demarches-normaliennes/spec/controllers/users/sessions_controller_spec.rb

248 lines
7.5 KiB
Ruby
Raw Normal View History

describe Users::SessionsController, type: :controller do
let(:email) { 'unique@plop.com' }
let(:password) { 'my-s3cure-p4ssword' }
let(:loged_in_with_france_connect) { User.loged_in_with_france_connects.fetch(:particulier) }
let!(:user) { create(:user, email: email, password: password, loged_in_with_france_connect: loged_in_with_france_connect) }
2015-10-07 16:38:29 +02:00
before do
@request.env["devise.mapping"] = Devise.mappings[:user]
end
describe '#create' do
2019-08-16 16:38:02 +02:00
let(:user) { create(:user, email: email, password: password, loged_in_with_france_connect: 'particulier') }
let(:send_password) { password }
2019-08-16 15:46:51 +02:00
let(:remember_me) { '0' }
subject do
2019-08-16 15:46:51 +02:00
post :create, params: {
user: {
email: email,
password: send_password,
remember_me: remember_me
}
}
end
context 'when the credentials are right' do
it 'signs in' do
subject
expect(response).to redirect_to(root_path)
expect(controller.current_user).to eq(user)
2019-08-16 16:38:02 +02:00
expect(user.reload.loged_in_with_france_connect).to be(nil)
2019-08-16 15:46:51 +02:00
expect(user.reload.remember_created_at).to be_nil
end
context 'when remember_me is specified' do
let(:remember_me) { '1' }
it 'remembers' do
subject
expect(user.reload.remember_created_at).to be_present
end
2018-10-30 18:24:29 +01:00
end
context 'when a previous path was registered' do
let(:stored_path) { 'a_path' }
before { controller.store_location_for(:user, stored_path) }
it 'redirects to that previous path' do
subject
expect(response).to redirect_to(stored_path)
end
end
2019-08-16 14:17:39 +02:00
context 'when the user is locked' do
before { user.lock_access! }
it 'redirects to new_path' do
subject
expect(response).to render_template(:new)
2020-09-01 15:28:31 +02:00
expect(flash.alert).to eq('Courriel ou mot de passe incorrect.')
2019-08-16 14:17:39 +02:00
end
end
end
2018-10-30 18:24:29 +01:00
context 'when the credentials are wrong' do
let(:send_password) { 'wrong_password' }
it 'fails to sign in with bad credentials' do
subject
2019-08-16 16:41:28 +02:00
expect(response).to render_template(:new)
expect(controller.current_user).to be(nil)
end
end
2015-10-07 16:38:29 +02:00
end
describe '#destroy' do
2019-08-07 11:15:16 +02:00
let!(:user) { create(:user, email: email, password: password, loged_in_with_france_connect: loged_in_with_france_connect) }
before do
2015-10-07 16:38:29 +02:00
sign_in user
delete :destroy
end
it 'user is sign out' do
expect(subject.current_user).to be_nil
end
it 'loged_in_with_france_connect current_user attribut is nil' do
user.reload
2018-12-18 22:48:56 +01:00
expect(user.loged_in_with_france_connect.present?).to be_falsey
end
2015-10-07 16:38:29 +02:00
2016-02-11 16:12:59 +01:00
context 'when user is connect with france connect particulier' do
let(:loged_in_with_france_connect) { User.loged_in_with_france_connects.fetch(:particulier) }
it 'redirect to france connect logout page' do
2018-01-11 14:04:24 +01:00
expect(response).to redirect_to(FRANCE_CONNECT[:particulier][:logout_endpoint])
end
end
2015-10-07 16:38:29 +02:00
context 'when user is not connect with france connect' do
let(:loged_in_with_france_connect) { '' }
2015-10-07 16:38:29 +02:00
it 'redirect to root page' do
expect(response).to redirect_to(root_path)
end
end
end
describe '#new' do
subject { get :new }
it { expect(subject.status).to eq 200 }
context 'when a procedure location has been stored' do
let(:procedure) { create :procedure, :published }
before do
controller.store_location_for(:user, commencer_path(path: procedure.path))
end
it 'makes the saved procedure available' do
expect(subject.status).to eq 200
expect(assigns(:procedure)).to eq procedure
end
end
end
describe '#sign_in_by_link' do
context 'when the instructeur has non other account' do
let(:instructeur) { create(:instructeur) }
