experts: fix saving password on sign-in

app/controllers/experts/avis_controller.rb

@@ -82,12 +82,11 @@ module Experts
       email = params[:email]
       password = params[:user][:password]
 
-      # Not perfect because the password will not be changed if the user already exists
       user = User.create_or_promote_to_expert(email, password)
+      user.reset_password(password, password)
 
       if user.valid?
         sign_in(user)
-
         redirect_to url_for(expert_all_avis_path)
       else
         flash[:alert] = user.errors.full_messages

spec/controllers/experts/avis_controller_spec.rb

@@ -360,6 +360,11 @@ describe Experts::AvisController, type: :controller do
       context 'when the expert hasn’t signed up yet' do
         before { expert.user.update(last_sign_in_at: nil) }
 
+        it 'saves the expert new password' do
+          subject
+          expect(expert.user.reload.valid_password?('my-s3cure-p4ssword')).to be true
+        end
+
         it { is_expected.to redirect_to expert_all_avis_path }
       end
     end

spec/features/experts/expert_spec.rb

@@ -11,16 +11,30 @@ feature 'Inviting an expert:' do
     let(:avis) { create(:avis, dossier: dossier, claimant: instructeur, experts_procedure: experts_procedure, confidentiel: true) }
 
     context 'when I don’t already have an account' do
-      scenario 'I can sign up' do
+      let(:password) { 'This is an expert password' }
+
+      before 'Signing up' do
         visit sign_up_expert_avis_path(avis.dossier.procedure, avis, email: avis.expert.email)
 
         expect(page).to have_field('Email', with: avis.expert.email, disabled: true)
-        fill_in 'Mot de passe', with: 'This is a very complicated password !'
+        fill_in 'Mot de passe', with: password
         click_on 'Créer un compte'
+      end
 
+      scenario 'I can see the avis after signing up' do
         expect(page).to have_current_path(expert_all_avis_path)
         expect(page).to have_text('1 avis à donner')
       end
+
+      scenario 'I can sign-in again afterwards' do
+        click_on 'Se déconnecter'
+
+        visit new_user_session_path
+        sign_in_with avis.expert.email, password
+
+        expect(page).to have_content('Connecté(e).')
+        expect(page).to have_current_path(dossiers_path) # Ideally we'd want `expert_all_avis_path` instead
+      end
     end
 
     context 'when I already have an existing account' do