deploy/docker-compose-e2e-2fa.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Overlay for the two-factor authentication suite.
#
#   docker compose -f deploy/docker-compose-e2e.yml -f deploy/docker-compose-e2e-2fa.yml up -d
#
# Two things the ordinary stack does not have:
#
#   * `FINERACT_SECURITY_2FA_ENABLED`, without which Fineract does not register the
#     `/v1/twofactor/**` controllers at all and every one of them answers 404. It is a
#     process-wide switch, which is why this is a separate stack rather than a per-test toggle —
#     with it on, every other endpoint answers 403 until a one-time token has been validated, so
#     the ordinary suite cannot run against it.
#
#   * A mail catcher. The one-time token is delivered by email and nothing is persisted before
#     the send, so a failed send leaves nothing to read: `POST /v1/twofactor` answers 500 and no
#     row appears in `twofactor_access_token`. The test reads the token out of Mailpit's API,
#     which is the only way to obtain it without a real mailbox.
services:
  mailpit:
    image: axllent/mailpit:v1.21
    container_name: fineract-mailpit
    restart: unless-stopped
    ports:
      # 1025 SMTP (reached by the backend over the compose network), 8025 the HTTP API the
      # test reads from.
      - '8025:8025'
    environment:
      - MP_SMTP_AUTH_ACCEPT_ANY=true
      - MP_SMTP_AUTH_ALLOW_INSECURE=true

  fineract-backend:
    environment:
      - FINERACT_SECURITY_2FA_ENABLED=true