let!(:good_jeton) { instructeur.create_trusted_device_token }
2019-08-27 10:05:12 +02:00
let(:jeton) { good_jeton }
2019-02-01 17:17:10 +01:00
let(:logged) { false }
2019-08-27 10:04:12 +02:00
let(:valid_token) { true }
2019-01-03 16:00:58 +01:00
before do
2019-02-01 17:17:10 +01:00
if logged
2019-08-07 11:15:16 +02:00
sign_in(instructeur.user)
2019-02-01 17:17:10 +01:00
end
2018-10-30 18:24:29 +01:00
allow(controller).to receive(:trust_device)
2019-02-01 17:17:10 +01:00
allow(controller).to receive(:send_login_token_or_bufferize)
2019-08-27 10:04:12 +02:00
allow_any_instance_of(TrustedDeviceToken).to receive(:token_valid?).and_return(valid_token)
post :sign_in_by_link, params: { id: instructeur.id, jeton: jeton }
end
context 'when the instructeur is not logged in' do
2019-02-01 17:17:10 +01:00
context 'when the token is valid' do
it { is_expected.to redirect_to new_user_session_path }
it { expect(controller.current_instructeur).to be_nil }
2019-02-01 17:17:10 +01:00
it { expect(controller).to have_received(:trust_device) }
end
2019-02-01 17:17:10 +01:00
context 'when the token is invalid' do
2019-08-27 10:04:12 +02:00
let(:valid_token) { false }
it { is_expected.to redirect_to link_sent_path(email: instructeur.email) }
it { expect(controller.current_instructeur).to be_nil }
2019-02-01 17:17:10 +01:00
it { expect(controller).not_to have_received(:trust_device) }
it { expect(controller).to have_received(:send_login_token_or_bufferize) }
end
context 'when the token does not exist' do
let(:jeton) { 'I do not exist' }
it { is_expected.to redirect_to root_path }
it { expect(controller.current_instructeur).to be_nil }
it { expect(controller).not_to have_received(:trust_device) }
it { expect(controller).not_to have_received(:send_login_token_or_bufferize) }
it { expect(flash.alert).to eq('Votre lien est invalide.') }
end
end
context 'when the instructeur is logged in' do
2019-02-01 17:17:10 +01:00
let(:logged) { true }
2019-02-01 17:17:10 +01:00
context 'when the token is valid' do
# redirect to root_path, then redirect to instructeur_procedures_path (see root_controller)
2019-02-01 17:17:10 +01:00
it { is_expected.to redirect_to root_path }
it { expect(controller.current_instructeur).to eq(instructeur) }
2019-02-01 17:17:10 +01:00
it { expect(controller).to have_received(:trust_device) }
end
2019-02-01 17:17:10 +01:00
context 'when the token is invalid' do
2019-08-27 10:04:12 +02:00
let(:valid_token) { false }
it { is_expected.to redirect_to link_sent_path(email: instructeur.email) }
it { expect(controller.current_instructeur).to eq(instructeur) }
2019-02-01 17:17:10 +01:00
it { expect(controller).not_to have_received(:trust_device) }
it { expect(controller).to have_received(:send_login_token_or_bufferize) }
end
end
end
end
2018-10-30 18:24:29 +01:00
describe '#trust_device and #trusted_device?' do
subject { controller.trusted_device? }
context 'when the trusted cookie is not present' do
it { is_expected.to be false }
end
context 'when the cookie is outdated' do
before do
emission_date = Time.zone.now - TrustedDeviceConcern::TRUSTED_DEVICE_PERIOD - 1.minute
controller.trust_device(emission_date)
2018-10-30 18:24:29 +01:00
end
it { is_expected.to be false }
end
context 'when the cookie is ok' do
2019-02-01 17:17:10 +01:00
before { controller.trust_device(Time.zone.now) }
2018-10-30 18:24:29 +01:00
it { is_expected.to be true }
end
end
2021-12-15 13:44:12 +01:00
describe '#link_sent' do
render_views
before { get :link_sent, params: { email: link_email } }
context 'when the email is legit' do
let(:link_email) { 'a@a.com' }
it { expect(response.body).to include(link_email) }
end
context 'when the email is evil' do
2022-03-24 12:38:32 +01:00
[
'Hello, I am an evil email',
'a@a%C2%A0evil%C2%A0text%C2%A0with%C2%A0spaces'
].each do |evil_attempt|
let(:link_email) { evil_attempt }
2021-12-15 13:44:12 +01:00
2022-03-24 12:38:32 +01:00
it { expect(response).to redirect_to(root_path) }
end
2021-12-15 13:44:12 +01:00
end
end
end