Merge branch 'develop' of github.com:sgmap/tps into develop

Conflicts:
	db/schema.rb

.gitignore

@@ -28,6 +28,5 @@ config/initializers/token.rb
 doc/*.svg
 rubocop.html
 config/france_connect.yml
-vendor/**/*
 uploads/*
 

app/assets/javascripts/application.js

@@ -24,4 +24,5 @@
 //= require concavehull.min
 //= require graham_scan.min
 //= require leaflet.freedraw
-//= require smart_listing
+//= require smart_listing
+//= require turf

app/assets/javascripts/carte/cadastre.js

@@ -21,17 +21,17 @@ function get_cadastre(coordinates) {
     return cadastre['cadastres'];
 }
 
-function display_cadastre(cadastre_list) {
+function display_cadastre(cadastre_array) {
     if (!cadastre_active())
         return;
 
-    cadastre_array = cadastre_list;
-
     $("#cadastre.list ul").html('');
-
     new_cadastreLayer();
 
-    if (cadastre_array.length > 0) {
+    if (cadastre_array.length == 1 && cadastre_array[0]['zoom_error'])
+        $("#cadastre.list ul").html('<li><b>Merci de dessiner une surface plus petite afin de récupérer les parcelles cadastrales.</b></li>');
+
+    else if (cadastre_array.length > 0) {
         cadastre_array.forEach(function (cadastre) {
             $("#cadastre.list ul").append('<li> Parcelle n°' + cadastre.numero + ' - Feuille ' + cadastre.code_arr + ' ' + cadastre.section + ' ' + cadastre.feuille+ '</li>');
 
@@ -56,6 +56,5 @@ function new_cadastreLayer() {
         map.removeLayer(cadastreItems);
 
     cadastreItems = new L.GeoJSON();
-
     cadastreItems.addTo(map);
 }

app/assets/javascripts/carte/carte.js

@@ -41,17 +41,42 @@ function initCarto() {
     add_event_freeDraw();
 }
 
-function default_position (){
+function default_position() {
     return {lon: LON, lat: LAT, zoom: 13}
 }
 
-function get_external_data (latLngs){
+function get_external_data(latLngs) {
-
     if (qp_active())
         display_qp(get_qp(latLngs));
 
-    if (cadastre_active())
+    if (cadastre_active()) {
-        display_cadastre(get_cadastre(latLngs));
+        cadastre_list = [];
+
+        polygons = {"type": "FeatureCollection", "features": []};
+
+        for (i = 0; i < latLngs.length; i++)
+            polygons.features.push(feature_polygon_latLngs(latLngs[i]))
+
+        if (turf.area(polygons) < 300000)
+            cadastre_list = get_cadastre(latLngs);
+        else
+            cadastre_list = [{zoom_error: true}];
+
+        display_cadastre(cadastre_list);
+    }
+}
+
+function feature_polygon_latLngs(coordinates) {
+    return ({
+        "type": "Feature",
+        "properties": {},
+        "geometry": {
+            "type": "Polygon",
+            "coordinates": [
+                JSON.parse(L.FreeDraw.Utilities.getJsonPolygons([coordinates]))['latLngs']
+            ]
+        }
+    })
 }
 
 function add_event_freeDraw() {

app/controllers/france_connect/particulier_controller.rb

@@ -13,74 +13,86 @@ class FranceConnect::ParticulierController < ApplicationController
     redirect_to authorization_uri
   end
 
-  def new
-    return redirect_to root_path if france_connect_particulier_id_blank?
-
-    @user = (User.new create_user_params).decorate
-  end
-
-  def create
-    user = User.new create_user_params
-    user.password = Devise.friendly_token[0, 20]
-
-    unless user.valid?
-      flash.alert = 'Email non valide'
-      return redirect_to france_connect_particulier_new_path user: params[:user]
-    end
-
-    user.save
-    connect_france_connect_particulier user
-  end
-
-  def check_email
-    user = User.find_by_email(params[:user][:email])
-
-    return create if user.nil?
-    return redirect_to root_path if france_connect_particulier_id_blank?
-
-    unless params[:user][:password].nil?
-
-      if user.valid_password?(params[:user][:password])
-        user.update_attributes create_user_params
-        return connect_france_connect_particulier user
-      else
-        flash.now.alert = 'Mot de passe invalide'
-      end
-    end
-
-    @user = (User.new create_user_params).decorate
-  end
-
   def callback
     return redirect_to new_user_session_path unless params.has_key?(:code)
 
     user_infos = FranceConnectService.retrieve_user_informations_particulier(params[:code])
 
     unless user_infos.nil?
-      user = User.find_for_france_connect_particulier user_infos
+      france_connect_information = FranceConnectInformation.find_by_france_connect_particulier user_infos
 
-      if user.nil?
+      france_connect_information = FranceConnectInformation.create(
-        return redirect_to france_connect_particulier_new_path(user: user_infos)
+          {gender: user_infos[:gender],
-      end
+           given_name: user_infos[:given_name],
+           family_name: user_infos[:family_name],
+           email_france_connect: user_infos[:email],
+           birthdate: user_infos[:birthdate],
+           birthplace: user_infos[:birthplace],
+           france_connect_particulier_id: user_infos[:france_connect_particulier_id]}
+      ) if france_connect_information.nil?
+
+      user = france_connect_information.user
+      salt = FranceConnectSaltService.new(france_connect_information).salt
+
+      return redirect_to france_connect_particulier_new_path(fci_id: france_connect_information.id, salt: salt) if user.nil?
 
       connect_france_connect_particulier user
     end
   rescue Rack::OAuth2::Client::Error => e
     Rails.logger.error e.message
-    flash.alert = t('errors.messages.france_connect.connexion')
+    redirect_france_connect_error_connection
-    redirect_to(new_user_session_path)
+  end
+
+  def new
+    return redirect_france_connect_error_connection unless valid_salt_and_fci_id_params?
+
+    france_connect_information = FranceConnectInformation.find(params[:fci_id])
+    @user = User.new(france_connect_information: france_connect_information).decorate
+  rescue ActiveRecord::RecordNotFound
+    redirect_france_connect_error_connection
+  end
+
+  def check_email
+    return redirect_france_connect_error_connection unless valid_salt_and_fci_id_params?
+
+    user = User.find_by_email(params[:user][:email_france_connect])
+
+    return create if user.nil?
+
+    unless params[:user][:password].nil?
+
+      if user.valid_password?(params[:user][:password])
+        user.france_connect_information = FranceConnectInformation.find(params[:fci_id])
+
+        return connect_france_connect_particulier user
+      else
+        flash.now.alert = 'Mot de passe invalide'
+      end
+    end
+
+    france_connect_information = FranceConnectInformation.find(params[:fci_id])
+    france_connect_information.update_attribute(:email_france_connect, params[:user][:email_france_connect])
+
+    @user = User.new(france_connect_information: france_connect_information).decorate
+  end
+
+  def create
+    user = User.new email: params[:user][:email_france_connect]
+    user.password = Devise.friendly_token[0, 20]
+
+    unless user.valid?
+      flash.alert = 'Email non valide'
+      return redirect_to france_connect_particulier_new_path fci_id: params[:fci_id], salt: params[:salt], user: params[:user]
+    end
+
+    user.save
+    FranceConnectInformation.find(params[:fci_id]).update_attribute(:user, user)
+
+    connect_france_connect_particulier user
   end
 
