fix: section Securite du compte incomplete BUG-068 (boutons theme, QR local, mot de passe, recovery WebAuthn)

tests/test_mfa.py

@@ -248,6 +248,22 @@ class TestMfaApiEndpoints:
         assert "otpauth://totp/" in data["otpauth_uri"]
         assert len(data["secret"]) >= 16
 
+    def test_mfa_setup_returns_local_qr_data_url(self, mfa_client):
+        """BUG-068: the setup response carries a CSP-safe local QR code.
+
+        The previous client used an https://api.qrserver.com image, blocked by
+        the CSP (img-src 'self' data: blob:) — the QR never displayed — and
+        leaking the otpauth URI to a third party.
+        """
+        token, _ = _login(mfa_client)
+        resp = mfa_client.post("/api/auth/mfa/totp/setup", headers=_auth_headers(token))
+        assert resp.status_code == 200
+        data = resp.json()
+        qr_data_url = data.get("qr_data_url")
+        assert qr_data_url, "setup must return a local qr_data_url"
+        assert qr_data_url.startswith("data:image/svg+xml"), qr_data_url[:60]
+        assert "qrserver.com" not in qr_data_url
+
     def test_mfa_enable_flow(self, mfa_client):
         token, _ = _login(mfa_client)
         headers = _auth_headers(token)