@nathapp/na-cli 1.0.0-rc.18 → 1.0.0-rc.20

package/templates/k8s-deployment/services/charts/tests/charts/e2e-test-js/tests/individual-onboard-app.ts

@@ -0,0 +1,823 @@
+'use strict';
+
+import { describe, it } from 'mocha';
+import chai, { expect } from 'chai';
+import chaihttp from 'chai-http';
+
+import HubService, { User, challengeIt, goodRes, goodRet, badRet, serviceUrl, mxwServiceUrl, getOTP } from "./hub";
+import { timeNow, sortObject, isUndefinedOrNullOrEmpty, hexlify } from 'mxw-libs-utils';
+import { mxw, utils } from 'mxw-sdk-js';
+import { ApiService } from 'mxw-libs-api-token';
+import { KYC_STATUS } from "./individual-kyc";
+import md5 from "md5";
+
+chai.use(chaihttp);
+
+let indent = "     ";
+
+export function appOnboard(user: User, challenge: boolean) {
+    describe('Suite: Individual App Onboard: ' + user.code + " (" + user.email + ")", function () {
+        let otp: string;
+        let keeperPublicKey: string;
+
+        it("Initial", function () {
+            return ApiService.Instance.init({
+                name: "MXW",
+                domain: process.env.MXW_SERVICE_DOMAIN,
+                wallet: user.wallet
+            }).then(() => {
+                return ApiService.Instance.init({
+                    name: "BDSS",
+                    domain: process.env.SERVICE_DOMAIN,
+                    wallet: user.wallet
+                });
+            });
+        });
+
+        challengeIt("Request registration OTP", function (params) {
+            let url = mxwServiceUrl("/auth/api/v2");
+
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                return chai.request(url).post("/sendOtp")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + token)
+                    .send(params).then((res) => {
+                        badRet(res);
+                    });
+            });
+        }, {
+            email: "",
+            walletAddress: "",
+            buildNo: "",
+            brand: "",
+            flag: "0",
+            imei: "",
+            imsi: "",
+            model: "",
+            os: "",
+            osVer: "",
+            timezone: "480",
+        }, challenge);
+
+        it("Request registration OTP", function () {
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sendOtp")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + token)
+                    .send({
+                        email: user.email,
+                        walletAddress: user.wallet.address,
+                        buildNo: "",
+                        brand: "",
+                        flag: "0",
+                        imei: "",
+                        imsi: "",
+                        model: "",
+                        os: "",
+                        osVer: "",
+                        timezone: "480",
+                    }).then((res) => {
+                        goodRet(res);
+                        if (res.body.otp) {
+                            console.log("\x1b[33m%s", indent, "WARNING: OTP value should be remove!", "\x1b[0m");
+                        }
+                    });
+            });
+        });
+
+        it("Check OTP email", function () {
+            return getOTP(user.username, "Your OTP is ").then((value) => {
+                otp = value;
+                if (!HubService.Instance.silent) { console.log(indent, "OTP:", otp) }
+            });
+        });
+
+        it("Activate Maxonrow registration", function () {
+            let url = mxwServiceUrl("/auth/api/v2");
+
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/verifyEmailOtp")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .send({
+                            email: user.email,
+                            otp,
+                            delegateToken,
+                            nickName: "hello-world",
+                            referralCode: "",
+                            buildNo: "0",
+                            brand: "0",
+                            flag: "0",
+                            imei: "0",
+                            imsi: "0",
+                            model: "0",
+                            os: "0",
+                            osVer: "0",
+                            timezone: "480"
+                        }).then((res) => {
+                            goodRet(res);
+                            expect(res.body).have.property("data").have.property("token").is.a("string").lengthOf.greaterThan(0);
+
+                            user.mxwJwt = res.body.data.token;
+                            if (!HubService.Instance.silent) { console.log(indent, "Maxonrow JWT:", user.mxwJwt) }
+                        });
+                });
+            });
+        });
+
+        challengeIt("Activate Maxonrow registration", function (params) {
+            let url = mxwServiceUrl("/auth/api/v2");
+
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                let delegateToken = {
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    }
+                };
+
+                return user.wallet.signMessage(JSON.stringify(sortObject(delegateToken.payload))).then((signature) => {
+                    delegateToken["signature"] = signature;
+                    if (!isUndefinedOrNullOrEmpty(params)) {
+                        params.delegateToken = delegateToken; // Overwrite with actual value
+                    }
+                    return chai.request(url).post("/verifyEmailOtp")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .send(params).then((res) => {
+                            badRet(res);
+                        });
+                });
+            });
+        }, {
+            email: user.email,
+            otp: "",
+            delegateToken: "",
+            nickName: "",
+            referralCode: "",
+            buildNo: "0",
+            brand: "0",
+            flag: "0",
+            imei: "0",
