rubygems-update 3.3.18 → 3.4.19

data/test/rubygems/test_gem_commands_list_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/list_command'
+
+require_relative "helper"
+require "rubygems/commands/list_command"
 
 class TestGemCommandsListCommand < Gem::TestCase
   def setup
@@ -9,7 +10,7 @@ class TestGemCommandsListCommand < Gem::TestCase
     @cmd = Gem::Commands::ListCommand.new
 
     spec_fetcher do |fetcher|
-      fetcher.spec 'c', 1
+      fetcher.spec "c", 1
     end
 
     @fetcher.data["#{@gem_repo}Marshal.#{Gem.marshal_version}"] = proc do
@@ -27,6 +28,6 @@ class TestGemCommandsListCommand < Gem::TestCase
     end
 
     assert_equal "true\n", @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 end

data/test/rubygems/test_gem_commands_lock_command.rb

@@ -1,18 +1,19 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/lock_command'
+
+require_relative "helper"
+require "rubygems/commands/lock_command"
 
 class TestGemCommandsLockCommand < Gem::TestCase
   def setup
     super
 
-    @a1 = quick_gem 'a', '1'
-    @b1 = quick_gem 'b', '1' do |s|
-      s.add_runtime_dependency 'a'
+    @a1 = quick_gem "a", "1"
+    @b1 = quick_gem "b", "1" do |s|
+      s.add_runtime_dependency "a"
     end
 
-    @d1 = quick_gem 'd', '1' do |s|
-      s.add_runtime_dependency 'z'
+    @d1 = quick_gem "d", "1" do |s|
+      s.add_runtime_dependency "z"
     end
 
     @cmd = Gem::Commands::LockCommand.new
@@ -32,7 +33,7 @@ gem 'a', '= 1'
     EXPECTED
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_missing_dependency
@@ -49,7 +50,7 @@ gem 'd', '= 1'
     EXPECTED
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_strict
@@ -61,6 +62,6 @@ gem 'd', '= 1'
       end
     end
 
-    assert_equal 'Could not find gem c-1, try using the full name', e.message
+    assert_equal "Could not find gem c-1, try using the full name", e.message
   end
 end

data/test/rubygems/test_gem_commands_mirror.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/mirror_command'
+
+require_relative "helper"
+require "rubygems/commands/mirror_command"
 
 class TestGemCommandsMirrorCommand < Gem::TestCase
   def setup

data/test/rubygems/test_gem_commands_open_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/open_command'
+
+require_relative "helper"
+require "rubygems/commands/open_command"
 
 class TestGemCommandsOpenCommand < Gem::TestCase
   def setup
@@ -23,8 +24,8 @@ class TestGemCommandsOpenCommand < Gem::TestCase
     @cmd.options[:args] = %w[foo]
     @cmd.options[:editor] = "#{ruby_with_rubygems_in_load_path} -eexit --"
 
-    gem 'foo', '1.0.0'
-    spec = gem 'foo', '1.0.1'
+    gem "foo", "1.0.0"
+    spec = gem "foo", "1.0.1"
 
     assert_nothing_raised Gem::MockGemUi::TermError do
       Dir.stub(:chdir, spec.full_gem_path) do

data/test/rubygems/test_gem_commands_outdated_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/outdated_command'
+
+require_relative "helper"
+require "rubygems/commands/outdated_command"
 
 class TestGemCommandsOutdatedCommand < Gem::TestCase
   def setup
@@ -15,10 +16,10 @@ class TestGemCommandsOutdatedCommand < Gem::TestCase
 
   def test_execute
     spec_fetcher do |fetcher|
-      fetcher.download 'foo', '1.0'
-      fetcher.download 'foo', '2.0'
-      fetcher.gem 'foo', '0.1'
-      fetcher.gem 'foo', '0.2'
+      fetcher.download "foo", "1.0"
+      fetcher.download "foo", "2.0"
+      fetcher.gem "foo", "0.1"
+      fetcher.gem "foo", "0.2"
     end
 
     use_ui @ui do
@@ -31,10 +32,10 @@ class TestGemCommandsOutdatedCommand < Gem::TestCase
 
   def test_execute_with_up_to_date_platform_specific_gem
     spec_fetcher do |fetcher|
-      fetcher.download 'foo', '2.0'
+      fetcher.download "foo", "2.0"
 
