling another should succeed, and not change the primary.
		$dummy_enabled     = Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Dummy' );
		$enabled_providers = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertTrue( $dummy_enabled, 'Can enable valid provider' );
		$this->assertSame( array( 'Two_Factor_Totp', 'Two_Factor_Dummy' ), $enabled_providers, 'Multiple can be enabled at the same time' );
		$this->assertSame( 'Two_Factor_Totp', Two_Factor_Core::get_primary_provider_for_user( $user->ID )->get_key(), 'The primary not changed upon additional providers being enabled' );

		// Disabling one that doesn't exist should fail.
		$nonexistent_disabled = Two_Factor_Core::disable_provider_for_user( $user->ID, 'Nonexistent_Provider' );
		$enabled_providers    = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertFalse( $nonexistent_disabled, 'Unavailable provider can\'t be disabled' );
		$this->assertSame( array( 'Two_Factor_Totp', 'Two_Factor_Dummy' ), $enabled_providers, 'Unavailable wasn\'t added to the list of enabled proviers' );
		$this->assertSame( 'Two_Factor_Totp', Two_Factor_Core::get_primary_provider_for_user( $user->ID )->get_key(), 'The primary is still the same after unavailable disable attempt' );

		// Disabling one that's enabled should succeed, and change the primary to the next available one.
		$totp_disabled     = Two_Factor_Core::disable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
		$enabled_providers = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertTrue( $totp_disabled, 'Can disable a provider that is enabled' );
		$this->assertSame( array( 1 => 'Two_Factor_Dummy' ), $enabled_providers, 'The other providers are kept enabled' );
		$this->assertSame( 'Two_Factor_Dummy', Two_Factor_Core::get_primary_provider_for_user( $user->ID )->get_key(), 'Primary is updated to the first available' );
	}

	/**
	 * Ensure that when a user enables two factor, that they are able to continue to change settings.
	 *
	 * @covers Two_Factor_Core::current_user_can_update_two_factor_options()
	 * @covers Two_Factor_Core::user_two_factor_options_update()
	 */
	public function test_enabling_two_factor_is_factored_session() {
		$user = self::factory()->user->create_and_get();

		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Set the cookie without going through two-factor, and fill in $_COOKIE.
		wp_set_current_user( $user->ID );
		wp_set_auth_cookie( $user->ID );

		// Session is not two-factored.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Can view 2FA edit settings.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options() );
		// Can save 2FA settings.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options( 'save' ) );

		$key              = '_nonce_user_two_factor_options';
		$nonce            = wp_create_nonce( 'user_two_factor_options' );
		$_POST[ $key ]    = $nonce;
		$_REQUEST[ $key ] = $nonce;

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' );

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		// Validate that the session is flagged as 2FA, the return value being int.
		$this->assertNotFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		// Validate that the session provider is as expected.
		$this->assertArrayHasKey( 'two-factor-login', $session );
		$this->assertEquals( '', $session['two-factor-provider'] ); // No provider was used for login.
		$this->assertGreaterThan( time() - MINUTE_IN_SECONDS, $session['two-factor-login'] );

		// Can view 2FA edit settings.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options() );
		// Can save 2FA settings.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options( 'save' ) );
	}

	/**
	 * Validate that disabling all providers results in a non-two-factor session.
	 *
	 * @covers Two_Factor_Core::current_user_can_update_two_factor_options()
	 * @covers Two_Factor_Core::user_two_factor_options_update()
	 */
	public function test_disabling_two_factor_is_not_factored_session() {
		$user = self::factory()->user->create_and_get();

		// Setup a 2FA session.
		wp_set_current_user( $user->ID );
		wp_set_auth_cookie( $user->ID );

		$key              = '_nonce_user_two_factor_options';
		$nonce            = wp_create_nonce( 'user_two_factor_options' );
		$_POST[ $key ]    = $nonce;
		$_REQUEST[ $key ] = $nonce;

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' );

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		$this->assertNotFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Disable all providers, and test that the session is invalidated.
		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array();
		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		$session = Two_Factor_Core::get_current_user_session();

		$this->assertArrayNotHasKey( 'two-factor-login', $session );
		$this->assertArrayNotHasKey( 'two-factor-provider', $session );
	}

	/**
	 * Validate that a non-2fa login doesn't set the session two-factor data.
	 *
	 * @covers Two_Factor_Core::is_current_user_session_two_factor()
	 */
	public function test_is_current_user_session_two_factor_without_two_factor() {
		$user = $this->get_dummy_user();

		// Assert no cookies are set.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );
		$this->assertArrayNotHasKey( LOGGED_IN_COOKIE, $_COOKIE );

		// Assert user not logged in is false.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Set the cookie without going through two-factor, and fill in $_COOKIE.
		wp_set_auth_cookie( $user->ID );

		$this->assertNotEmpty( $_COOKIE[ AUTH_COOKIE ] );
		$this->assertNotEmpty( $_COOKIE[ LOGGED_IN_COOKIE ] );

		// Validate that the session is not flagged as 2FA.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		// Validate the Session data is not set.
		$this->assertArrayNotHasKey( 'two-factor-provider', $session );
	}

	/**
	 * Validate that a simulated 2fa login sets the session two-factor data.
	 *
	 * @covers Two_Factor_Core::is_current_user_session_two_factor()
	 * @covers Two_Factor_Core::current_user_can_update_two_factor_options()
	 * @covers Two_Factor_Core::_login_form_validate_2fa()
	 */
	public function test_is_current_user_session_two_factor_with_two_factor() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Assert no cookies are set.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );
		$this->assertArrayNotHasKey( LOGGED_IN_COOKIE, $_COOKIE );

		// Assert user not logged in is false.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Display it.
		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		ob_start();
		Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Dummy', '', false );
		ob_end_clean();

		// Validate that the session is not set, as it wasn't a POST.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		// Process it.
		$redirect_url = $this->do_redirect_callable(
			function () use ( $user, $login_nonce ) {
				Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Dummy', '', true );
			}
		);
		$this->assertNotNull( $redirect_url, 'Expected a redirect after successful 2FA validation.' );

		$this->assertNotEmpty( $_COOKIE[ AUTH_COOKIE ] );
		$this->assertNotEmpty( $_COOKIE[ LOGGED_IN_COOKIE ] );

		// Validate that the session is flagged as 2FA, the return value being int.
		$this->assertNotFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		// Validate that the session provider is as expected.
		$this->assertArrayHasKey( 'two-factor-provider', $session );
		$this->assertEquals( 'Two_Factor_Dummy', $session['two-factor-provider'] );
	}

	/**
	 * Validate that a simulated 2fa revalidation updates the session two-factor data.
	 *
	 * @covers Two_Factor_Core::_login_form_revalidate_2fa()
	 * @covers Two_Factor_Core::current_user_can_update_two_factor_options()
	 */
	public function test_revalidation_sets_time() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Assert no cookies are set.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );
		$this->assertArrayNotHasKey( LOGGED_IN_COOKIE, $_COOKIE );

		// Assert user not logged in is false.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Simulate a 2FA login.