+            imsi: "0",
+            model: "0",
+            os: "0",
+            osVer: "0",
+            timezone: "480"
+        }, challenge);
+
+        challengeIt("Retrieve Keeper public key", function (params) {
+            let url = mxwServiceUrl("/wallet-keeper/api/v1");
+
+            return chai.request(url).get("/get")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .query(params).then((res) => {
+                    if (params && "" == params.email) {
+                        goodRet(res);
+                        expect(res.body).have.property("data").property("publicKey").is.a("string").lengthOf.greaterThan(0);
+                    }
+                    else {
+                        badRet(res);
+                    }
+                });
+        }, {
+            email: "",
+            appId: 0,
+            label: "",
+            publicKey: ""
+        }, challenge);
+
+        it("Retrieve Keeper public key", function () {
+            let url = mxwServiceUrl("/wallet-keeper/api/v1");
+
+            return chai.request(url).get("/get")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .query({
+                    email: user.email,
+                    appId: HubService.Instance.appId,
+                    label: "",
+                    publicKey: user.wallet.publicKey
+                }).then((res) => {
+                    goodRet(res);
+                    expect(res.body).have.property("data").have.property("publicKey").is.a("string").lengthOf.greaterThan(0);
+                    keeperPublicKey = res.body.data.publicKey;
+                });
+        });
+
+        if (challenge) {
+            it("Retrieve wallet from Keeper - should not return any wallet", function () {
+                let url = mxwServiceUrl("/wallet-keeper/api/v1");
+
+                return chai.request(url).get("/get")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + user.mxwJwt)
+                    .query({
+                        email: user.email,
+                        appId: HubService.Instance.appId,
+                        label: "",
+                        publicKey: user.wallet.publicKey
+                    }).then((res) => {
+                        goodRet(res);
+                        expect(res.body).have.property("data").not.have.property("encryptedWallet");
+                    });
+            });
+        }
+
+        challengeIt("Save wallet to Keeper", function (params) {
+            let url = mxwServiceUrl("/wallet-keeper/api/v1");
+
+            return chai.request(url).post("/keep")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .send(params).then((res) => {
+                    badRet(res);
+                });
+        }, {
+            email: user.email,
+            appId: HubService.Instance.appId,
+            label: "",
+            encWallet: "",
+            publicKey: ""
+        }, challenge);
+
+        it("Save wallet to Keeper", function () {
+            let url = mxwServiceUrl("/wallet-keeper/api/v1");
+            let sharedSecret = user.wallet.computeSharedSecret(keeperPublicKey);
+
+            return user.wallet.encrypt(sharedSecret).then((encryptedWallet) => {
+                return chai.request(url).post("/keep")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + user.mxwJwt)
+                    .send({
+                        email: user.email,
+                        appId: HubService.Instance.appId,
+                        label: "",
+                        encWallet: encryptedWallet,
+                        publicKey: user.wallet.publicKey
+                    }).then((res) => {
+                        goodRet(res);
+                        if (!HubService.Instance.silent) { console.log(indent, "Wallet:", user.wallet.address, "-", user.wallet.mnemonic) }
+                        if (!HubService.Instance.silent) { console.log(indent, "LoginWallet:", user.loginWallet.address) }
+                    });
+            });
+        });
+
+        it("Retrieve wallet from Keeper", function () {
+            let url = mxwServiceUrl("/wallet-keeper/api/v1");
+            let transportWallet = mxw.Wallet.createRandom();
+
+            return chai.request(url).get("/get")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .query({
+                    email: user.email,
+                    appId: HubService.Instance.appId,
+                    label: "",
+                    publicKey: transportWallet.publicKey
+                }).then((res) => {
+                    goodRet(res);
+                    expect(res.body).have.property("data").have.property("walletAddress").is.a("string").lengthOf.greaterThan(0);
+                    expect(res.body).have.property("data").have.property("publicKey").is.a("string").lengthOf.greaterThan(0);
+                    expect(res.body).have.property("data").have.property("encryptedWallet").is.a("string").lengthOf.greaterThan(0);
+
+                    return {
+                        publicKey: res.body.data.publicKey,
+                        encryptedWallet: res.body.data.encryptedWallet
+                    };
+                }).then((result) => {
+                    let sharedSecret = transportWallet.computeSharedSecret(result.publicKey)
+                    return mxw.Wallet.fromEncryptedJson(result.encryptedWallet, sharedSecret);
+                }).then((retrievedWallet) => {
+                    expect(retrievedWallet).is.exist;
+                    expect(retrievedWallet).have.property("address").is.eq(user.wallet.address);
+                });
+        });
+
+        challengeIt("Initialize Maxonrow user account", function (params) {
+            let url = mxwServiceUrl("/user/api");
+
+            return chai.request(url).post("/initUser")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .timeout(1000)
+                .send(params).then((res) => {
+                    badRet(res);
