user_spec.rb 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516
  1. require 'rails_helper'
  2. require 'devise_two_factor/spec_helpers'
  3. RSpec.describe User, type: :model do
  4. it_behaves_like 'two_factor_backupable'
  5. describe 'otp_secret' do
  6. it 'is encrypted with OTP_SECRET environment variable' do
  7. user = Fabricate(:user,
  8. encrypted_otp_secret: "Fttsy7QAa0edaDfdfSz094rRLAxc8cJweDQ4BsWH/zozcdVA8o9GLqcKhn2b\nGi/V\n",
  9. encrypted_otp_secret_iv: 'rys3THICkr60BoWC',
  10. encrypted_otp_secret_salt: '_LMkAGvdg7a+sDIKjI3mR2Q==')
  11. expect(user.otp_secret).to eq 'anotpsecretthatshouldbeencrypted'
  12. end
  13. end
  14. describe 'validations' do
  15. it 'is invalid without an account' do
  16. user = Fabricate.build(:user, account: nil)
  17. user.valid?
  18. expect(user).to model_have_error_on_field(:account)
  19. end
  20. it 'is invalid without a valid locale' do
  21. user = Fabricate.build(:user, locale: 'toto')
  22. user.valid?
  23. expect(user).to model_have_error_on_field(:locale)
  24. end
  25. it 'is invalid without a valid email' do
  26. user = Fabricate.build(:user, email: 'john@')
  27. user.valid?
  28. expect(user).to model_have_error_on_field(:email)
  29. end
  30. it 'is valid with an invalid e-mail that has already been saved' do
  31. user = Fabricate.build(:user, email: 'invalid-email')
  32. user.save(validate: false)
  33. expect(user.valid?).to be true
  34. end
  35. it 'cleans out empty string from languages' do
  36. user = Fabricate.build(:user, chosen_languages: [''])
  37. user.valid?
  38. expect(user.chosen_languages).to eq nil
  39. end
  40. end
  41. describe 'scopes' do
  42. describe 'recent' do
  43. it 'returns an array of recent users ordered by id' do
  44. user_1 = Fabricate(:user)
  45. user_2 = Fabricate(:user)
  46. expect(User.recent).to eq [user_2, user_1]
  47. end
  48. end
  49. describe 'admins' do
  50. it 'returns an array of users who are admin' do
  51. user_1 = Fabricate(:user, admin: false)
  52. user_2 = Fabricate(:user, admin: true)
  53. expect(User.admins).to match_array([user_2])
  54. end
  55. end
  56. describe 'confirmed' do
  57. it 'returns an array of users who are confirmed' do
  58. user_1 = Fabricate(:user, confirmed_at: nil)
  59. user_2 = Fabricate(:user, confirmed_at: Time.zone.now)
  60. expect(User.confirmed).to match_array([user_2])
  61. end
  62. end
  63. describe 'inactive' do
  64. it 'returns a relation of inactive users' do
  65. specified = Fabricate(:user, current_sign_in_at: 15.days.ago)
  66. Fabricate(:user, current_sign_in_at: 6.days.ago)
  67. expect(User.inactive).to match_array([specified])
  68. end
  69. end
  70. describe 'matches_email' do
  71. it 'returns a relation of users whose email starts with the given string' do
  72. specified = Fabricate(:user, email: 'specified@spec')
  73. Fabricate(:user, email: 'unspecified@spec')
  74. expect(User.matches_email('specified')).to match_array([specified])
  75. end
  76. end
  77. end
  78. let(:account) { Fabricate(:account, username: 'alice') }
  79. let(:password) { 'abcd1234' }
  80. describe 'blacklist' do
  81. around(:each) do |example|
  82. old_blacklist = Rails.configuration.x.email_blacklist
  83. Rails.configuration.x.email_domains_blacklist = 'mvrht.com'
  84. example.run
  85. Rails.configuration.x.email_domains_blacklist = old_blacklist
  86. end
  87. it 'should allow a non-blacklisted user to be created' do
  88. user = User.new(email: 'foo@example.com', account: account, password: password, agreement: true)
  89. expect(user.valid?).to be_truthy
  90. end
  91. it 'should not allow a blacklisted user to be created' do
  92. user = User.new(email: 'foo@mvrht.com', account: account, password: password, agreement: true)
  93. expect(user.valid?).to be_falsey
  94. end
  95. it 'should not allow a subdomain blacklisted user to be created' do
