spec/controllers/auth/sessions_controller_spec.rb

   1 # frozen_string_literal: true
   2
   3 require 'rails_helper'
   4
   5 RSpec.describe Auth::SessionsController, type: :controller do
   6   render_views
   7
   8   describe 'GET #new' do
   9     before do
  10       request.env['devise.mapping'] = Devise.mappings[:user]
  11     end
  12
  13     it 'returns http success' do
  14       get :new
  15       expect(response).to have_http_status(:success)
  16     end
  17   end
  18
  19   describe 'DELETE #destroy' do
  20     let(:user) { Fabricate(:user) }
  21
  22     before do
  23       request.env['devise.mapping'] = Devise.mappings[:user]
  24     end
  25
  26     context 'with a regular user' do
  27       it 'redirects to home after sign out' do
  28         sign_in(user, scope: :user)
  29         delete :destroy
  30
  31         expect(response).to redirect_to(new_user_session_path)
  32       end
  33     end
  34
  35     context 'with a suspended user' do
  36       it 'redirects to home after sign out' do
  37         Fabricate(:account, user: user, suspended: true)
  38         sign_in(user, scope: :user)
  39         delete :destroy
  40
  41         expect(response).to redirect_to(new_user_session_path)
  42       end
  43     end
  44   end
  45
  46   describe 'POST #create' do
  47     before do
  48       request.env['devise.mapping'] = Devise.mappings[:user]
  49     end
  50
  51     context 'using password authentication' do
  52       let(:user) { Fabricate(:user, email: 'foo@bar.com', password: 'abcdefgh') }
  53
  54       context 'using a valid password' do
  55         before do
  56           post :create, params: { user: { email: user.email, password: user.password } }
  57         end
  58
  59         it 'redirects to home' do
  60           expect(response).to redirect_to(root_path)
  61         end
  62
  63         it 'logs the user in' do
  64           expect(controller.current_user).to eq user
  65         end
  66       end
  67
  68       context 'using email with uppercase letters' do
  69         before do
  70           post :create, params: { user: { email: user.email.upcase, password: user.password } }
  71         end
  72
  73         it 'redirects to home' do
  74           expect(response).to redirect_to(root_path)
  75         end
  76
  77         it 'logs the user in' do
  78           expect(controller.current_user).to eq user
  79         end
  80       end
  81
  82       context 'using an invalid password' do
  83         before do
  84           post :create, params: { user: { email: user.email, password: 'wrongpw' } }
  85         end
  86
  87         it 'shows a login error' do
  88           expect(flash[:alert]).to match I18n.t('devise.failure.invalid', authentication_keys: 'Email')
  89         end
  90
  91         it "doesn't log the user in" do
  92           expect(controller.current_user).to be_nil
  93         end
  94       end
  95
  96       context 'using an unconfirmed password' do
  97         before do
  98           request.headers['Accept-Language'] = accept_language
  99           post :create, params: { user: { email: unconfirmed_user.email, password: unconfirmed_user.password } }
 100         end
 101
 102         let(:unconfirmed_user) { user.tap { |u| u.update!(confirmed_at: nil) } }
 103         let(:accept_language) { 'fr' }
 104
 105         it 'shows a translated login error' do
 106           expect(flash[:alert]).to eq(I18n.t('devise.failure.unconfirmed', locale: accept_language))
 107         end
 108       end
 109
 110       context "logging in from the user's page" do
 111         before do
 112           allow(controller).to receive(:single_user_mode?).and_return(single_user_mode)
 113           allow(controller).to receive(:stored_location_for).with(:user).and_return("/@#{user.account.username}")
 114           post :create, params: { user: { email: user.email, password: user.password } }
 115         end
 116
 117         context "in single user mode" do
 118           let(:single_user_mode) { true }
 119
 120           it 'redirects to home' do
 121             expect(response).to redirect_to(root_path)
 122           end
 123         end
 124
 125         context "in non-single user mode" do
 126           let(:single_user_mode) { false }
 127
 128           it "redirects back to the user's page" do
 129             expect(response).to redirect_to(short_account_path(username: user.account))
 130           end
 131         end
 132       end
 133     end
 134
 135     context 'using two-factor authentication' do
 136       let(:user) do
 137         Fabricate(:user, email: 'x@y.com', password: 'abcdefgh',
 138                          otp_required_for_login: true, otp_secret: User.generate_otp_secret(32))
 139       end
 140       let(:recovery_codes) do
 141         codes = user.generate_otp_backup_codes!
 142         user.save
 143         return codes
 144       end
 145
 146       context 'using email and password' do
 147         before do
 148           post :create, params: { user: { email: user.email, password: user.password } }
 149         end
 150
 151         it 'renders two factor authentication page' do
 152           expect(controller).to render_template("two_factor")
 153         end
 154       end
 155
 156       context 'using upcase email and password' do
 157         before do
 158           post :create, params: { user: { email: user.email.upcase, password: user.password } }
 159         end
 160
 161         it 'renders two factor authentication page' do
 162           expect(controller).to render_template("two_factor")
 163         end
 164       end
 165
 166       context 'using a valid OTP' do
 167         before do
 168           post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
 169         end
 170
 171         it 'redirects to home' do
 172           expect(response).to redirect_to(root_path)
 173         end
 174
 175         it 'logs the user in' do
 176           expect(controller.current_user).to eq user
 177         end
 178       end
 179
 180       context 'when the server has an decryption error' do
 181         before do
 182           allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_raise(OpenSSL::Cipher::CipherError)
 183           post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
 184         end
 185
 186         it 'shows a login error' do
 187           expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
 188         end
 189
 190         it "doesn't log the user in" do
 191           expect(controller.current_user).to be_nil
 192         end
 193       end
 194
 195       context 'using a valid recovery code' do
 196         before do
 197           post :create, params: { user: { otp_attempt: recovery_codes.first } }, session: { otp_user_id: user.id }
 198         end
 199
 200         it 'redirects to home' do
 201           expect(response).to redirect_to(root_path)
 202         end
 203
 204         it 'logs the user in' do
 205           expect(controller.current_user).to eq user
 206         end
 207       end
 208
 209       context 'using an invalid OTP' do
 210         before do
 211           post :create, params: { user: { otp_attempt: 'wrongotp' } }, session: { otp_user_id: user.id }
 212         end
 213
 214         it 'shows a login error' do
 215           expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
 216         end
 217
 218         it "doesn't log the user in" do
 219           expect(controller.current_user).to be_nil
 220         end
 221       end
 222     end
 223   end
 224 end