+                });
+        }, {
+            walletAddress: ""
+        }, challenge);
+
+        it("Initialize Maxonrow user account", function () {
+            let url = mxwServiceUrl("/user/api");
+
+            return chai.request(url).post("/initUser")
+                .type("application/json")
+                .set("Authorization", "Bearer " + user.mxwJwt)
+                .send({
+                    walletAddress: user.wallet.address
+                }).then((res) => {
+                    goodRet(res);
+                    expect(res.body).have.property("data").have.property("walletId").is.a("number").greaterThan(0);
+                });
+        });
+
+        if (challenge) {
+            it("Login Maxonrow - challenge with fake delegateToken signature", function () {
+                let url = mxwServiceUrl("/auth/api/v2");
+
+                return ApiService.Instance.getToken("MXW").then((token) => {
+                    let delegateToken = sortObject({
+                        payload: {
+                            timestamp: timeNow(),
+                            loginWallet: user.loginWallet.address,
+                            mainWallet: user.wallet.address
+                        }
+                    });
+
+                    return user.loginWallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                        delegateToken["signature"] = signature;
+
+                        return chai.request(url).post("/loginWallet")
+                            .type("application/json")
+                            .set("Authorization", "Bearer " + token)
+                            .send({
+                                delegateToken
+                            }).then((res) => {
+                                badRet(res, "NotSigned");
+                            });
+                    });
+                });
+            });
+
+            it("Login Maxonrow - challenge without apiToken", function () {
+                let url = mxwServiceUrl("/auth/api/v2");
+
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    }
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/loginWallet")
+                        .type("application/json")
+                        .send({
+                            delegateToken
+                        }).then((res) => {
+                            badRet(res, "Unauthorised");
+                        });
+                });
+            });
+
+            it("Login Maxonrow - challenge without delegateToken", function () {
+                let url = mxwServiceUrl("/auth/api/v2");
+
+                return ApiService.Instance.getToken("MXW").then((token) => {
+                    return chai.request(url).post("/loginWallet")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .then((res) => {
+                            badRet(res, "InvalidParameter");
+                        });
+                });
+            });
+
+            it("Login Maxonrow - challenge without any credential", function () {
+                let url = mxwServiceUrl("/auth/api/v2");
+
+                return chai.request(url).post("/loginWallet")
+                    .type("application/json")
+                    .then((res) => {
+                        badRet(res, "Unauthorised");
+                    });
+            });
+        }
+
+        it("Login Maxonrow", function () {
+            let url = mxwServiceUrl("/auth/api/v2");
+
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    }
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/loginWallet")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .send({
+                            delegateToken
+                        }).then((res) => {
+                            goodRes(res);
+                            expect(res.body).have.property("data").property("token").is.a("string").lengthOf.greaterThan(0);
+                            expect(res.body).have.property("data").property("kycId").is.a("number").is.greaterThan(0);
+                            expect(res.body).have.property("data").property("kycStatus").is.a("number");
+
+                            user.mxwJwt = res.body.data.token;
+                            user.kyc.kycId = res.body.data.kycId;
+                            user.kyc.status = res.body.data.kycStatus;
+
+                            if (!HubService.Instance.silent) { console.log(indent, "Maxonrow KYC id:", user.kyc.kycId + ", status:", user.kyc.status) }
+                            if (!HubService.Instance.silent) { console.log(indent, "Maxonrow JWT:", user.mxwJwt) }
+                        });
+                });
+            });
+        });
+
+        challengeIt("Initialize user account", function (params) {
+            let url = serviceUrl("/auth/api");
+
+            return chai.request(url).post("/initUser")
+                .type("application/json")
+                .send(params)
+                .then((res) => {
+                    badRet(res);
+                });
+        }, {
+            email: "",
+            walletAddress: "",
+            delegateToken: ""
+        }, challenge);
+
+        if (challenge) {
+            it("Initialize user account - challenge fake delegateToken signature", function () {
+                let url = serviceUrl("/auth/api");
+
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.loginWallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/initUser")
+                        .type("application/json")
+                        .send({
+                            email: "trustMe" + user.email,
+                            walletAddress: user.wallet.address,
+                            delegateToken
+                        })
+                        .then((res) => {
+                            badRet(res, "NotSigned");
+                        });
+                });
+            });
+