-      fetcher.gem 'foo', '1.0'
-      fetcher.gem 'foo', '2.0' do |s|
+      fetcher.gem "foo", "1.0"
+      fetcher.gem "foo", "2.0" do |s|
         s.platform = Gem::Platform.local
       end
     end

data/test/rubygems/test_gem_commands_owner_command.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
-require_relative 'helper'
-require 'rubygems/commands/owner_command'
+
+require_relative "helper"
+require_relative "multifactor_auth_utilities"
+require "rubygems/commands/owner_command"
 
 class TestGemCommandsOwnerCommand < Gem::TestCase
   def setup
@@ -10,7 +12,7 @@ class TestGemCommandsOwnerCommand < Gem::TestCase
 
     ENV["RUBYGEMS_HOST"] = nil
     @stub_ui = Gem::MockGemUi.new
-    @stub_fetcher = Gem::FakeFetcher.new
+    @stub_fetcher = Gem::MultifactorAuthFetcher.new
     Gem::RemoteFetcher.fetcher = @stub_fetcher
     Gem.configuration = nil
     Gem.configuration.rubygems_api_key = "ed244fbf2b1a52e012da8616c512fa47f9aa5250"
@@ -36,7 +38,7 @@ class TestGemCommandsOwnerCommand < Gem::TestCase
 - id: 4
 EOF
 
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     use_ui @stub_ui do
       @cmd.show_owners("freewill")
@@ -66,7 +68,7 @@ EOF
 - id: 4
 EOF
 
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     assert_raise Psych::DisallowedClass do
       use_ui @ui do
@@ -80,7 +82,7 @@ EOF
     host = "http://rubygems.example"
     ENV["RUBYGEMS_HOST"] = host
 
-    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     use_ui @stub_ui do
       @cmd.show_owners("freewill")
@@ -95,7 +97,7 @@ EOF
     host = "http://rubygems.example"
     @cmd.host = host
 
-    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     use_ui @stub_ui do
       @cmd.show_owners("freewill")
@@ -107,7 +109,7 @@ EOF
 
   def test_show_owners_denied
     response = "You don't have permission to push to this gem"
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 403, 'Forbidden']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 403, msg: "Forbidden")
 
     assert_raise Gem::MockGemUi::TermError do
       use_ui @stub_ui do
@@ -118,23 +120,46 @@ EOF
     assert_match response, @stub_ui.output
   end
 
+  def test_show_owners_permanent_redirect
+    host = "http://rubygems.example"
+    ENV["RUBYGEMS_HOST"] = host
+    path = "/api/v1/gems/freewill/owners.yaml"
+    redirected_uri = "https://rubygems.example#{path}"
+
+    @stub_fetcher.data["#{host}#{path}"] = HTTPResponseFactory.create(
+      body: "",
+      code: "301",
+      msg: "Moved Permanently",
+      headers: { "location" => redirected_uri }
+    )
+
+    assert_raise Gem::MockGemUi::TermError do
+      use_ui @stub_ui do
+        @cmd.show_owners("freewill")
+      end
+    end
+
+    response = "The request has redirected permanently to #{redirected_uri}. Please check your defined push host URL."
+    assert_match response, @stub_ui.output
+  end
+
   def test_show_owners_key
     response = "- email: user1@example.com\n"
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
-    File.open Gem.configuration.credentials_path, 'a' do |f|
-      f.write ':other: 701229f217cdf23b1344c7b4b54ca97'
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
+    File.open Gem.configuration.credentials_path, "a" do |f|
+      f.write ":other: 701229f217cdf23b1344c7b4b54ca97"
     end
     Gem.configuration.load_api_keys
 
     @cmd.handle_options %w[-k other]
-    @cmd.show_owners('freewill')
+    @cmd.show_owners("freewill")
 