		// Display it.
		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		ob_start();
		Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Dummy', '', false );
		ob_end_clean();

		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		// Process it.
		$redirect_url = $this->do_redirect_callable(
			function () use ( $user, $login_nonce ) {
				Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Dummy', '', true );
			}
		);
		$this->assertNotNull( $redirect_url, 'Expected a redirect after successful 2FA validation.' );

		$this->assertNotEmpty( $_COOKIE[ AUTH_COOKIE ] );
		$this->assertNotEmpty( $_COOKIE[ LOGGED_IN_COOKIE ] );

		// Validate that the session is flagged as 2FA, and now-ish.
		$current_session_two_factor = Two_Factor_Core::is_current_user_session_two_factor();
		$this->assertNotFalse( $current_session_two_factor );
		// Verify that it was set to now.
		$this->assertLessThanOrEqual( time(), $current_session_two_factor );
		$this->assertGreaterThanOrEqual( time() - MINUTE_IN_SECONDS, $current_session_two_factor );

		// Validate that the user can update options.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options() );

		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		// Validate that the session provider is as expected.
		$this->assertArrayHasKey( 'two-factor-provider', $session );
		$this->assertEquals( 'Two_Factor_Dummy', $session['two-factor-provider'] );
		$this->assertEquals( $current_session_two_factor, $session['two-factor-login'] );

		// Set the Session to have started an hour ago.
		$session['two-factor-login'] = time() - HOUR_IN_SECONDS;
		$manager->update( $token, $session );

		// The session should now be "expired" for revalidation.
		$this->assertLessThan( time(), Two_Factor_Core::is_current_user_session_two_factor() );

		// Revalidate.
		// Simulate displaying it.
		ob_start();
		Two_Factor_Core::_login_form_revalidate_2fa( '', 'Two_Factor_Dummy', '', false );
		ob_end_clean();

		// Check it's still expired.
		$this->assertLessThan( time(), Two_Factor_Core::is_current_user_session_two_factor() );

		// Simulate clicking it with an incorrect nonce.
		$bad_nonce        = '__BAD_NONCE__';
		$bad_redirect_url = $this->do_redirect_callable(
			function () use ( $bad_nonce ) {
				Two_Factor_Core::_login_form_revalidate_2fa( $bad_nonce, 'Two_Factor_Dummy', '', true );
			}
		);
		$this->assertNotNull( $bad_redirect_url, 'Expected a redirect after bad-nonce revalidation attempt.' );
		$this->assertEquals( home_url(), $bad_redirect_url, 'Bad-nonce revalidation should redirect to home.' );

		// Check it's still expired.
		$this->assertLessThan( time(), Two_Factor_Core::is_current_user_session_two_factor() );

		// Simulate clicking it.
		$login_nonce = wp_create_nonce( 'two_factor_revalidate_' . $user->ID );

		$good_redirect_url = $this->do_redirect_callable(
			function () use ( $login_nonce ) {
				Two_Factor_Core::_login_form_revalidate_2fa( $login_nonce, 'Two_Factor_Dummy', '', true );
			}
		);
		$this->assertNotNull( $good_redirect_url, 'Expected a redirect after successful revalidation.' );

		// Validate that the session is flagged as 2FA, and set to now-ish.
		$current_session_two_factor = Two_Factor_Core::is_current_user_session_two_factor();
		$this->assertNotFalse( $current_session_two_factor );
		// Verify that it was set to now.
		$this->assertLessThanOrEqual( time(), $current_session_two_factor );
		$this->assertGreaterThanOrEqual( time() - MINUTE_IN_SECONDS, $current_session_two_factor );
	}

	/**
	 * Test current user can update two factor options functionality.
	 *
	 * @covers Two_Factor_Core::current_user_can_update_two_factor_options()
	 */
	public function test_current_user_can_update_two_factor_options() {
		// Logged out.
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Create a user, set a session.
		$user = self::factory()->user->create_and_get();

		wp_set_current_user( $user->ID );
		wp_set_auth_cookie( $user->ID );

		// Logged in, no 2FA setup.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Manually setup 2FA, but not through the User Options API, such that the above session is not-2fa.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Dummy' );

		// Logged in, user has 2FA, session has no 2FA.
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Set the session as 2FA.
		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		$session['two-factor-provider'] = 'Two_Factor_Dummy';
		$session['two-factor-login']    = time();
		$manager->update( $token, $session );

		// Logged in, user has 2FA, session has 2FA "now".
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Set the two factor login time to a minute less than the grace time.
		$session['two-factor-login'] = time() - ( 11 * MINUTE_IN_SECONDS );
		$manager->update( $token, $session );

		// Logged in, user has 2FA, session has 2FA that's longer than the grace period. Can Save, can't Display.
		$this->assertTrue( Two_Factor_Core::current_user_can_update_two_factor_options( 'save' ) );
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options() );

		// Set the two factor login time to a older than the saving grace time.
		$session['two-factor-login'] = time() - ( 30 * MINUTE_IN_SECONDS );
		$manager->update( $token, $session );

		// Logged in, user has 2FA, session has 2FA way past grace period. Can't Save, can't Display.
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options( 'save' ) );
		$this->assertFalse( Two_Factor_Core::current_user_can_update_two_factor_options() );
	}

	/**
	 * Test the fetch & update session methods.
	 *
	 * @covers Two_Factor_Core::get_current_user_session
	 * @covers Two_Factor_Core::update_current_user_session
	 */
	public function test_session_getter_setter() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Fetch the session, it's not yet a thing.
		$session = Two_Factor_Core::get_current_user_session();
		$this->assertFalse( $session );

		// Set the cookie without going through two-factor, and fill in $_COOKIE, for session handler.
		wp_set_auth_cookie( $user->ID );

		// Fetch the session, check it exists.
		$session = Two_Factor_Core::get_current_user_session();
		$this->assertNotEmpty( $session );

		// Check setting keys works.
		$this->assertArrayNotHasKey( 'test-key', $session );

		// Set the key.
		Two_Factor_Core::update_current_user_session(
			array(
				'test-key'     => true,
				'test-key-two' => true,
			)
		);

		// Retrieve the session again, and verify it's updated.
		$session = Two_Factor_Core::get_current_user_session();
		$this->assertNotEmpty( $session );
		$this->assertArrayHasKey( 'test-key', $session );
		$this->assertArrayHasKey( 'test-key-two', $session );

		// Remove the key by setting it to null.
		Two_Factor_Core::update_current_user_session(
			array(
				'test-key' => null,
			)
		);

		// Check the key is no longer there.
		$session = Two_Factor_Core::get_current_user_session();
		$this->assertNotEmpty( $session );
		$this->assertArrayNotHasKey( 'test-key', $session );
		$this->assertArrayHasKey( 'test-key-two', $session );
	}