   private
 
-  def create_user_params
-    params.require(:user).permit(:france_connect_particulier_id, :gender, :given_name, :family_name, :birthdate, :birthplace, :email)
-  end
-
-  def france_connect_particulier_id_blank?
-    redirect_to root_path if params[:user][:france_connect_particulier_id].blank?
-  end
-
   def connect_france_connect_particulier user
     sign_in user
 
@@ -89,4 +101,14 @@ class FranceConnect::ParticulierController < ApplicationController
 
     redirect_to stored_location_for(current_user) || signed_in_root_path(current_user)
   end
+
+  def redirect_france_connect_error_connection
+    flash.alert = t('errors.messages.france_connect.connexion')
+    redirect_to(new_user_session_path)
+  end
+
+  def valid_salt_and_fci_id_params?
+    france_connect_information = FranceConnectInformation.find(params[:fci_id])
+    FranceConnectSaltService.new(france_connect_information).valid? params[:salt]
+  end
 end

app/controllers/users/carte_controller.rb

@@ -1,14 +1,11 @@
 class Users::CarteController < UsersController
   include DossierConcern
 
+  before_action :authorized_routes?, only: [:show]
+
   def show
     @dossier = current_user_dossier
 
-    unless @dossier.procedure.module_api_carto.use_api_carto
-      flash.alert = t('errors.messages.dossier_map_not_activated')
-      redirect_to url_for(root_path)
-    end
-
   rescue ActiveRecord::RecordNotFound
     flash.alert = t('errors.messages.dossier_not_found')
     redirect_to url_for(root_path)

app/controllers/users/description_controller.rb

@@ -1,4 +1,6 @@
 class Users::DescriptionController < UsersController
+  before_action :authorized_routes?, only: [:show]
+
   def show
     @dossier = current_user_dossier
     @dossier = @dossier.decorate

app/controllers/users/dossiers_controller.rb

@@ -5,6 +5,8 @@ class Users::DossiersController < UsersController
   before_action :authenticate_user!
   before_action :check_siret, only: :create
 
+  before_action :authorized_routes?, only: [:show]
+
   def index
     order = 'DESC'
 
@@ -152,16 +154,16 @@ class Users::DossiersController < UsersController
 
   def error_procedure
     flash.alert = t('errors.messages.procedure_not_found')
-
     redirect_to url_for users_dossiers_path
   end
 
   def mandataire_social? mandataires_list
-    mandataires_list.each do |mandataire|
+    unless current_user.france_connect_information.nil?
-      return true if !current_user.france_connect_particulier_id.nil? &&
+      mandataires_list.each do |mandataire|
-          mandataire[:nom].upcase == current_user.family_name.upcase &&
+        return true if mandataire[:nom].upcase == current_user.family_name.upcase &&
-          mandataire[:prenom].upcase == current_user.given_name.upcase &&
+            mandataire[:prenom].upcase == current_user.given_name.upcase &&
-          mandataire[:date_naissance_timestamp] == current_user.birthdate.to_time.to_i
+            mandataire[:date_naissance_timestamp] == current_user.birthdate.to_time.to_i
+      end
     end
 
     false

app/controllers/users/recapitulatif_controller.rb

@@ -1,4 +1,6 @@
 class Users::RecapitulatifController < UsersController
+  before_action :authorized_routes?, only: [:show]
+
   def show
     create_dossier_facade
   end

app/controllers/users_controller.rb

@@ -2,8 +2,26 @@ class UsersController < ApplicationController
   before_action :authenticate_user!
 
   def current_user_dossier dossier_id=nil
-    dossier_id ||= params[:dossier_id]
+    dossier_id ||= params[:dossier_id] || params[:id]
 
     current_user.dossiers.find(dossier_id)
   end
+
+  def authorized_routes?
+    sub_path = "/users/dossiers/#{current_user_dossier.id}"
+
+    redirect_to_root_path 'Le status de votre dossier n\'autorise pas cette URL' unless UserRoutesAuthorizationService.authorized_route?(
+        (request.env['PATH_INFO']).gsub(sub_path, ''),
+        current_user_dossier.state,
+        current_user_dossier.procedure.use_api_carto)
+  rescue ActiveRecord::RecordNotFound
+    redirect_to_root_path 'Vous n’avez pas accès à ce dossier.'
+  end
+
+  private
+
+  def redirect_to_root_path message
+    flash.alert = message
+    redirect_to url_for root_path
+  end
 end

app/models/france_connect_information.rb

@@ -0,0 +1,9 @@
+class FranceConnectInformation < ActiveRecord::Base
+  belongs_to :user
+
+  validates :france_connect_particulier_id, presence: true, allow_blank: false, allow_nil: false
+
+  def self.find_by_france_connect_particulier user_info
+    FranceConnectInformation.find_by(france_connect_particulier_id: user_info[:france_connect_particulier_id])
+  end
+end

app/models/procedure.rb

@@ -7,6 +7,8 @@ class Procedure < ActiveRecord::Base
 
   belongs_to :administrateur
 
+  delegate :use_api_carto, to: :module_api_carto
+
   accepts_nested_attributes_for :types_de_champ,:reject_if => proc { |attributes| attributes['libelle'].blank? }, :allow_destroy => true
   accepts_nested_attributes_for :types_de_piece_justificative, :reject_if => proc { |attributes| attributes['libelle'].blank? }, :allow_destroy => true
   accepts_nested_attributes_for :module_api_carto

app/models/user.rb

@@ -8,11 +8,10 @@ class User < ActiveRecord::Base
          :recoverable, :rememberable, :trackable, :validatable
 
   has_many :dossiers, dependent: :destroy
+  has_one :france_connect_information, dependent: :destroy
 