+            it("Initialize user account - challeenge non-exist email", function () {
+                let url = serviceUrl("/auth/api");
+
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/initUser")
+                        .type("application/json")
+                        .send({
+                            email: "trustMe" + user.email,
+                            walletAddress: user.wallet.address,
+                            delegateToken
+                        })
+                        .then((res) => {
+                            badRet(res);
+                        });
+                });
+            });
+
+            it("Initialize user account - challenge wrong wallet address", function () {
+                let url = serviceUrl("/auth/api");
+
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/initUser")
+                        .type("application/json")
+                        .send({
+                            email: user.email,
+                            walletAddress: mxw.Wallet.createRandom().address,
+                            delegateToken
+                        })
+                        .then((res) => {
+                            badRet(res);
+                        });
+                });
+            });
+        }
+
+        it("Initialize user account", function () {
+            let url = serviceUrl("/auth/api");
+
+            let delegateToken = sortObject({
+                payload: {
+                    timestamp: timeNow(),
+                    loginWallet: user.loginWallet.address,
+                    mainWallet: user.wallet.address
+                },
+                signature: ""
+            });
+
+            return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                delegateToken["signature"] = signature;
+
+                return chai.request(url).post("/initUser")
+                    .type("application/json")
+                    .send({
+                        email: user.email,
+                        walletAddress: user.wallet.address,
+                        delegateToken
+                    })
+                    .then((res) => {
+                        goodRet(res);
+                    });
+            });
+        });
+
+        it("Login", function () {
+            let url = serviceUrl("/auth/api");
+
+            return ApiService.Instance.getToken("BDSS").then((token) => {
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(url).post("/loginWallet")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .send({
+                            delegateToken
+                        })
+                        .then((res) => {
+                            goodRet(res);
+                            expect(res.body).have.property("data").property("token").is.a("string").lengthOf.greaterThan(0);
+                            expect(res.body).have.property("data").property("userId").is.a("number").is.greaterThan(0);
+                            expect(res.body).have.property("data").property("username").is.eq(user.email);
+                            expect(res.body).have.property("data").property("walletAddr").is.eq(user.wallet.address);
+
+                            user.jwt = res.body.data.token;
+                            user.id = res.body.data.userId;
+
+                            if (!HubService.Instance.silent) { console.log(indent, "Login with username:", user.email, "wallet:", user.wallet.address) }
+                            if (!HubService.Instance.silent) { console.log(indent, "JWT:", user.jwt) }
+                        });
+                });
+            });
+        });
+    });
+}
+
+export function appReauth(user: User, challenge: boolean) {
+    describe('Suite: Individual App Reauth: ' + user.code + " (" + user.email + ")", function () {
+        let otp: string;
+        let jwt: string;
+        let questionId: number;
+
+        challengeIt("Request reauth OTP", function (params) {
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sendReauthOtp")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + token)
+                    .send(params).then((res) => {
+                        badRet(res);
+                    });
+            });
+        }, {
+            userId: "",
+            email: ""
+        }, challenge);
+
+        if (challenge) {
+            it("Request reauth OTP - challenge without Token", function () {
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sendReauthOtp")
+                    .type("application/json")
+                    .send({
+                        userId: String(user.id),
+                        email: user.email
+                    }).then((res) => {
+                        badRet(res, "Unauthorised");
+                    });
+            });
+
+            it("Request reauth OTP - challenge with empty Token", function () {
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sendReauthOtp")
+                    .type("application/json")
+                    .set("Authorization", "Bearer ")
+                    .send({
+                        userId: String(user.id),
+                        email: user.email
+                    }).then((res) => {
+                        badRet(res, "InvalidHeader");
+                    });
+            });
+        }
+
+        it("Request reauth OTP", function () {
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sendReauthOtp")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + token)
+                    .send({
+                        userId: String(user.id),
+                        email: user.email
+                    }).then((res) => {
+                        goodRet(res);
+                        if (res.body.otp) {
+                            console.log("\x1b[33m%s", indent, "WARNING: OTP value should be remove!", "\x1b[0m");
+                        }
+                    });
+            });