	/**
	 * Test get_provider_for_user()
	 *
	 * @covers Two_Factor_Core::get_provider_for_user
	 */
	public function test_get_provider_for_user() {
		$other_user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );
		$user       = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Set the cookie without going through two-factor, and fill in $_COOKIE.
		wp_set_auth_cookie( $user->ID );

		// Setup the current session as 2fa'd.
		Two_Factor_Core::update_current_user_session(
			array(
				'two-factor-provider' => 'Two_Factor_Dummy',
				'two-factor-login'    => time(),
			)
		);

		$dummy = Two_Factor_Dummy::get_instance();
		$email = Two_Factor_Email::get_instance();

		// Ensure the provider returned is the primary for the user.
		$this->assertEquals(
			'Two_Factor_Dummy',
			// Using get_class() to verify the actual class, rather than the provider key.
			get_class( Two_Factor_Core::get_provider_for_user( $user ) )
		);

		// Validate that passing a specific provider that's not enabled, returns their primary provider.
		$this->assertSame(
			$dummy,
			Two_Factor_Core::get_provider_for_user( $user, $email )
		);

		// Validate that upon requesting an invalid provider, valid data comes back.
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user, new stdClass() )->get_key()
		);
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user, false )->get_key()
		);
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user, 'Unknown_Provider' )->get_key()
		);

		// Validate that a provider not setup for the user is not returned.
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user, 'Two_Factor_Email' )->get_key()
		);
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user, $email )->get_key()
		);

		// Validate that even when another provider is set as primary, if the user is the current user it returns their last-used.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Email' );
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $user )->get_key()
		);

		// Update the session to say that Email was last-used.
		Two_Factor_Core::update_current_user_session(
			array(
				'two-factor-provider' => $email->get_key(),
			)
		);

		// Validate it's now the default for the current session.
		$this->assertEquals(
			'Two_Factor_Email',
			Two_Factor_Core::get_provider_for_user( $user )->get_key()
		);

		// Ensure that passing a specific provider class in comes back out.
		$this->assertSame(
			$dummy,
			Two_Factor_Core::get_provider_for_user( $user, $dummy )
		);
		$this->assertSame(
			$email,
			Two_Factor_Core::get_provider_for_user( $user, $email )
		);

		// Validate that the current user session doesn't affect fetching it for a different user.
		$this->assertEquals(
			'Two_Factor_Dummy',
			Two_Factor_Core::get_provider_for_user( $other_user )->get_key()
		);
	}

	/**
	 * Test that session information related to Two-Factor sync's to new sessions created in the context of the user.
	 *
	 * @covers Two_Factor_Core::filter_session_information
	 */
	public function test_filter_session_information() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Assert no cookies are set.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );
		$this->assertArrayNotHasKey( LOGGED_IN_COOKIE, $_COOKIE );

		// Assert user not logged in is false.
		$this->assertFalse( Two_Factor_Core::is_current_user_session_two_factor() );

		// Display it.
		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		// Process it.
		$redirect_url = $this->do_redirect_callable(
			function () use ( $user, $login_nonce ) {
				Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Dummy', '', true );
			}
		);
		$this->assertNotNull( $redirect_url, 'Expected a redirect after successful 2FA validation.' );

		$this->assertNotEmpty( $_COOKIE[ AUTH_COOKIE ] );
		$this->assertNotEmpty( $_COOKIE[ LOGGED_IN_COOKIE ] );

		// Boilerplate ends here.

		// Add a custom meta item to the session.
		Two_Factor_Core::update_current_user_session(
			array(
				'two-factor-test-key1' => 'test-value',
				'two-factor-test-key2' => 'test-value',
				'tests-key'            => 'test-value',
			)
		);

		$session = Two_Factor_Core::get_current_user_session();
		$this->assertArrayHasKey( 'two-factor-test-key1', $session );
		$this->assertArrayHasKey( 'two-factor-test-key2', $session );
		$this->assertArrayHasKey( 'tests-key', $session );

		// Create a new user session.
		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = $manager->create( time() + DAY_IN_SECONDS );
		$session = $manager->get( $token );

		$this->assertNotSame( $token, wp_get_session_token() );

		// Validate that the two-factor-* key(s) sync over.
		$this->assertArrayHasKey( 'two-factor-test-key1', $session );
		$this->assertArrayHasKey( 'two-factor-test-key2', $session );
		$this->assertArrayNotHasKey( 'tests-key', $session );

		// Validate that it only applies to new sessions created for this user from this user session.

		// Simulate a new browser session.
		unset( $_COOKIE[ AUTH_COOKIE ], $_COOKIE[ LOGGED_IN_COOKIE ] );
		wp_set_current_user( 0 );

		$this->assertEmpty( wp_get_session_token() );

		$token2  = $manager->create( time() + DAY_IN_SECONDS );
		$session = $manager->get( $token2 );

		$this->assertNotSame( $token, wp_get_session_token() );
		$this->assertNotSame( $token, $token2 );

		$this->assertArrayNotHasKey( 'two-factor-test-key1', $session );
		$this->assertArrayNotHasKey( 'two-factor-test-key2', $session );
		$this->assertArrayNotHasKey( 'tests-key', $session );
	}


	/**
	 * Validate that other sessions are destroyed once Two-Factor is enabled.
	 *
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 */
	public function test_other_sessions_destroyed_when_enabling_2fa() {
		$user_id = self::factory()->user->create(
			array(
				'user_login' => 'username',
				'user_pass'  => 'password',
			)
		);

		$user = new WP_User( $user_id );

		$session_manager = WP_Session_Tokens::get_instance( $user->ID );

		$this->assertCount( 0, $session_manager->get_all(), 'No user sessions are present first' );

		// Generate multiple existing sessions.
		$session_manager->create( time() + HOUR_IN_SECONDS );
		$session_manager->create( time() + DAY_IN_SECONDS );
		$this->assertCount( 2, $session_manager->get_all(), 'Can fetch active sessions' );

		// Shim the cookie... this allows for functions that use sessions to know the current session.
		add_action(
			'set_logged_in_cookie',
			function ( $logged_in_cookie ) {
				$_COOKIE[ LOGGED_IN_COOKIE ] = $logged_in_cookie;
			}
		);

		$user_authenticated = wp_signon(
			array(
				'user_login'    => 'username',
				'user_password' => 'password',
			)
		);
		$this->assertEquals( $user_authenticated, $user, 'User can authenticate' );

		// Enable Two-Factor for the user.
		wp_set_current_user( $user->ID );

		$key              = '_nonce_user_two_factor_options';
		$nonce            = wp_create_nonce( 'user_two_factor_options' );
		$_POST[ $key ]    = $nonce;
		$_REQUEST[ $key ] = $nonce;

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array(
			'Two_Factor_Dummy' => 'Two_Factor_Dummy',
		);

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		// Validate that Two-Factor is now enabled.
		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		// Validate that only the current session still exists.
		$this->assertCount( 1, $session_manager->get_all(), 'All known authentication sessions have been destroyed' );

		// Create another session, activate another provider, verify sessions are still valid.
		$session_manager->create( time() + DAY_IN_SECONDS );
		$this->assertCount( 2, $session_manager->get_all(), 'Failed to create another session' );