-  def self.find_for_france_connect_particulier user_info
+  delegate :given_name, :family_name, :email_france_connect, :gender, :birthdate, :birthplace, :france_connect_particulier_id, to: :france_connect_information
-
+  accepts_nested_attributes_for :france_connect_information
-    User.find_by(france_connect_particulier_id: user_info[:france_connect_particulier_id])
-  end
 
   def self.find_for_france_connect email, siret
     user = User.find_by_email(email)

app/services/france_connect_salt_service.rb

@@ -0,0 +1,17 @@
+class FranceConnectSaltService
+
+  attr_reader :model
+
+  def initialize france_connect_information
+    raise 'Not a FranceConnectInformation class' unless france_connect_information.class == FranceConnectInformation
+    @model = france_connect_information
+  end
+
+  def valid? test_salt
+    salt == test_salt
+  end
+
+  def salt
+    Digest::MD5.hexdigest(model.france_connect_particulier_id + model.given_name + model.family_name + FRANCE_CONNECT.particulier_secret + DateTime.now.to_date.to_s)
+  end
+end

app/services/user_routes_authorization_service.rb

@@ -0,0 +1,48 @@
+class UserRoutesAuthorizationService
+
+  def self.authorized_paths
+    {
+        root: '',
+        carte: '/carte',
+        description: '/description',
+        recapitulatif: '/recapitulatif'
+    }
+  end
+
+  def self.authorized_states
+    Dossier.states
+  end
+
+  def self.authorized_routes
+    {
+        root: {
+            authorized_states: [:draft],
+            api_carto: false
+        },
+        carte: {
+            authorized_states: [:draft, :initiated, :replied, :updated],
+            api_carto: true
+        },
+        description: {
+            authorized_states: [:draft, :initiated, :replied, :updated],
+            api_carto: false
+        },
+        recapitulatif: {
+            authorized_states: [:initiated, :replied, :updated, :validated, :submitted, :closed],
+            api_carto: false
+        }
+    }
+  end
+
+  def self.authorized_route? path, state, api_carto=false
+    return raise 'Not a valid path' unless authorized_paths.has_value? path
+    return raise 'Not a valid state' unless authorized_states.has_value? state
+
+    path_key = authorized_paths.key(path)
+
+    first = authorized_routes[path_key][:authorized_states].include? state.to_sym
+    seconde = authorized_routes[path_key][:api_carto] ? api_carto : true
+
+    first && seconde
+  end
+end

app/views/admin/procedures/_informations.html.haml

@@ -38,8 +38,5 @@
         Quartiers Prioritaires
     %li
       %label
-        = ff.check_box :cadastre, disabled: :disabled
+        = ff.check_box :cadastre
         Cadastre
-        %i
-          %strong
-            (bientôt disponible)

app/views/france_connect/particulier/check_email.html.haml

@@ -15,14 +15,9 @@
   #france_connect_particulier_email
     = form_for @user, url: {controller: 'france_connect/particulier', action: :check_email}, method: :post do |f|
       .form-group.form-group-lg
-        = f.text_field :email, class: "form-control", readonly: 'readonly'
+        = f.text_field :email_france_connect, class: "form-control", readonly: 'readonly'
         %br
         = f.password_field :password, class: "form-control", placeholder: "Entrez votre mot de passe"
-        = f.hidden_field :email
+        = hidden_field_tag :fci_id, params[:fci_id]
-        = f.hidden_field :gender
+        = hidden_field_tag :salt, params[:salt]
-        = f.hidden_field :given_name
-        = f.hidden_field :family_name
-        = f.hidden_field :birthdate
-        = f.hidden_field :birthplace
-        = f.hidden_field :france_connect_particulier_id
         = f.submit 'Terminer', class: %w(btn btn-lg btn-success), style: 'margin-top:20px;', id: 'valid_new_fcp'

app/views/france_connect/particulier/new.html.haml

@@ -6,7 +6,7 @@
 
 %br
 %p
-  Nous vous avons correctement identifié comme étant
+  Nous vous avons identifié comme étant
 
 %h4.text-info.center
   %strong
@@ -26,11 +26,7 @@
   #france_connect_particulier_email
     = form_for @user, url: {controller: 'france_connect/particulier', action: :check_email}, method: :post do |f|
       .form-group.form-group-lg
-        = f.text_field :email, class: "form-control", placeholder: "Entrez votre email"
+        = f.text_field :email_france_connect, class: "form-control", placeholder: "Entrez votre email"
-        = f.hidden_field :gender
+        = hidden_field_tag :fci_id, params[:fci_id]
-        = f.hidden_field :given_name
+        = hidden_field_tag :salt, params[:salt]
-        = f.hidden_field :family_name
-        = f.hidden_field :birthdate
-        = f.hidden_field :birthplace
-        = f.hidden_field :france_connect_particulier_id
         = f.submit 'Terminer', class: %w(btn btn-lg btn-success), style: 'margin-top:20px;', id: 'valid_new_fcp'

db/migrate/20160120094750_create_france_connect_information.rb

@@ -0,0 +1,61 @@
+class CreateFranceConnectInformation < ActiveRecord::Migration
+
+  class User < ActiveRecord::Base
+
+  end
+
+  class FranceConnectInformation < ActiveRecord::Base
+
+  end
+
+  def up
+    create_table :france_connect_informations do |t|
+      t.string :gender
+      t.string :given_name
+      t.string :family_name
+      t.date :birthdate
+      t.string :birthplace
+      t.string :france_connect_particulier_id
+    end
+
+    add_reference :france_connect_informations, :user, references: :users
+
+    User.all.each do |user|
+      FranceConnectInformation.create({gender: user.gender,
+                                       given_name: user.given_name,
+                                       family_name: user.family_name,
+                                       birthdate: user.birthdate,
+                                       birthplace: user.birthplace,
+                                       france_connect_particulier_id: user.france_connect_particulier_id,
+                                       user_id: user.id}) unless user.france_connect_particulier_id.nil?
+    end
+
+    remove_column :users, :gender
+    remove_column :users, :given_name
+    remove_column :users, :family_name
+    remove_column :users, :birthdate
+    remove_column :users, :birthplace
+    remove_column :users, :france_connect_particulier_id
+  end
+
+
+  def down
+    add_column :users, :gender, :string
+    add_column :users, :given_name, :string
+    add_column :users, :family_name, :string
+    add_column :users, :birthdate, :date
+    add_column :users, :birthplace, :string
+    add_column :users, :france_connect_particulier_id, :string
+
+    FranceConnectInformation.all.each do |fci|
+      User.find(fci.user_id).update_attributes({gender: fci.gender,
+                                                given_name: fci.given_name,
+                                                family_name: fci.family_name,
+                                                birthdate: fci.birthdate,
+                                                birthplace: fci.birthplace,
+                                                france_connect_particulier_id: fci.france_connect_particulier_id})
+    end
+
+    drop_table :france_connect_informations
+  end
+end

db/migrate/20160121110603_add_email_to_france_connect_information.rb

@@ -0,0 +1,5 @@
+class AddEmailToFranceConnectInformation < ActiveRecord::Migration
+  def change
+    add_column :france_connect_informations, :email_france_connect, :string
+  end
+end

db/schema.rb

@@ -11,7 +11,8 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160120141602) do
+
+ActiveRecord::Schema.define(version: 20160121110603) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -129,6 +130,17 @@ ActiveRecord::Schema.define(version: 20160120141602) do
     t.integer  "etablissement_id"
   end
 