-    assert_equal '701229f217cdf23b1344c7b4b54ca97', @stub_fetcher.last_request['Authorization']
+    assert_equal "701229f217cdf23b1344c7b4b54ca97", @stub_fetcher.last_request["Authorization"]
   end
 
   def test_add_owners
     response = "Owner added successfully."
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     use_ui @stub_ui do
       @cmd.add_owners("freewill", ["user-new1@example.com"])
@@ -149,7 +174,7 @@ EOF
 
   def test_add_owners_denied
     response = "You don't have permission to push to this gem"
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 403, 'Forbidden']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 403, msg: "Forbidden")
 
     use_ui @stub_ui do
       @cmd.add_owners("freewill", ["user-new1@example.com"])
@@ -158,12 +183,33 @@ EOF
     assert_match response, @stub_ui.output
   end
 
+  def test_add_owners_permanent_redirect
+    host = "http://rubygems.example"
+    ENV["RUBYGEMS_HOST"] = host
+    path = "/api/v1/gems/freewill/owners"
+    redirected_uri = "https://rubygems.example#{path}"
+
+    @stub_fetcher.data["#{host}#{path}"] = HTTPResponseFactory.create(
+      body: "",
+      code: "308",
+      msg: "Permanent Redirect",
+      headers: { "location" => redirected_uri }
+    )
+
+    use_ui @stub_ui do
+      @cmd.add_owners("freewill", ["user-new1@example.com"])
+    end
+
+    response = "The request has redirected permanently to #{redirected_uri}. Please check your defined push host URL."
+    assert_match response, @stub_ui.output
+  end
+
   def test_add_owner_with_host_option_through_execute
     host = "http://rubygems.example"
     add_owner_response = "Owner added successfully."
     show_owners_response = "- email: user1@example.com\n"
-    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners"] = [add_owner_response, 200, 'OK']
-    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = [show_owners_response, 200, 'OK']
+    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: add_owner_response, code: 200, msg: "OK")
+    @stub_fetcher.data["#{host}/api/v1/gems/freewill/owners.yaml"] = HTTPResponseFactory.create(body: show_owners_response, code: 200, msg: "OK")
 
     @cmd.handle_options %W[--host #{host} --add user-new1@example.com freewill]
 
@@ -178,21 +224,21 @@ EOF
 
   def test_add_owners_key
     response = "Owner added successfully."
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 200, 'OK']
-    File.open Gem.configuration.credentials_path, 'a' do |f|
-      f.write ':other: 701229f217cdf23b1344c7b4b54ca97'
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
+    File.open Gem.configuration.credentials_path, "a" do |f|
+      f.write ":other: 701229f217cdf23b1344c7b4b54ca97"
     end
     Gem.configuration.load_api_keys
 
     @cmd.handle_options %w[-k other]
-    @cmd.add_owners('freewill', ['user-new1@example.com'])
+    @cmd.add_owners("freewill", ["user-new1@example.com"])
 
-    assert_equal '701229f217cdf23b1344c7b4b54ca97', @stub_fetcher.last_request['Authorization']
+    assert_equal "701229f217cdf23b1344c7b4b54ca97", @stub_fetcher.last_request["Authorization"]
   end
 
   def test_remove_owners
     response = "Owner removed successfully."
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 200, 'OK']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
 
     use_ui @stub_ui do
       @cmd.remove_owners("freewill", ["user-remove1@example.com"])
@@ -207,32 +253,69 @@ EOF
 
   def test_remove_owners_denied
     response = "You don't have permission to push to this gem"
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 403, 'Forbidden']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 403, msg: "Forbidden")
+
+    use_ui @stub_ui do
+      @cmd.remove_owners("freewill", ["user-remove1@example.com"])
+    end
+
+    assert_match response, @stub_ui.output
+  end
+
+  def test_remove_owners_permanent_redirect
+    host = "http://rubygems.example"
+    ENV["RUBYGEMS_HOST"] = host
+    path = "/api/v1/gems/freewill/owners"
+    redirected_uri = "https://rubygems.example#{path}"
+    @stub_fetcher.data["#{host}#{path}"] = HTTPResponseFactory.create(
+      body: "",
+      code: "308",
+      msg: "Permanent Redirect",
+      headers: { "location" => redirected_uri }
+    )
 
     use_ui @stub_ui do
       @cmd.remove_owners("freewill", ["user-remove1@example.com"])
     end
 