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array(
			'Two_Factor_Dummy' => 'Two_Factor_Dummy',
			'Two_Factor_Email' => 'Two_Factor_Email',
		);

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		// Validate that Two-Factor is now enabled with two providers.
		$this->assertCount( 2, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 2, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		$this->assertCount( 2, $session_manager->get_all(), 'Adding an additional provider should not destroy other sessions.' );

		// Disable a provider, verify other sessions are destroyed.
		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array(
			'Two_Factor_Dummy' => 'Two_Factor_Dummy',
		);

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		// Validate that Two-Factor is now enabled with two providers.
		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		$this->assertCount( 1, $session_manager->get_all(), 'All known authentication sessions have been destroyed' );

		// Create another session, deactivate two-factor, verify sessions are still valid.
		$session_manager->create( time() + DAY_IN_SECONDS );
		$this->assertCount( 2, $session_manager->get_all(), 'Failed to create another session' );

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array();

		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		// Validate that Two-Factor is now disabled.
		$this->assertCount( 0, Two_Factor_Core::get_available_providers_for_user( $user->ID ) );
		$this->assertCount( 0, Two_Factor_Core::get_enabled_providers_for_user( $user->ID ) );

		$this->assertCount( 2, $session_manager->get_all(), 'All known authentication sessions have been destroyed' );
	}

	/**
	 * Validate the current users sessions are not modified when modifying another user.
	 *
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 */
	public function test_all_sessions_destroyed_when_enabling_2fa_by_admin() {
		$admin_id = self::factory()->user->create(
			array(
				'role' => 'administrator',
			)
		);
		wp_set_current_user( $admin_id );

		// Create an admin session,.
		$admin_session_manager = WP_Session_Tokens::get_instance( $admin_id );

		$admin_session_manager->create( time() + DAY_IN_SECONDS );
		$this->assertCount( 1, $admin_session_manager->get_all(), 'No admin sessions are present first' );

		// Create the target user.
		$user_id = self::factory()->user->create(
			array(
				'user_login' => 'username',
				'user_pass'  => 'password',
			)
		);

		$session_manager = WP_Session_Tokens::get_instance( $user_id );

		$this->assertCount( 0, $session_manager->get_all(), 'No user sessions are present first' );

		// Generate multiple existing sessions.
		$session_manager->create( time() + DAY_IN_SECONDS );
		$this->assertCount( 1, $session_manager->get_all(), 'Can fetch active sessions' );

		$key              = '_nonce_user_two_factor_options';
		$nonce            = wp_create_nonce( 'user_two_factor_options' );
		$_POST[ $key ]    = $nonce;
		$_REQUEST[ $key ] = $nonce;

		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' );

		Two_Factor_Core::user_two_factor_options_update( $user_id );

		// Validate that Two-Factor is now enabled.
		$this->assertCount( 1, Two_Factor_Core::get_available_providers_for_user( $user_id ) );
		$this->assertCount( 1, Two_Factor_Core::get_enabled_providers_for_user( $user_id ) );

		// Validate the User has no sessions.
		$this->assertCount( 0, $session_manager->get_all(), 'All known authentication sessions have been destroyed' );

		// Validate that the Admin still has a session.
		$this->assertCount( 1, $admin_session_manager->get_all(), 'No admin sessions are present first' );
	}

	/**
	 * Test filtering registered providers for user.
	 */
	public function test_can_filter_registered_providers_for_user() {
		$user      = self::factory()->user->create_and_get();
		$providers = Two_Factor_Core::get_providers();

		$this->assertEquals(
			$providers,
			Two_Factor_Core::get_supported_providers_for_user( $user ),
			'All providers are available by default'
		);

		$this->assertTrue( $providers['Two_Factor_Email']::is_supported_for_user( $user ), 'Email provider is supported by default' );

		add_filter(
			'two_factor_providers_for_user',
			function ( $providers, $user ) {
				$this->assertInstanceOf( WP_User::class, $user, 'A user referenced is passed to the filter' );

				return array_diff_key( $providers, array( 'Two_Factor_Email' => null ) );
			},
			10,
			2
		);

		$this->assertNotContains(
			'Two_Factor_Email',
			Two_Factor_Core::get_supported_providers_for_user( $user ),
			'Email provider can be disabled for a user'
		);

		$this->assertFalse( $providers['Two_Factor_Email']::is_supported_for_user( $user ), 'Email provider is disabled if not supported' );

		remove_all_filters( 'two_factor_providers_for_user' );
	}

	/**
	 * Test disabling default providers.
	 */
	public function test_can_disable_default_providers() {
		$user             = self::factory()->user->create_and_get();
		$providers        = Two_Factor_Core::get_providers();
		$default_provider = current( $providers );

		$this->assertContains( 'Two_Factor_Email', array_keys( $providers ), 'Email provider is enabled by default' );

		$this->assertTrue( $default_provider::is_supported_for_user( $user ), 'Available provider is supported by default' );

		add_filter(
			'two_factor_providers',
			function ( $providers ) {
				return array_diff_key( $providers, array( 'Two_Factor_Email' => null ) );
			}
		);

		$this->assertNotContains( 'Two_Factor_Email', array_keys( Two_Factor_Core::get_providers() ), 'Default provider can be disabled via a filter' );

		$this->assertFalse( $default_provider::is_supported_for_user( $user ), 'Disabled provider is not supported for user' );

		remove_all_filters( 'two_factor_providers' );
	}

	/**
	 * Plugin uninstall removes all user meta.
	 *
	 * @covers Two_Factor_Core::uninstall
	 */
	public function test_uninstall_removes_user_meta() {
		$user = self::factory()->user->create_and_get();

		// Enable a provider for the user.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );

		$this->assertContains(
			'Two_Factor_Totp',
			Two_Factor_Core::get_enabled_providers_for_user( $user->ID ),
			'Sample provider was enabled'
		);

		Two_Factor_Core::uninstall();

		$this->assertNotContains(
			'Two_Factor_Totp',
			Two_Factor_Core::get_enabled_providers_for_user( $user->ID ),
			'Provider was disabled due to uninstall'
		);
	}

	/**
	 * Plugin uninstall removes all user meta even for disabled providers.
	 *
	 * @covers Two_Factor_Core::uninstall
	 */
	public function test_uninstall_removes_disabled_provider_user_meta() {
		$user = self::factory()->user->create_and_get();

		// Enable a provider for the user.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );

		$totp_provider = Two_Factor_Totp::get_instance();

		$totp_provider->set_user_totp_key( $user->ID, 'some_key' );

		$this->assertEquals( 'some_key', $totp_provider->get_user_totp_key( $user->ID ), 'TOTP secret was set for user' );

		add_filter(
			'two_factor_providers',
			function ( $providers ) {
				return array_diff_key( $providers, array( 'Two_Factor_Totp' => null ) );
			}
		);