+  create_table "france_connect_informations", force: :cascade do |t|
+    t.string  "gender"
+    t.string  "given_name"
+    t.string  "family_name"
+    t.date    "birthdate"
+    t.string  "birthplace"
+    t.string  "france_connect_particulier_id"
+    t.integer "user_id"
+    t.string  "email_france_connect"
+  end
+
   create_table "gestionnaires", force: :cascade do |t|
     t.string   "email",                  default: "", null: false
     t.string   "encrypted_password",     default: "", null: false
@@ -216,12 +228,12 @@ ActiveRecord::Schema.define(version: 20160120141602) do
   end
 
   create_table "users", force: :cascade do |t|
-    t.string   "email",                         default: "",      null: false
+    t.string   "email",                        default: "",      null: false
-    t.string   "encrypted_password",            default: "",      null: false
+    t.string   "encrypted_password",           default: "",      null: false
     t.string   "reset_password_token"
     t.datetime "reset_password_sent_at"
     t.datetime "remember_created_at"
-    t.integer  "sign_in_count",                 default: 0,       null: false
+    t.integer  "sign_in_count",                default: 0,       null: false
     t.datetime "current_sign_in_at"
     t.datetime "last_sign_in_at"
     t.inet     "current_sign_in_ip"
@@ -229,13 +241,7 @@ ActiveRecord::Schema.define(version: 20160120141602) do
     t.datetime "created_at"
     t.datetime "updated_at"
     t.string   "siret"
-    t.string   "loged_in_with_france_connect",  default: "false"
+    t.string   "loged_in_with_france_connect", default: "false"
-    t.string   "gender"
-    t.string   "given_name"
-    t.string   "family_name"
-    t.date     "birthdate"
-    t.string   "birthplace"
-    t.string   "france_connect_particulier_id"
   end
 
   add_index "users", ["email"], name: "index_users_on_email", unique: true, using: :btree

spec/controllers/france_connect/particulier_controller_spec.rb

@@ -8,7 +8,7 @@ describe FranceConnect::ParticulierController, type: :controller do
   let(:gender) { 'M' }
   let(:birthplace) { '1234' }
   let(:france_connect_particulier_id) { 'blabla' }
-  let(:email) { '' }
+  let(:email) { 'test@test.com' }
   let(:password) { '' }
 
   let(:user_info) { Hashie::Mash.new(france_connect_particulier_id: france_connect_particulier_id, given_name: given_name, family_name: family_name, birthdate: birthdate, birthplace: birthplace, gender: gender, email: email, password: password) }
@@ -32,33 +32,80 @@ describe FranceConnect::ParticulierController, type: :controller do
       context 'when code is correct' do
         before do
           allow(FranceConnectService).to receive(:retrieve_user_informations_particulier).and_return(user_info)
-          get :callback, code: code
         end
 
         context 'when france_connect_particulier_id exist in database' do
-          before do
+          let!(:france_connect_information) { create(:france_connect_information, france_connect_particulier_id: france_connect_particulier_id, given_name: given_name, family_name: family_name, birthdate: birthdate, gender: gender, birthplace: birthplace) }
-            create(:user, france_connect_particulier_id: france_connect_particulier_id, email: email, given_name: given_name, family_name: family_name, birthdate: birthdate, gender: gender, birthplace: birthplace)
+
-            get :callback, code: code
+          context {
+            subject { get :callback, code: code }
+
+            it 'does not create a new france_connect_information in database' do
+              expect { subject }.not_to change { FranceConnectInformation.count }
+            end
+          }
+
+          context 'when france_connect_particulier_id have an associate user' do
+            before do
+              create(:user, email: email, france_connect_information: france_connect_information)
+
+              get :callback, code: code
+            end
+
+            let(:email) { 'plop@plop.com' }
+            let(:current_user) { User.find_by_email(email) }
+            let(:stored_location) { '/plip/plop' }
+
+            it 'current user have attribut loged_in_with_france_connect? at true' do
+              expect(current_user.loged_in_with_france_connect?).to be_truthy
+            end
+
+            it 'redirect to stored location' do
+              subject.store_location_for(:user, stored_location)
+
+              get :callback, code: code
+              expect(response).to redirect_to(stored_location)
+            end
           end
 
-          let(:email) { 'plop@plop.com' }
+          context 'when france_connect_particulier_id does not have an associate user' do
-          let(:current_user) { User.find_by_email(email) }
+            let(:salt) { FranceConnectSaltService.new(france_connect_information).salt }
-          let(:stored_location) { '/plip/plop' }
 
-          it 'current user have attribut loged_in_with_france_connect? at true' do
+            before do
-            expect(current_user.loged_in_with_france_connect?).to be_truthy
+              get :callback, code: code
-          end
+            end
 
-          it 'redirect to stored location' do
+            it 'redirects to check email FC page' do
-            subject.store_location_for(:user, stored_location)
+              expect(response).to redirect_to(france_connect_particulier_new_path(fci_id: france_connect_information.id, salt: salt))
-            get :callback, code: code
+            end
-            expect(response).to redirect_to(stored_location)
           end
         end
 
         context 'when france_connect_particulier_id does not exist in database' do
+          let(:last_france_connect_information) { FranceConnectInformation.last }
+          let(:salt) { FranceConnectSaltService.new(last_france_connect_information).salt }
+          subject { get :callback, code: code }
+
+          it { expect { subject }.to change { FranceConnectInformation.count }.by(1) }
+
+          describe 'FranceConnectInformation attributs' do
+            before do
+              get :callback, code: code
+            end
+
+            subject { last_france_connect_information }
+
+            it { expect(subject.gender).to eq gender }
+            it { expect(subject.given_name).to eq given_name }
+            it { expect(subject.family_name).to eq family_name }
+            it { expect(subject.email_france_connect).to eq email }
+            it { expect(subject.birthdate.to_time.to_i).to eq birthdate.to_time.to_i }
+            it { expect(subject.birthplace).to eq birthplace }
+            it { expect(subject.france_connect_particulier_id).to eq france_connect_particulier_id }
+          end
+
           it 'redirects to check email FC page' do
-            expect(response).to redirect_to(france_connect_particulier_new_path(user: user_info))
+            expect(subject).to redirect_to(france_connect_particulier_new_path(fci_id: last_france_connect_information.id, salt: salt))
           end
         end
       end
@@ -80,8 +127,85 @@ describe FranceConnect::ParticulierController, type: :controller do
     end
   end
 