+    response = "The request has redirected permanently to #{redirected_uri}. Please check your defined push host URL."
+    assert_match response, @stub_ui.output
+
+    path = "/api/v1/gems/freewill/owners"
+    redirected_uri = "https://rubygems.example#{path}"
+
+    @stub_fetcher.data["#{host}#{path}"] = HTTPResponseFactory.create(
+      body: "",
+      code: "308",
+      msg: "Permanent Redirect",
+      headers: { "location" => redirected_uri }
+    )
+
+    use_ui @stub_ui do
+      @cmd.add_owners("freewill", ["user-new1@example.com"])
+    end
+
+    response = "The request has redirected permanently to #{redirected_uri}. Please check your defined push host URL."
     assert_match response, @stub_ui.output
   end
 
   def test_remove_owners_key
     response = "Owner removed successfully."
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 200, 'OK']
-    File.open Gem.configuration.credentials_path, 'a' do |f|
-      f.write ':other: 701229f217cdf23b1344c7b4b54ca97'
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 200, msg: "OK")
+    File.open Gem.configuration.credentials_path, "a" do |f|
+      f.write ":other: 701229f217cdf23b1344c7b4b54ca97"
     end
     Gem.configuration.load_api_keys
 
     @cmd.handle_options %w[-k other]
-    @cmd.remove_owners('freewill', ['user-remove1@example.com'])
+    @cmd.remove_owners("freewill", ["user-remove1@example.com"])
 
-    assert_equal '701229f217cdf23b1344c7b4b54ca97', @stub_fetcher.last_request['Authorization']
+    assert_equal "701229f217cdf23b1344c7b4b54ca97", @stub_fetcher.last_request["Authorization"]
   end
 
   def test_remove_owners_missing
-    response = 'Owner could not be found.'
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 404, 'Not Found']
+    response = "Owner could not be found."
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 404, msg: "Not Found")
 
     use_ui @stub_ui do
       @cmd.remove_owners("freewill", ["missing@example"])
@@ -242,28 +325,25 @@ EOF
   end
 
   def test_otp_verified_success
-    response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = "Owner added successfully."
-
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      [response_fail, 401, 'Unauthorized'],
-      [response_success, 200, 'OK'],
-    ]
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
 
     @otp_ui = Gem::MockGemUi.new "111111\n"
     use_ui @otp_ui do
       @cmd.add_owners("freewill", ["user-new1@example.com"])
     end
 
-    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @otp_ui.output
-    assert_match 'Code: ', @otp_ui.output
+    assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @otp_ui.output
+    assert_match "Code: ", @otp_ui.output
     assert_match response_success, @otp_ui.output
-    assert_equal '111111', @stub_fetcher.last_request['OTP']
+    assert_equal "111111", @stub_fetcher.last_request["OTP"]
   end
 
   def test_otp_verified_failure
     response = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [response, 401, 'Unauthorized']
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = HTTPResponseFactory.create(body: response, code: 401, msg: "Unauthorized")
+    @stub_fetcher.data["#{Gem.host}/api/v1/webauthn_verification"] =
+      HTTPResponseFactory.create(body: "You don't have any security devices", code: 422, msg: "Unprocessable Entity")
 
     @otp_ui = Gem::MockGemUi.new "111111\n"
     use_ui @otp_ui do
@@ -271,9 +351,106 @@ EOF
     end
 