		$this->assertNotContains(
			'Two_Factor_Totp',
			Two_Factor_Core::get_enabled_providers_for_user( $user->ID ),
			'TOTP provider is disabled for everyone via filter'
		);

		Two_Factor_Core::uninstall();

		$this->assertEmpty( $totp_provider->get_user_totp_key( $user->ID ), 'TOTP secret was deleted during uninstall' );

		remove_all_filters( 'two_factor_providers' );
	}

	/**
	 * Plugin uninstall removes the site-wide enabled providers option.
	 *
	 * @covers Two_Factor_Core::uninstall
	 */
	public function test_uninstall_removes_enabled_providers_option() {
		update_option( Two_Factor_Core::ENABLED_PROVIDERS_OPTION_KEY, array( 'Two_Factor_Email' ) );

		$this->assertSame(
			array( 'Two_Factor_Email' ),
			get_option( Two_Factor_Core::ENABLED_PROVIDERS_OPTION_KEY ),
			'Enabled providers option was set'
		);

		Two_Factor_Core::uninstall();

		$this->assertFalse(
			get_option( Two_Factor_Core::ENABLED_PROVIDERS_OPTION_KEY ),
			'Enabled providers option was deleted during uninstall'
		);
	}

	/**
	 * Test delete_login_nonce removes the nonce.
	 *
	 * @covers Two_Factor_Core::delete_login_nonce
	 */
	public function test_delete_login_nonce() {
		$user_id = self::factory()->user->create();
		$nonce   = Two_Factor_Core::create_login_nonce( $user_id );

		$this->assertNotEmpty( $nonce, 'Login nonce was created' );
		$this->assertNotEmpty( get_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, true ), 'Nonce meta exists' );

		$result = Two_Factor_Core::delete_login_nonce( $user_id );

		$this->assertTrue( $result, 'Nonce was deleted successfully' );
		$this->assertEmpty( get_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, true ), 'Nonce meta was removed' );
	}

	/**
	 * Test get_user_update_action_url generates correct URL.
	 *
	 * @covers Two_Factor_Core::get_user_update_action_url
	 */
	public function test_get_user_update_action_url() {
		$user_id = self::factory()->user->create();
		$action  = 'test_action';

		$url = Two_Factor_Core::get_user_update_action_url( $user_id, $action );

		$this->assertStringContainsString( 'two_factor_action=test_action', $url, 'URL contains action parameter' );
		$this->assertStringContainsString( '_two_factor_action_nonce=', $url, 'URL contains nonce parameter' );
	}

	/**
	 * Test get_user_two_factor_revalidate_url generates correct URL.
	 *
	 * @covers Two_Factor_Core::get_user_two_factor_revalidate_url
	 */
	public function test_get_user_two_factor_revalidate_url() {
		$url = Two_Factor_Core::get_user_two_factor_revalidate_url();

		$this->assertStringContainsString( 'action=revalidate_2fa', $url, 'URL contains revalidate action' );
		$this->assertStringNotContainsString( 'interim-login', $url, 'URL does not contain interim login by default' );

		$url_with_interim = Two_Factor_Core::get_user_two_factor_revalidate_url( true );

		$this->assertStringContainsString( 'interim-login=1', $url_with_interim, 'URL contains interim login when requested' );
	}

	/**
	 * Test is_valid_user_action validates actions correctly.
	 *
	 * @covers Two_Factor_Core::is_valid_user_action
	 */
	public function test_is_valid_user_action() {
		$user_id = self::factory()->user->create();
		$action  = 'test_action';

		// Test without nonce.
		$this->assertFalse( Two_Factor_Core::is_valid_user_action( $user_id, $action ), 'Action is invalid without nonce' );

		// Test with invalid nonce.
		$_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_NONCE_QUERY_ARG ] = 'invalid_nonce';
		$this->assertFalse( Two_Factor_Core::is_valid_user_action( $user_id, $action ), 'Action is invalid with wrong nonce' );

		// Test with valid nonce.
		$nonce = wp_create_nonce( sprintf( '%d-%s', $user_id, $action ) );
		$_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_NONCE_QUERY_ARG ] = $nonce;
		$this->assertNotFalse( Two_Factor_Core::is_valid_user_action( $user_id, $action ), 'Action is valid with correct nonce' );

		// Test with missing user_id.
		$this->assertFalse( Two_Factor_Core::is_valid_user_action( 0, $action ), 'Action is invalid without user ID' );

		// Test with missing action.
		$this->assertFalse( Two_Factor_Core::is_valid_user_action( $user_id, '' ), 'Action is invalid without action name' );

		// Cleanup.
		unset( $_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_NONCE_QUERY_ARG ] );
	}

	/**
	 * Test current_user_being_edited returns correct user ID.
	 *
	 * @covers Two_Factor_Core::current_user_being_edited
	 */
	public function test_current_user_being_edited() {
		$user_id = self::factory()->user->create();
		wp_set_current_user( $user_id );

		// Test without user_id in request.
		$this->assertEquals( $user_id, Two_Factor_Core::current_user_being_edited(), 'Returns current user ID when no user_id in request' );

		// Test with user_id in request for current user.
		$_REQUEST['user_id'] = $user_id;
		$this->assertEquals( $user_id, Two_Factor_Core::current_user_being_edited(), 'Returns user ID from request when editing self' );

		// Test with admin editing another user.
		$admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
		wp_set_current_user( $admin_id );
		$_REQUEST['user_id'] = $user_id;

		$this->assertEquals( $user_id, Two_Factor_Core::current_user_being_edited(), 'Returns user ID from request when admin edits user' );

		// Test with non-admin trying to edit another user.
		$other_user = self::factory()->user->create();
		wp_set_current_user( $other_user );
		$_REQUEST['user_id'] = $user_id;

		$this->assertEquals( $other_user, Two_Factor_Core::current_user_being_edited(), 'Returns current user ID when user lacks edit permission' );

		// Cleanup.
		unset( $_REQUEST['user_id'] );
	}

	/**
	 * Test trigger_user_settings_action triggers action hook.
	 *
	 * @covers Two_Factor_Core::trigger_user_settings_action
	 */
	public function test_trigger_user_settings_action() {
		$user_id = self::factory()->user->create();
		wp_set_current_user( $user_id );

		$action        = 'test_action';
		$action_fired  = false;
		$received_args = array();

		// Add a test hook.
		$test_callback = function ( $uid, $act ) use ( &$action_fired, &$received_args ) {
			$action_fired  = true;
			$received_args = array( $uid, $act );
		};
		add_action( 'two_factor_user_settings_action', $test_callback, 10, 2 );

		// Test without valid nonce.
		Two_Factor_Core::trigger_user_settings_action();
		$this->assertFalse( $action_fired, 'Action does not fire without valid nonce' );

		// Set up valid action and nonce.
		$_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_QUERY_VAR ] = $action;
		$nonce = wp_create_nonce( sprintf( '%d-%s', $user_id, $action ) );
		$_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_NONCE_QUERY_ARG ] = $nonce;

		// Trigger the action.
		Two_Factor_Core::trigger_user_settings_action();