+  describe 'POST #check_email' do
+    let(:email) { 'plop@gmail.com' }
+
+    let!(:france_connect_information) { create(:france_connect_information) }
+    let(:france_connect_information_id) { france_connect_information.id }
+    let(:salt) { FranceConnectSaltService.new(france_connect_information).salt }
+
+    subject { post :check_email, fci_id: france_connect_information_id, salt: salt, user: {email_france_connect: email} }
+
+    context 'when salt and fci_id does not matches' do
+      let(:france_connect_information_fake) { create(:france_connect_information, france_connect_particulier_id: 'iugfjh') }
+      let(:france_connect_information_id) { france_connect_information_fake.id }
+
+      it { is_expected.to redirect_to new_user_session_path }
+    end
+
+    context 'when salt and fci_id matches' do
+      context 'when email is not used' do
+        context 'when email is valid' do
+          it { expect { subject }.to change { User.count }.by(1) }
+
+          describe 'New user attributs' do
+            before do
+              subject
+            end
+
+            let(:user) { User.last }
+
+            it { expect(user.email).to eq email }
+            it { expect(user.france_connect_information).to eq france_connect_information }
+          end
+        end
+
+        context 'when email is not valid' do
+          let(:email) { 'kdjizjflk' }
+
+          it { expect { subject }.not_to change { User.count } }
+          it { is_expected.to redirect_to(france_connect_particulier_new_path fci_id: france_connect_information.id, salt: salt, user: {email_france_connect: email}) }
+        end
+      end
+
+      context 'when email is used' do
+        let!(:user) { create(:user, email: france_connect_information.email_france_connect) }
+        let(:email) { france_connect_information.email_france_connect }
+        let(:password) { user.password }
+
+        before do
+          subject
+        end
+
+        subject { post :check_email, fci_id: france_connect_information_id, salt: salt, user: {email_france_connect: email, password: password} }
+
+        context 'when email and password couple is valid' do
+          it { expect { subject }.not_to change { User.count } }
+
+          describe 'Update user attributs' do
+            before do
+              subject
+            end
+
+            it { expect(user.france_connect_information).to eq france_connect_information }
+          end
+        end
+
+        context 'when email and password couple is not valid' do
+          let(:password) { 'fake' }
+
+          it { expect(flash.alert).to eq 'Mot de passe invalide' }
+        end
+      end
+    end
+  end
+
   describe 'POST #create' do
-    subject { post :create, user: user_info }
+    let!(:france_connect_information) { create(:france_connect_information, email_france_connect: email) }
+    let(:france_connect_information_id) { france_connect_information.id }
+    let(:salt) { FranceConnectSaltService.new(france_connect_information).salt }
+
+    subject { post :create, fci_id: france_connect_information_id, salt: salt, user:{email_france_connect: france_connect_information.email_france_connect} }
 
     context 'when email is filled' do
       let(:email) { 'plop@gmail.com' }
@@ -93,38 +217,8 @@ describe FranceConnect::ParticulierController, type: :controller do
     context 'when email is incorrect' do
       let(:email) { '' }
 
-      it { expect { subject }.to change { User.count }.by(0) }
+      it { expect { subject }.not_to change { User.count } }
-      it { expect(subject).to redirect_to(france_connect_particulier_new_path(user: user_info)) }
+      it { expect(subject).to redirect_to(france_connect_particulier_new_path(fci_id: france_connect_information_id, salt: salt, user:{email_france_connect: france_connect_information.email_france_connect})) }
-    end
-  end
-
-  describe 'POST #check_email' do
-    let(:email) { 'plop@gmail.com' }
-    let(:password) { 'blabla141415' }
-
-    subject { post :check_email, user: user_info }
-
-    context 'when email is linked at an existant user' do
-      context 'when email and password couple is valid' do
-        let!(:user) { create(:user, email: email, password: password) }
-
-        it { expect { subject }.to change { user.reload.france_connect_particulier_id } }
-        it { is_expected.to redirect_to root_path }
-      end
-
-      context 'when email and password couple is not valid' do
-        let!(:user) { create(:user, email: email, password: 'plop12345678') }
-
-        before do
-          subject
-        end
-
-        it { expect(flash[:alert]).to be_present }
-      end
-    end
-
-    context 'when email is not used' do
-      it { expect { subject }.to change { User.count }.by(1) }
     end
   end
 end

spec/controllers/users/carte_controller_spec.rb

@@ -5,9 +5,9 @@ RSpec.describe Users::CarteController, type: :controller do
 
   let(:module_api_carto) { create(:module_api_carto, :with_api_carto) }
   let(:procedure) { create(:procedure, module_api_carto: module_api_carto) }
-  let(:dossier) { create(:dossier,  procedure: procedure) }
+  let(:dossier) { create(:dossier, procedure: procedure) }
 
-  let(:dossier_with_no_carto) { create(:dossier,  :with_procedure) }
+  let(:dossier_with_no_carto) { create(:dossier, :with_procedure) }
   let!(:entreprise) { create(:entreprise, dossier: dossier) }
   let!(:etablissement) { create(:etablissement, dossier: dossier) }
   let(:bad_dossier_id) { Dossier.count + 1000 }
@@ -18,6 +18,32 @@ RSpec.describe Users::CarteController, type: :controller do
   end
 
   describe 'GET #show' do
+
+    describe 'before_action authorized_routes?' do
+      context 'when dossier’s procedure have api carto actived' do
+        context 'when dossier does not have a valid state' do
+          before do
+            dossier.state = 'validated'
+            dossier.save
+
+            get :show, dossier_id: dossier.id
+          end
+
+          it { is_expected.to redirect_to root_path}
+        end
+      end
+
+      context 'when dossier’s procedure does not have api carto actived' do
+        let(:dossier) { create(:dossier, :with_procedure) }
+
+        before do
+          get :show, dossier_id: dossier.id
+        end
+
+        it { is_expected.to redirect_to(root_path) }
+      end
+    end
+
     context 'user is not connected' do
       before do
         sign_out dossier.user
@@ -60,7 +86,7 @@ RSpec.describe Users::CarteController, type: :controller do
     end
 