+        });
+
+        it("Check reauth OTP email", function () {
+            return getOTP(user.username, "OTP: ").then((value) => {
+                otp = value;
+                if (!HubService.Instance.silent) { console.log(indent, "Reauth OTP:", otp) }
+            });
+        });
+
+        it("Verify reauth OTP", function () {
+            return ApiService.Instance.getToken("MXW").then((token) => {
+                let delegateToken = sortObject({
+                    payload: {
+                        timestamp: timeNow(),
+                        loginWallet: user.loginWallet.address,
+                        mainWallet: user.wallet.address
+                    },
+                    signature: ""
+                });
+
+                return user.wallet.signMessage(JSON.stringify(delegateToken.payload)).then((signature) => {
+                    delegateToken["signature"] = signature;
+
+                    return chai.request(mxwServiceUrl("/auth/api/v2")).post("/verifyReauthOtp")
+                        .type("application/json")
+                        .set("Authorization", "Bearer " + token)
+                        .send({
+                            userId: String(user.id),
+                            email: user.email,
+                            otp
+                        }).then((res) => {
+                            goodRet(res);
+                            expect(res.body).have.property("data").have.property("token").is.a("string").lengthOf.greaterThan(0);
+
+                            jwt = res.body.data.token;
+                            if (!HubService.Instance.silent) { console.log(indent, "Reauth JWT:", jwt) }
+                        });
+                });
+            });
+        });
+
+        it("View security question", function () {
+            return chai.request(mxwServiceUrl("/auth/api/v2")).get("/sec/qns")
+                .type("application/json")
+                .set("Authorization", "Bearer " + jwt)
+                .then((res) => {
+                    if (KYC_STATUS.SUBMITTED == user.kyc.status) {
+                        badRet(res, "1201", "No Records Found");
+                        return;
+                    }
+                    goodRet(res);
+                    expect(res.body).have.property("data").property("id").is.a("number").greaterThan(0);
+                    expect(res.body).have.property("data").property("name").is.a("string").lengthOf.greaterThan(0);
+                    expect(res.body).have.property("data").property("label").is.a("string").lengthOf.greaterThan(0);
+
+                    questionId = res.body.data.id;
+                });
+        });
+
+        challengeIt("Verify security answer", function (params) {
+            if (isUndefinedOrNullOrEmpty(questionId)) {
+                this.skip();
+            }
+            return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sec/secret")
+                .type("application/json")
+                .set("Authorization", "Bearer " + jwt)
+                .send(params)
+                .then((res) => {
+                    badRet(res);
+                });
+        }, {
+            qnsId: 0,
+            answer: null
+        }, challenge);
+
+        if (challenge) {
+            it("Verify security answer - challenge without JWT", function () {
+                if (isUndefinedOrNullOrEmpty(questionId)) {
+                    this.skip();
+                }
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sec/secret")
+                    .type("application/json")
+                    .send({
+                        qnsId: questionId,
+                        answer: md5(hexlify(utils.randomBytes(5)).substr(2))
+                    })
+                    .then((res) => {
+                        badRet(res, "Unauthorised");
+                    });
+            });
+
+            it("Verify security answer - challenge empty JWT", function () {
+                if (isUndefinedOrNullOrEmpty(questionId)) {
+                    this.skip();
+                }
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sec/secret")
+                    .type("application/json")
+                    .set("Authorization", "Bearer ")
+                    .send({
+                        qnsId: questionId,
+                        answer: md5(hexlify(utils.randomBytes(5)).substr(2))
+                    })
+                    .then((res) => {
+                        badRet(res, "InvalidHeader");
+                    });
+            });
+
+            it("Verify security answer - challenge with wrong answer", function () {
+                if (isUndefinedOrNullOrEmpty(questionId)) {
+                    this.skip();
+                }
+                return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sec/secret")
+                    .type("application/json")
+                    .set("Authorization", "Bearer " + jwt)
+                    .send({
+                        qnsId: questionId,
+                        answer: md5(hexlify(utils.randomBytes(5)).substr(2))
+                    })
+                    .then((res) => {
+                        badRet(res, "1121", "Invalid Password");
+                    });
+            });
+        }
+
+        it("Verify security answer", function () {
+            if (isUndefinedOrNullOrEmpty(questionId)) {
+                this.skip();
+            }
+            return chai.request(mxwServiceUrl("/auth/api/v2")).post("/sec/secret")
+                .type("application/json")
+                .set("Authorization", "Bearer " + jwt)
+                .send({
+                    qnsId: questionId,
+                    answer: md5(user.username.substr(user.username.length - 6))
+                })
+                .then((res) => {
+                    goodRet(res);
+                });
+        });
+
+    });
+}