		$this->assertTrue( $action_fired, 'Action fires with valid nonce' );
		$this->assertEquals( $user_id, $received_args[0], 'Action receives correct user ID' );
		$this->assertEquals( $action, $received_args[1], 'Action receives correct action name' );

		// Cleanup.
		remove_action( 'two_factor_user_settings_action', $test_callback, 10 );
		unset( $_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_QUERY_VAR ] );
		unset( $_REQUEST[ Two_Factor_Core::USER_SETTINGS_ACTION_NONCE_QUERY_ARG ] );
	}

	/**
	 * Test get_primary_provider_for_user with multiple providers.
	 *
	 * @covers Two_Factor_Core::get_primary_provider_for_user
	 */
	public function test_get_primary_provider_for_user_with_multiple_providers() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Enable TOTP as well.
		$totp = Two_Factor_Totp::get_instance();
		$totp->set_user_totp_key( $user->ID, 'test_key' );
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );

		// Get the initial primary provider.
		$primary = Two_Factor_Core::get_primary_provider_for_user( $user->ID );
		$this->assertNotNull( $primary, 'Primary provider exists when multiple are enabled' );
		$initial_primary_key = $primary->get_key();
		$this->assertContains( $initial_primary_key, array( 'Two_Factor_Dummy', 'Two_Factor_Totp' ), 'Primary is one of enabled providers' );

		// Set Dummy as primary explicitly.
		update_user_meta( $user->ID, Two_Factor_Core::PROVIDER_USER_META_KEY, 'Two_Factor_Dummy' );
		$primary = Two_Factor_Core::get_primary_provider_for_user( $user->ID );
		$this->assertEquals( 'Two_Factor_Dummy', $primary->get_key(), 'Primary provider can be set to Dummy' );

		// Set TOTP as primary.
		update_user_meta( $user->ID, Two_Factor_Core::PROVIDER_USER_META_KEY, 'Two_Factor_Totp' );
		$primary = Two_Factor_Core::get_primary_provider_for_user( $user->ID );
		$this->assertEquals( 'Two_Factor_Totp', $primary->get_key(), 'Primary provider can be changed to TOTP' );

		// Disable TOTP, should fall back to Dummy.
		Two_Factor_Core::disable_provider_for_user( $user->ID, 'Two_Factor_Totp' );
		$primary = Two_Factor_Core::get_primary_provider_for_user( $user->ID );
		$this->assertEquals( 'Two_Factor_Dummy', $primary->get_key(), 'Primary falls back when selected provider is disabled' );

		$this->clean_dummy_user();
	}

	/**
	 * Test get_primary_provider_for_user with filter.
	 *
	 * @covers Two_Factor_Core::get_primary_provider_for_user
	 */
	public function test_get_primary_provider_for_user_with_filter() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Enable Email provider as well.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Email' );

		// Add filter to force Email as primary.
		add_filter(
			'two_factor_primary_provider_for_user',
			function ( $provider, $user_id ) use ( $user ) {
				if ( $user_id === $user->ID ) {
					return 'Two_Factor_Email';
				}
				return $provider;
			},
			10,
			2
		);

		$primary = Two_Factor_Core::get_primary_provider_for_user( $user->ID );
		$this->assertEquals( 'Two_Factor_Email', $primary->get_key(), 'Filter can override primary provider' );

		remove_all_filters( 'two_factor_primary_provider_for_user' );
		$this->clean_dummy_user();
	}

	/**
	 * Test show_two_factor_login displays login form.
	 *
	 * @covers Two_Factor_Core::show_two_factor_login
	 */
	public function test_show_two_factor_login() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		// Test with user parameter.
		ob_start();
		Two_Factor_Core::show_two_factor_login( $user );
		$output = ob_get_clean();

		$this->assertStringContainsString( 'wp-login.php', $output, 'Output contains login form action' );
		$this->assertStringContainsString( 'validate_2fa_form', $output, 'Output contains two-factor form' );
		$this->assertStringContainsString( 'wp-auth-nonce', $output, 'Output contains auth nonce field' );

		// Test without user parameter (uses current user).
		wp_set_current_user( $user->ID );
		ob_start();
		Two_Factor_Core::show_two_factor_login( null );
		$output = ob_get_clean();

		$this->assertStringContainsString( 'wp-login.php', $output, 'Output contains login form with current user' );
		$this->assertStringContainsString( 'validate_2fa_form', $output, 'Output contains two-factor form for current user' );

		$this->clean_dummy_user();
	}

	/**
	 * Test get_supported_providers_for_user.
	 *
	 * @covers Two_Factor_Core::get_supported_providers_for_user
	 */
	public function test_get_supported_providers_for_user() {
		$user      = self::factory()->user->create_and_get();
		$providers = Two_Factor_Core::get_supported_providers_for_user( $user );

		$this->assertIsArray( $providers, 'Returns an array of providers' );
		$this->assertArrayHasKey( 'Two_Factor_Email', $providers, 'Email provider is supported by default' );
		$this->assertArrayHasKey( 'Two_Factor_Totp', $providers, 'TOTP provider is supported by default' );
	}

	/**
	 * Test user_two_factor_options output when backup codes are available.
	 *
	 * @covers Two_Factor_Core::user_two_factor_options
	 */
	public function test_user_two_factor_options_mentions_recovery_codes_when_backup_codes_are_available() {
		$user = self::factory()->user->create_and_get();

		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Email' );

		try {
			$output = $this->render_user_two_factor_options( $user );

			$this->assertStringContainsString(
				'consider enabling a backup method like Recovery Codes',
				$output
			);
			$this->assertStringContainsString(
				'Configure a primary two-factor method along with a backup method, such as Recovery Codes',
				$output
			);
			$this->assertStringNotContainsString(
				'consider enabling an additional two-factor method',
				$output
			);
		} finally {
			$this->reset_profile_errors();
		}
	}

	/**
	 * Test user_two_factor_options output when backup codes are filtered out.
	 *
	 * @covers Two_Factor_Core::user_two_factor_options
	 */
	public function test_user_two_factor_options_uses_generic_wording_when_backup_codes_are_filtered_out() {
		$filter = static function ( $providers ) {
			unset( $providers['Two_Factor_Backup_Codes'] );
			return $providers;
		};

		add_filter( 'two_factor_providers', $filter );

		try {
			$user = self::factory()->user->create_and_get();

			Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Email' );

			$output = $this->render_user_two_factor_options( $user );

			$this->assertStringContainsString(
				'consider enabling an additional two-factor method',
				$output
			);
			$this->assertStringContainsString(
				'Configure a primary two-factor method along with an additional two-factor method',
				$output
			);
			$this->assertStringNotContainsString( 'Recovery Codes', $output );
		} finally {
			remove_filter( 'two_factor_providers', $filter );
			$this->reset_profile_errors();
		}
	}