     context 'En train de modifier la localisation' do
-      let(:dossier) { create(:dossier, :with_procedure,  state: 'initiated') }
+      let(:dossier) { create(:dossier, :with_procedure, state: 'initiated') }
       before do
         post :save, dossier_id: dossier.id, json_latlngs: ''
       end
@@ -99,7 +125,7 @@ RSpec.describe Users::CarteController, type: :controller do
 
       context 'when json_latlngs params is empty' do
         context 'when dossier have quartier prioritaire in database' do
-          let!(:dossier) { create(:dossier,  :with_procedure, :with_two_quartier_prioritaires) }
+          let!(:dossier) { create(:dossier, :with_procedure, :with_two_quartier_prioritaires) }
 
           before do
             dossier.reload
@@ -139,14 +165,14 @@ RSpec.describe Users::CarteController, type: :controller do
       before do
         allow_any_instance_of(CARTO::SGMAP::Cadastre::Adapter).
             to receive(:to_params).
-                   and_return([{:surface_intersection=>"0.0006", :surface_parcelle=>11252.692583090324, :numero=>"0013", :feuille=>1, :section=>"CD", :code_dep=>"30", :nom_com=>"Le Grau-du-Roi", :code_com=>"133", :code_arr=>"000", :geometry=>{:type=>"MultiPolygon", :coordinates=>[[[[4.134084, 43.5209193], [4.1346615, 43.5212035], [4.1346984, 43.521189], [4.135096, 43.5213848], [4.1350839, 43.5214122], [4.1352697, 43.521505], [4.1356278, 43.5211065], [4.1357402, 43.5207188], [4.1350935, 43.5203936], [4.135002, 43.5204366], [4.1346051, 43.5202412], [4.134584, 43.5202472], [4.1345572, 43.5202551], [4.134356, 43.5203137], [4.1342488, 43.5203448], [4.134084, 43.5209193]]]]}}])
+                   and_return([{:surface_intersection => "0.0006", :surface_parcelle => 11252.692583090324, :numero => "0013", :feuille => 1, :section => "CD", :code_dep => "30", :nom_com => "Le Grau-du-Roi", :code_com => "133", :code_arr => "000", :geometry => {:type => "MultiPolygon", :coordinates => [[[[4.134084, 43.5209193], [4.1346615, 43.5212035], [4.1346984, 43.521189], [4.135096, 43.5213848], [4.1350839, 43.5214122], [4.1352697, 43.521505], [4.1356278, 43.5211065], [4.1357402, 43.5207188], [4.1350935, 43.5203936], [4.135002, 43.5204366], [4.1346051, 43.5202412], [4.134584, 43.5202472], [4.1345572, 43.5202551], [4.134356, 43.5203137], [4.1342488, 43.5203448], [4.134084, 43.5209193]]]]}}])
 
         post :save, dossier_id: dossier.id, json_latlngs: json_latlngs
       end
 
       context 'when json_latlngs params is empty' do
         context 'when dossier have cadastres in database' do
-          let!(:dossier) { create(:dossier,  :with_procedure, :with_two_cadastres) }
+          let!(:dossier) { create(:dossier, :with_procedure, :with_two_cadastres) }
 
           before do
             dossier.reload
@@ -181,7 +207,7 @@ RSpec.describe Users::CarteController, type: :controller do
           it { expect(subject.nom_com).to eq('Le Grau-du-Roi') }
           it { expect(subject.code_com).to eq('133') }
           it { expect(subject.code_arr).to eq('000') }
-          it { expect(subject.geometry).to eq({"type"=>"MultiPolygon", "coordinates"=>[[[[4.134084, 43.5209193], [4.1346615, 43.5212035], [4.1346984, 43.521189], [4.135096, 43.5213848], [4.1350839, 43.5214122], [4.1352697, 43.521505], [4.1356278, 43.5211065], [4.1357402, 43.5207188], [4.1350935, 43.5203936], [4.135002, 43.5204366], [4.1346051, 43.5202412], [4.134584, 43.5202472], [4.1345572, 43.5202551], [4.134356, 43.5203137], [4.1342488, 43.5203448], [4.134084, 43.5209193]]]]}) }
+          it { expect(subject.geometry).to eq({"type" => "MultiPolygon", "coordinates" => [[[[4.134084, 43.5209193], [4.1346615, 43.5212035], [4.1346984, 43.521189], [4.135096, 43.5213848], [4.1350839, 43.5214122], [4.1352697, 43.521505], [4.1356278, 43.5211065], [4.1357402, 43.5207188], [4.1350935, 43.5203936], [4.135002, 43.5204366], [4.1346051, 43.5202412], [4.134584, 43.5202472], [4.1345572, 43.5202551], [4.134356, 43.5203137], [4.1342488, 43.5203448], [4.134084, 43.5209193]]]]}) }
         end
       end
     end
@@ -190,7 +216,7 @@ RSpec.describe Users::CarteController, type: :controller do
   describe '#get_position' do
     context 'Geocodeur renvoie des positions nil' do
       let(:etablissement) { create(:etablissement, adresse: bad_adresse, numero_voie: 'dzj', type_voie: 'fzjfk', nom_voie: 'hdidjkz', complement_adresse: 'fjef', code_postal: 'fjeiefk', localite: 'zjfkfz') }
-      let(:dossier) { create(:dossier, :with_procedure,  etablissement: etablissement) }
+      let(:dossier) { create(:dossier, :with_procedure, etablissement: etablissement) }
       before do
         stub_request(:get, /http:\/\/api-adresse[.]data[.]gouv[.]fr\/search[?]limit=1&q=/)
             .to_return(status: 200, body: '{"query": "babouba", "version": "draft", "licence": "ODbL 1.0", "features": [], "type": "FeatureCollection", "attribution": "BAN"}', headers: {})

spec/controllers/users/description_controller_spec.rb

@@ -33,6 +33,19 @@ describe Users::DescriptionController, type: :controller do
     end
 
     it_behaves_like "not owner of dossier", :show
+
+    describe 'before_action authorized_routes?' do
+      context 'when dossier does not have a valid state' do
+        before do
+          dossier.state = 'validated'
+          dossier.save
+
+          get :show, dossier_id: dossier.id
+        end
+
+        it { is_expected.to redirect_to root_path }
+      end
+    end
   end
 
   describe 'POST #create' do

spec/controllers/users/dossiers_controller_spec.rb

@@ -30,7 +30,20 @@ describe Users::DossiersController, type: :controller do
 
     it 'redirection vers liste dossier si mauvais dossier ID' do
       get :show, id: siret_not_found
-      expect(response).to redirect_to('/users/dossiers')
+      expect(response).to redirect_to root_path
+    end
+
+    describe 'before_action authorized_routes?' do
+      context 'when dossier does not have a valid state' do
+        before do
+          dossier.state = 'validated'
+          dossier.save
+
+          get :show, id: dossier.id
+        end
+
+        it { is_expected.to redirect_to root_path }
+      end
     end
   end
 