     assert_match response, @otp_ui.output
-    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @otp_ui.output
-    assert_match 'Code: ', @otp_ui.output
-    assert_equal '111111', @stub_fetcher.last_request['OTP']
+    assert_match "You have enabled multi-factor authentication. Please enter OTP code.", @otp_ui.output
+    assert_match "Code: ", @otp_ui.output
+    assert_equal "111111", @stub_fetcher.last_request["OTP"]
+  end
+
+  def test_with_webauthn_enabled_success
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
+
+    TCPServer.stub(:new, server) do
+      Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:otp] = "Uvh6T57tkWuUnWYo" }) do
+        use_ui @stub_ui do
+          @cmd.add_owners("freewill", ["user-new1@example.com"])
+        end
+      end
+    end
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    assert_equal "Uvh6T57tkWuUnWYo", @stub_fetcher.last_request["OTP"]
+    assert_match response_success, @stub_ui.output
+  end
+
+  def test_with_webauthn_enabled_failure
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+    error = Gem::WebauthnVerificationError.new("Something went wrong")
+
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
+
+    TCPServer.stub(:new, server) do
+      Gem::GemcutterUtilities::WebauthnListener.stub(:listener_thread, Thread.new { Thread.current[:error] = error }) do
+        use_ui @stub_ui do
+          @cmd.add_owners("freewill", ["user-new1@example.com"])
+        end
+      end
+    end
+
+    assert_match @stub_fetcher.last_request["Authorization"], Gem.configuration.rubygems_api_key
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
+      "you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "ERROR:  Security device verification failed: Something went wrong", @stub_ui.error
+    refute_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    refute_match response_success, @stub_ui.output
+  end
+
+  def test_with_webauthn_enabled_success_with_polling
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+
+    @stub_fetcher.respond_with_require_otp("#{Gem.host}/api/v1/gems/freewill/owners", response_success)
+    @stub_fetcher.respond_with_webauthn_url
+    @stub_fetcher.respond_with_webauthn_polling("Uvh6T57tkWuUnWYo")
+
+    TCPServer.stub(:new, server) do
+      use_ui @stub_ui do
+        @cmd.add_owners("freewill", ["user-new1@example.com"])
+      end
+    end
+
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin " \
+      "command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    assert_equal "Uvh6T57tkWuUnWYo", @stub_fetcher.last_request["OTP"]
+    assert_match response_success, @stub_ui.output
+  end
+
+  def test_with_webauthn_enabled_failure_with_polling
+    response_success = "Owner added successfully."
+    server = Gem::MockTCPServer.new
+
+    @stub_fetcher.respond_with_require_otp(
+      "#{Gem.host}/api/v1/gems/freewill/owners",
+      response_success
+    )
+    @stub_fetcher.respond_with_webauthn_url
+    @stub_fetcher.respond_with_webauthn_polling_failure
+
+    TCPServer.stub(:new, server) do
+      use_ui @stub_ui do
+        @cmd.add_owners("freewill", ["user-new1@example.com"])
+      end
+    end
+
+    assert_match @stub_fetcher.last_request["Authorization"], Gem.configuration.rubygems_api_key
+    assert_match "You have enabled multi-factor authentication. Please visit #{@stub_fetcher.webauthn_url_with_port(server.port)} " \
+      "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin " \
+      "command with the `--otp [your_code]` option.", @stub_ui.output
+    assert_match "ERROR:  Security device verification failed: The token in the link you used has either expired " \
+      "or been used already.", @stub_ui.error
+    refute_match "You are verified with a security device. You may close the browser window.", @stub_ui.output
+    refute_match response_success, @stub_ui.output
   end
 
   def test_remove_owners_unathorized_api_key
@@ -281,10 +458,10 @@ EOF
     response_success   = "Owner removed successfully."
 
     @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      [response_forbidden, 403, 'Forbidden'],
-      [response_success, 200, "OK"],
+      HTTPResponseFactory.create(body: response_forbidden, code: 403, msg: "Forbidden"),
+      HTTPResponseFactory.create(body: response_success, code: 200, msg: "OK"),
     ]
-    @stub_fetcher.data["#{Gem.host}/api/v1/api_key"] = ["", 200, "OK"]
+    @stub_fetcher.data["#{Gem.host}/api/v1/api_key"] = HTTPResponseFactory.create(body: "", code: 200, msg: "OK")
     @cmd.instance_variable_set :@scope, :remove_owner
 
     @stub_ui = Gem::MockGemUi.new "some@mail.com\npass\n"
@@ -305,10 +482,10 @@ EOF
     response_success   = "Owner added successfully."
 
     @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
-      [response_forbidden, 403, 'Forbidden'],
-      [response_success, 200, "OK"],
+      HTTPResponseFactory.create(body: response_forbidden, code: 403, msg: "Forbidden"),
+      HTTPResponseFactory.create(body: response_success, code: 200, msg: "OK"),
     ]
-    @stub_fetcher.data["#{Gem.host}/api/v1/api_key"] = ["", 200, "OK"]
+    @stub_fetcher.data["#{Gem.host}/api/v1/api_key"] = HTTPResponseFactory.create(body: "", code: 200, msg: "OK")
     @cmd.instance_variable_set :@scope, :add_owner
 
     @stub_ui = Gem::MockGemUi.new "some@mail.com\npass\n"