	/**
	 * Test is_user_using_two_factor with enabled provider.
	 *
	 * @covers Two_Factor_Core::is_user_using_two_factor
	 */
	public function test_is_user_using_two_factor_with_enabled_provider() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		$this->assertTrue( Two_Factor_Core::is_user_using_two_factor( $user->ID ), 'User with enabled provider is using two factor' );

		wp_set_current_user( $user->ID );
		$this->assertTrue( Two_Factor_Core::is_user_using_two_factor(), 'Current user with enabled provider is using two factor' );

		$this->clean_dummy_user();
	}

	/**
	 * Test user_two_factor_options_update with invalid nonce.
	 *
	 * @covers Two_Factor_Core::user_two_factor_options_update
	 */
	public function test_user_two_factor_options_update_with_invalid_nonce() {
		$user = self::factory()->user->create_and_get();
		wp_set_current_user( $user->ID );

		// Do NOT set nonce — the function skips the update block entirely when nonce is absent.
		$_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] = array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' );

		// Should not enable provider without a valid nonce.
		Two_Factor_Core::user_two_factor_options_update( $user->ID );

		$providers = Two_Factor_Core::get_enabled_providers_for_user( $user->ID );
		$this->assertEmpty( $providers, 'Providers not enabled without a valid nonce' );

		// Cleanup.
		unset( $_POST[ Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY ] );
	}

	/**
	 * Test collect_auth_cookie_tokens stores tokens correctly.
	 *
	 * @covers Two_Factor_Core::collect_auth_cookie_tokens
	 */
	public function test_collect_auth_cookie_tokens() {
		$user_id = self::factory()->user->create(
			array(
				'user_login' => 'testuser',
				'user_pass'  => 'password123',
			)
		);

		// Reset the private static before the test to ensure a clean baseline,
		// but capture the original value so it can be restored afterward.
		$reflection = new ReflectionClass( Two_Factor_Core::class );
		$prop       = $reflection->getProperty( 'password_auth_tokens' );
		$prop->setAccessible( true );
		$original_tokens = $prop->getValue( null );

		try {
			$prop->setValue( null, array() );

			// Authenticate user — this fires set_auth_cookie / set_logged_in_cookie,
			// which call collect_auth_cookie_tokens() via hook.
			$authenticated = wp_signon(
				array(
					'user_login'    => 'testuser',
					'user_password' => 'password123',
				)
			);

			$this->assertSame( $user_id, $authenticated->ID, 'Correct user authenticated' );

			// Verify collect_auth_cookie_tokens() actually stored at least one token.
			$tokens = $prop->getValue( null );
			$this->assertNotEmpty( $tokens, 'collect_auth_cookie_tokens stored at least one token' );

			// Cleanup.
			WP_Session_Tokens::get_instance( $user_id )->destroy_all();
		} finally {
			// Restore original static state to avoid leaking into other tests.
			$prop->setValue( null, $original_tokens );
		}
	}

	/**
	 * Test get_available_providers_for_user with configured providers.
	 *
	 * @covers Two_Factor_Core::get_available_providers_for_user
	 */
	public function test_get_available_providers_for_user_with_configured_providers() {
		$user = self::factory()->user->create_and_get();

		// Initially no providers.
		$this->assertEmpty( Two_Factor_Core::get_available_providers_for_user( $user->ID ), 'No providers available initially' );

		// Enable TOTP and configure it.
		$totp = Two_Factor_Totp::get_instance();
		$totp->set_user_totp_key( $user->ID, 'test_key' );
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Totp' );

		$available = Two_Factor_Core::get_available_providers_for_user( $user->ID );
		$this->assertCount( 1, $available, 'One provider is available when configured' );
		$this->assertArrayHasKey( 'Two_Factor_Totp', $available, 'TOTP provider is available' );

		// Enable Dummy (always available).
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Dummy' );
		$available = Two_Factor_Core::get_available_providers_for_user( $user->ID );
		$this->assertCount( 2, $available, 'Two providers are available' );
	}

	/**
	 * Verify process_provider() returns WP_Error when no provider is given.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_with_null_provider() {
		$user   = self::factory()->user->create_and_get();
		$result = Two_Factor_Core::process_provider( null, $user, true );

		$this->assertInstanceOf( WP_Error::class, $result );
		$this->assertSame( 'two_factor_provider_missing', $result->get_error_code() );
	}

	/**
	 * Verify process_provider() returns false when pre-processing signals a re-send.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_returns_false_when_pre_process_returns_true() {
		$user     = self::factory()->user->create_and_get();
		$provider = Two_Factor_Email::get_instance();

		// Simulate a "resend code" request – triggers pre_process_authentication() to return true.
		$_REQUEST[ Two_Factor_Email::INPUT_NAME_RESEND_CODE ] = '1';
		$result = Two_Factor_Core::process_provider( $provider, $user, true );
		unset( $_REQUEST[ Two_Factor_Email::INPUT_NAME_RESEND_CODE ] );

		$this->assertFalse( $result );
	}

	/**
	 * Verify process_provider() returns false on a GET (non-POST) request.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_not_post_request() {
		$user     = self::factory()->user->create_and_get();
		$provider = Two_Factor_Dummy::get_instance();

		$result = Two_Factor_Core::process_provider( $provider, $user, false );

		$this->assertFalse( $result );
	}

	/**
	 * Verify process_provider() returns WP_Error when the user is rate-limited.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_rate_limited() {
		$user     = self::factory()->user->create_and_get();
		$provider = Two_Factor_Dummy::get_instance();

		update_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, 1 );
		update_user_meta( $user->ID, Two_Factor_Core::USER_RATE_LIMIT_KEY, time() );

		$result = Two_Factor_Core::process_provider( $provider, $user, true );

		$this->assertInstanceOf( WP_Error::class, $result );
		$this->assertSame( 'two_factor_too_fast', $result->get_error_code() );
	}

	/**
	 * Verify process_provider() returns WP_Error and increments the failed-attempts
	 * counter when authentication fails.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_invalid_authentication() {
		$user     = self::factory()->user->create_and_get();
		$provider = Two_Factor_Email::get_instance();

		// No code submitted in POST → validate_authentication() returns false.
		$result = Two_Factor_Core::process_provider( $provider, $user, true );

		$this->assertInstanceOf( WP_Error::class, $result );
		$this->assertSame( 'two_factor_invalid', $result->get_error_code() );
		$this->assertEquals( 1, (int) get_user_meta( $user->ID, Two_Factor_Core::USER_FAILED_LOGIN_ATTEMPTS_KEY, true ) );
	}

	/**
	 * Verify process_provider() returns true when authentication succeeds.
	 *
	 * @covers Two_Factor_Core::process_provider
	 */
	public function test_process_provider_successful_authentication() {
		$user     = self::factory()->user->create_and_get();
		$provider = Two_Factor_Dummy::get_instance();

		$result = Two_Factor_Core::process_provider( $provider, $user, true );

		$this->assertTrue( $result );
	}

	/**
	 * Verify _login_form_validate_2fa() renders the login form and creates a new
	 * nonce when the provider fails authentication.
	 *
	 * @covers Two_Factor_Core::_login_form_validate_2fa
	 */
	public function test_login_form_validate_2fa_provider_failure() {
		$user = self::factory()->user->create_and_get();
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Email' );