@@ -152,7 +165,8 @@ describe Users::DossiersController, type: :controller do
         end
 
         describe 'Mandataires Sociaux' do
-          let(:user) { create(:user, given_name: given_name, family_name: family_name, birthdate: birthdate, france_connect_particulier_id: '1234567') }
+          let(:france_connect_information) { create(:france_connect_information, given_name: given_name, family_name: family_name, birthdate: birthdate, france_connect_particulier_id: '1234567') }
+          let(:user) { create(:user, france_connect_information: france_connect_information) }
 
           before do
             subject

spec/controllers/users/recapitulatif_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe Users::RecapitulatifController, type: :controller do
-  let(:dossier) { create(:dossier,  :with_procedure) }
+  let(:dossier) { create(:dossier,  :with_procedure, state:'initiated') }
   let(:bad_dossier_id) { Dossier.count + 100000 }
 
   before do
@@ -21,6 +21,19 @@ describe Users::RecapitulatifController, type: :controller do
 
     it_behaves_like "not owner of dossier", :show
 
+    describe 'before_action authorized_routes?' do
+      context 'when dossier have draft state' do
+        before do
+          dossier.state = 'draft'
+          dossier.save
+
+          get :show, dossier_id: dossier.id
+        end
+
+        it { is_expected.to redirect_to root_path }
+      end
+    end
+
   end
 
   describe 'POST #initiate' do

spec/factories/france_connect_information.rb

@@ -0,0 +1,9 @@
+FactoryGirl.define do
+  factory :france_connect_information do
+    given_name 'plop'
+    family_name 'plip'
+    birthdate '1976-02-24'
+    france_connect_particulier_id '1234567'
+    email_france_connect 'plip@octo.com'
+  end
+end

spec/features/france_connect/france_connect_particulier_spec.rb

@@ -9,8 +9,7 @@ feature 'France Connect Particulier  Connexion' do
   let(:gender) { 'M' }
   let(:birthplace) { '1234' }
   let(:email) { 'plop@plop.com' }
-  let(:know_france_connect_particulier_id) { 'blabla' }
+  let(:france_connect_particulier_id) { 'blabla' }
-  let(:unknow_france_connect_particulier_id) { 'titi' }
 
   let(:user_info) { Hashie::Mash.new(france_connect_particulier_id: france_connect_particulier_id,
                                      given_name: given_name,
@@ -34,30 +33,31 @@ feature 'France Connect Particulier  Connexion' do
       let(:code) { 'plop' }
 
       context 'when authentification is ok' do
-        let!(:user) { create(:user,
+        let(:france_connect_information) { create(:france_connect_information,
-                             france_connect_particulier_id: know_france_connect_particulier_id,
+                                                  france_connect_particulier_id: france_connect_particulier_id,
-                             given_name: given_name,
+                                                  given_name: given_name,
-                             family_name: family_name,
+                                                  family_name: family_name,
-                             birthdate: birthdate,
+                                                  birthdate: birthdate,
-                             birthplace: birthplace,
+                                                  birthplace: birthplace,
-                             gender: gender) }
+                                                  gender: gender,
+                                                  email_france_connect: email) }
 
         before do
           allow_any_instance_of(FranceConnectParticulierClient).to receive(:authorization_uri).and_return(france_connect_particulier_callback_path(code: code))
           allow(FranceConnectService).to receive(:retrieve_user_informations_particulier).and_return(user_info)
-          page.find_by_id('btn_fcp').click
         end
 
         context 'when is the first connexion' do
-          let(:france_connect_particulier_id) { unknow_france_connect_particulier_id }
+          before do
-
+            page.find_by_id('btn_fcp').click
+          end
           scenario 'he is redirected to france connect particulier page' do
             expect(page).to have_content('Nouvelle connexion')
           end
 
           context 'when he fill an email and valid' do
             before do
-              page.find_by_id('user_email').set email
+              page.find_by_id('user_email_france_connect').set email
               page.find_by_id('valid_new_fcp').click
             end
 
@@ -68,7 +68,10 @@ feature 'France Connect Particulier  Connexion' do
         end
 
         context 'when is not the first connexion' do
-          let(:france_connect_particulier_id) { know_france_connect_particulier_id }
+          before do
+            create(:user, france_connect_information: france_connect_information)
+            page.find_by_id('btn_fcp').click
+          end
 
           scenario 'he is redirected to user dossiers page' do
             expect(page).to have_content('Mes dossiers')

spec/features/users/drawing_a_zone_with_freedraw_spec.rb

@@ -38,7 +38,7 @@ feature 'drawing a zone with freedraw' do
         end
 
         scenario 'alert message is present' do
-          expect(page).to have_content('Le dossier n\'a pas accès à la cartographie')
+          expect(page).to have_content('Le status de votre dossier n\'autorise pas cette URL')
         end
       end
 

spec/models/france_connect_information_spec.rb

@@ -0,0 +1,41 @@
+require 'rails_helper'
+
+describe FranceConnectInformation, type: :model do
+  describe 'database columns' do
+    it { is_expected.to have_db_column(:given_name) }
+    it { is_expected.to have_db_column(:family_name) }
+    it { is_expected.to have_db_column(:email_france_connect) }
+    it { is_expected.to have_db_column(:birthdate) }
+    it { is_expected.to have_db_column(:gender) }
+    it { is_expected.to have_db_column(:birthplace) }
+    it { is_expected.to have_db_column(:france_connect_particulier_id) }
+  end
+
+  describe 'associations' do
+    it { is_expected.to belong_to(:user) }
+  end
+
+  describe 'validation' do
+    context 'france_connect_particulier_id' do
+      it { is_expected.not_to allow_value(nil).for(:france_connect_particulier_id) }
+      it { is_expected.not_to allow_value('').for(:france_connect_particulier_id) }
+      it { is_expected.to allow_value('mon super projet').for(:france_connect_particulier_id) }
+    end
+  end
+
+  describe '.find_by_france_connect_particulier' do
+    let(:user_info) { {france_connect_particulier_id: '123456'} }
+
+    subject { described_class.find_by_france_connect_particulier user_info }
+
+    context 'when france_connect_particulier_id is prensent in database' do
+      let!(:france_connect_information) { create(:france_connect_information, france_connect_particulier_id: '123456') }
+
+      it { is_expected.to eq france_connect_information }
+    end
+
+    context 'when france_connect_particulier_id is prensent in database' do
+      it { is_expected.to eq nil }
+    end
+  end
+end