		$login_nonce = Two_Factor_Core::create_login_nonce( $user->ID );
		$this->assertNotFalse( $login_nonce );

		// POST request but no email code supplied → provider fails.
		ob_start();
		Two_Factor_Core::_login_form_validate_2fa( $user, $login_nonce['key'], 'Two_Factor_Email', '', true );
		ob_end_clean();

		// Authentication did not succeed – no auth cookie should be set.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );

		// A new login nonce should have been created for the retry form.
		$stored_nonce = get_user_meta( $user->ID, Two_Factor_Core::USER_META_NONCE_KEY, true );
		$this->assertNotEmpty( $stored_nonce );
	}

	/**
	 * Verify that rest_api_can_edit_user_and_update_two_factor_options() returns
	 * false when the current user cannot edit the target user.
	 *
	 * @covers Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options
	 */
	public function test_rest_api_can_edit_user_no_capability() {
		$subscriber = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) );
		$other_user = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) );

		wp_set_current_user( $subscriber->ID );

		$result = Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options( $other_user->ID );

		$this->assertFalse( $result );
	}

	/**
	 * Verify that rest_api_can_edit_user_and_update_two_factor_options() returns
	 * WP_Error when revalidation is required.
	 *
	 * @covers Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options
	 */
	public function test_rest_api_can_edit_user_revalidation_required() {
		$user = self::factory()->user->create_and_get();
		wp_set_current_user( $user->ID );
		wp_set_auth_cookie( $user->ID );

		// Enable 2FA, but the session carries no two-factor metadata →
		// current_user_can_update_two_factor_options( 'save' ) returns false.
		Two_Factor_Core::enable_provider_for_user( $user->ID, 'Two_Factor_Dummy' );

		$result = Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options( $user->ID );

		$this->assertInstanceOf( WP_Error::class, $result );
		$this->assertSame( 'revalidation_required', $result->get_error_code() );
	}

	/**
	 * Verify that rest_api_can_edit_user_and_update_two_factor_options() applies
	 * the two_factor_rest_api_can_edit_user filter when permissions are satisfied.
	 *
	 * @covers Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options
	 */
	public function test_rest_api_can_edit_user_filter_overrides() {
		$user = self::factory()->user->create_and_get();
		wp_set_current_user( $user->ID );
		wp_set_auth_cookie( $user->ID );

		// Set up a valid 2FA session so save-context passes.
		$manager = WP_Session_Tokens::get_instance( $user->ID );
		$token   = wp_get_session_token();
		$session = $manager->get( $token );

		$session['two-factor-provider'] = 'Two_Factor_Dummy';
		$session['two-factor-login']    = time();
		$manager->update( $token, $session );

		// Filter should receive (true, $user_id) and its return value used.
		$filter_received_user_id = null;
		$filter                  = function ( $can, $user_id ) use ( &$filter_received_user_id ) {
			$filter_received_user_id = $user_id;
			return false;
		};
		add_filter( 'two_factor_rest_api_can_edit_user', $filter, 10, 2 );

		$result = Two_Factor_Core::rest_api_can_edit_user_and_update_two_factor_options( $user->ID );

		remove_filter( 'two_factor_rest_api_can_edit_user', $filter, 10 );

		$this->assertFalse( $result, 'Filter return value overrides default' );
		$this->assertSame( $user->ID, $filter_received_user_id, 'Filter receives correct user ID' );
	}

	/**
	 * Verify filter_manage_users_columns() adds the two-factor column.
	 *
	 * @covers Two_Factor_Core::filter_manage_users_columns
	 */
	public function test_filter_manage_users_columns() {
		$columns = array(
			'username' => 'Username',
			'email'    => 'Email',
		);

		$result = Two_Factor_Core::filter_manage_users_columns( $columns );

		$this->assertArrayHasKey( 'two-factor', $result );
		// Existing columns must be preserved.
		$this->assertSame( 'Username', $result['username'] );
	}

	/**
	 * Verify manage_users_custom_column() returns the original output for
	 * columns other than 'two-factor'.
	 *
	 * @covers Two_Factor_Core::manage_users_custom_column
	 */
	public function test_manage_users_custom_column_wrong_column() {
		$result = Two_Factor_Core::manage_users_custom_column( 'original_output', 'username', 1 );

		$this->assertSame( 'original_output', $result );
	}

	/**
	 * Verify manage_users_custom_column() returns a "Disabled" indicator for
	 * users who have not enabled two-factor.
	 *
	 * @covers Two_Factor_Core::manage_users_custom_column
	 */
	public function test_manage_users_custom_column_disabled() {
		$user = self::factory()->user->create_and_get();

		$result = Two_Factor_Core::manage_users_custom_column( '', 'two-factor', $user->ID );

		$this->assertStringContainsString( 'Disabled', $result );
	}

	/**
	 * Verify manage_users_custom_column() returns the provider label for users
	 * who have two-factor enabled.
	 *
	 * @covers Two_Factor_Core::manage_users_custom_column
	 */
	public function test_manage_users_custom_column_enabled() {
		$user = $this->get_dummy_user( array( 'Two_Factor_Dummy' => 'Two_Factor_Dummy' ) );

		$result = Two_Factor_Core::manage_users_custom_column( '', 'two-factor', $user->ID );

		$this->assertSame( Two_Factor_Dummy::get_instance()->get_label(), $result );

		$this->clean_dummy_user();
	}

	/**
	 * Verify wp_login() returns early without side-effects for users who have
	 * not enabled two-factor authentication.
	 *
	 * @covers Two_Factor_Core::wp_login
	 */
	public function test_wp_login_non_two_factor_user() {
		$user = self::factory()->user->create_and_get();
		// No 2FA providers enabled – is_user_using_two_factor() returns false.

		// Should return without touching auth cookies or destroying sessions.
		Two_Factor_Core::wp_login( $user->user_login, $user );

		// No auth cookie set by wp_login for a non-2FA user.
		$this->assertArrayNotHasKey( AUTH_COOKIE, $_COOKIE );
	}

	/**
	 * Verify add_settings_action_link() prepends a settings link.
	 *
	 * @covers Two_Factor_Core::add_settings_action_link
	 */
	public function test_add_settings_action_link() {
		$old_user_id = get_current_user_id();
		$admin       = self::factory()->user->create_and_get( array( 'role' => 'administrator' ) );
		wp_set_current_user( $admin->ID );

		$links  = array( 'deactivate' => '<a href="#">Deactivate</a>' );
		$result = Two_Factor_Core::add_settings_action_link( $links );

		wp_set_current_user( $old_user_id );

		// Settings link should be first.
		$this->assertCount( 3, $result );
		$first = reset( $result );
		$this->assertStringContainsString( '<a', $first );
		$this->assertStringContainsString( 'Settings', $first );
		$this->assertStringContainsString( 'options-general.php', $first );
	}
}