spec/models/user_spec.rb

@@ -16,12 +16,6 @@ describe User, type: :model do
     it { is_expected.to have_db_column(:updated_at) }
     it { is_expected.to have_db_column(:siret) }
     it { is_expected.to have_db_column(:loged_in_with_france_connect) }
-    it { is_expected.to have_db_column(:given_name) }
-    it { is_expected.to have_db_column(:family_name) }
-    it { is_expected.to have_db_column(:birthdate) }
-    it { is_expected.to have_db_column(:gender) }
-    it { is_expected.to have_db_column(:birthplace) }
-    it { is_expected.to have_db_column(:france_connect_particulier_id) }
 
   end
   describe 'associations' do

spec/services/france_connect_salt_service_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe FranceConnectSaltService do
+  describe '.initialize' do
+    context 'when args is not a FranceConnectInformation class' do
+      let(:args) { create(:dossier) }
+
+      subject { described_class.new args }
+
+      it { expect { subject }.to raise_error 'Not a FranceConnectInformation class' }
+    end
+  end
+
+  describe '.valid?' do
+    let(:france_connect_information) { create(:france_connect_information) }
+    let(:salt_service) { FranceConnectSaltService.new(france_connect_information) }
+    let(:salt) { salt_service.salt }
+
+    context 'when france_connect_information_id is correct' do
+      let(:france_connect_information_id) { france_connect_information.id }
+      let(:france_connect_information_get_with_id) { FranceConnectInformation.find(france_connect_information_id) }
+      let(:salt_service_compare) { FranceConnectSaltService.new france_connect_information_get_with_id }
+
+      subject { salt_service_compare.valid? salt }
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when france_connect_information_id is not correct' do
+      let(:france_connect_information_fake) { create(:france_connect_information, france_connect_particulier_id: '87515272') }
+
+      let(:france_connect_information_id) { france_connect_information_fake.id }
+      let(:france_connect_information_get_with_id) { FranceConnectInformation.find(france_connect_information_id) }
+      let(:salt_service_compare) { FranceConnectSaltService.new france_connect_information_get_with_id }
+
+      subject { salt_service_compare.valid? salt }
+
+      it { is_expected.to be_falsey }
+    end
+  end
+end

spec/services/user_routes_authorization_service_spec.rb

@@ -0,0 +1,223 @@
+require 'spec_helper'
+
+describe UserRoutesAuthorizationService do
+
+  describe '#authorize_route?' do
+    let(:api_carto) { false }
+
+    subject { described_class.authorized_route? path, state, api_carto }
+
+    context 'when path is not recognized' do
+      let(:state) { 'blabla' }
+      let(:path) { 'blabla' }
+
+      it { expect { subject }.to raise_error 'Not a valid path' }
+    end
+
+    context 'when state is not recognized' do
+      let(:state) { 'blabla' }
+      let(:path) { '' }
+
+      it { expect { subject }.to raise_error 'Not a valid state' }
+    end
+
+    context 'when path and state are recognized' do
+      describe 'root' do
+        let(:path) { '' }
+
+        describe 'draft' do
+          let(:state) { 'draft' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'initiated' do
+          let(:state) { 'initiated' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'replied' do
+          let(:state) { 'replied' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'updated' do
+          let(:state) { 'updated' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'validated' do
+          let(:state) { 'validated' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'submitted' do
+          let(:state) { 'submitted' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'closed' do
+          let(:state) { 'closed' }
+          it { is_expected.to be_falsey }
+        end
+      end
+
+      describe 'carte' do
+        let(:path) { '/carte' }
+        context 'when use_api_carto is false' do
+
+          describe 'draft' do
+            let(:state) { 'draft' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'initiated' do
+            let(:state) { 'initiated' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'replied' do
+            let(:state) { 'replied' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'updated' do
+            let(:state) { 'updated' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'validated' do
+            let(:state) { 'validated' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'submitted' do
+            let(:state) { 'submitted' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'closed' do
+            let(:state) { 'closed' }
+            it { is_expected.to be_falsey }
+          end
+        end
+
+        context 'when use_api_carto is true' do
+          let(:api_carto) { true }
+
+          describe 'draft' do
+            let(:state) { 'draft' }
+            it { is_expected.to be_truthy }
+          end
+
+          describe 'initiated' do
+            let(:state) { 'initiated' }
+            it { is_expected.to be_truthy }
+          end
+
+          describe 'replied' do
+            let(:state) { 'replied' }
+            it { is_expected.to be_truthy }
+          end
+
+          describe 'updated' do
+            let(:state) { 'updated' }
+            it { is_expected.to be_truthy }
+          end
+
+          describe 'validated' do
+            let(:state) { 'validated' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'submitted' do
+            let(:state) { 'submitted' }
+            it { is_expected.to be_falsey }
+          end
+
+          describe 'closed' do
+            let(:state) { 'closed' }
+            it { is_expected.to be_falsey }
+          end
+        end
+      end
+
+      describe 'description' do
+        let(:path) { '/description' }
+
+        describe 'draft' do
+          let(:state) { 'draft' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'initiated' do
+          let(:state) { 'initiated' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'replied' do
+          let(:state) { 'replied' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'updated' do
+          let(:state) { 'updated' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'validated' do
+          let(:state) { 'validated' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'submitted' do
+          let(:state) { 'submitted' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'closed' do
+          let(:state) { 'closed' }
+          it { is_expected.to be_falsey }
+        end
+      end
+
+      describe 'recapitulatif' do
+        let(:path) { '/recapitulatif' }
+
+        describe 'draft' do
+          let(:state) { 'draft' }
+          it { is_expected.to be_falsey }
+        end
+
+        describe 'initiated' do
+          let(:state) { 'initiated' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'replied' do
+          let(:state) { 'replied' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'updated' do
+          let(:state) { 'updated' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'validated' do
+          let(:state) { 'validated' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'submitted' do
+          let(:state) { 'submitted' }
+          it { is_expected.to be_truthy }
+        end
+
+        describe 'closed' do
+          let(:state) { 'closed' }
+          it { is_expected.to be_truthy }
+        end
+      end
+    end
+  end
+end