  96. user = User.new(email: 'foo@mvrht.com.topdomain.tld', account: account, password: password, agreement: true)
  97. expect(user.valid?).to be_falsey
  98. end
  99. end
  100. describe '#confirmed?' do
  101. it 'returns true when a confirmed_at is set' do
  102. user = Fabricate.build(:user, confirmed_at: Time.now.utc)
  103. expect(user.confirmed?).to be true
  104. end
  105. it 'returns false if a confirmed_at is nil' do
  106. user = Fabricate.build(:user, confirmed_at: nil)
  107. expect(user.confirmed?).to be false
  108. end
  109. end
  110. describe '#confirm' do
  111. it 'sets email to unconfirmed_email' do
  112. user = Fabricate.build(:user, confirmed_at: Time.now.utc, unconfirmed_email: 'new-email@example.com')
  113. user.confirm
  114. expect(user.email).to eq 'new-email@example.com'
  115. end
  116. end
  117. describe '#disable_two_factor!' do
  118. it 'saves false for otp_required_for_login' do
  119. user = Fabricate.build(:user, otp_required_for_login: true)
  120. user.disable_two_factor!
  121. expect(user.reload.otp_required_for_login).to be false
  122. end
  123. it 'saves cleared otp_backup_codes' do
  124. user = Fabricate.build(:user, otp_backup_codes: %w(dummy dummy))
  125. user.disable_two_factor!
  126. expect(user.reload.otp_backup_codes.empty?).to be true
  127. end
  128. end
  129. describe '#send_confirmation_instructions' do
  130. around do |example|
  131. queue_adapter = ActiveJob::Base.queue_adapter
  132. example.run
  133. ActiveJob::Base.queue_adapter = queue_adapter
  134. end
  135. it 'delivers confirmation instructions later' do
  136. user = Fabricate(:user)
  137. ActiveJob::Base.queue_adapter = :test
  138. expect { user.send_confirmation_instructions }.to have_enqueued_job(ActionMailer::DeliveryJob)
  139. end
  140. end
  141. describe 'settings' do
  142. it 'is instance of Settings::ScopedSettings' do
  143. user = Fabricate(:user)
  144. expect(user.settings).to be_kind_of Settings::ScopedSettings
  145. end
  146. end
  147. describe '#setting_default_privacy' do
  148. it 'returns default privacy setting if user has configured' do
  149. user = Fabricate(:user)
  150. user.settings[:default_privacy] = 'unlisted'
  151. expect(user.setting_default_privacy).to eq 'unlisted'
  152. end
  153. it "returns 'private' if user has not configured default privacy setting and account is locked" do
  154. user = Fabricate(:user, account: Fabricate(:account, locked: true))
  155. expect(user.setting_default_privacy).to eq 'private'
  156. end
  157. it "returns 'public' if user has not configured default privacy setting and account is not locked" do
  158. user = Fabricate(:user, account: Fabricate(:account, locked: false))
  159. expect(user.setting_default_privacy).to eq 'public'
  160. end
  161. end
  162. describe 'whitelist' do
  163. around(:each) do |example|
  164. old_whitelist = Rails.configuration.x.email_whitelist
  165. Rails.configuration.x.email_domains_whitelist = 'mastodon.space'
  166. example.run
  167. Rails.configuration.x.email_domains_whitelist = old_whitelist
  168. end
  169. it 'should not allow a user to be created unless they are whitelisted' do
  170. user = User.new(email: 'foo@example.com', account: account, password: password, agreement: true)
  171. expect(user.valid?).to be_falsey
  172. end
  173. it 'should allow a user to be created if they are whitelisted' do
  174. user = User.new(email: 'foo@mastodon.space', account: account, password: password, agreement: true)
  175. expect(user.valid?).to be_truthy
  176. end
  177. it 'should not allow a user with a whitelisted top domain as subdomain in their email address to be created' do
  178. user = User.new(email: 'foo@mastodon.space.userdomain.com', account: account, password: password, agreement: true)
  179. expect(user.valid?).to be_falsey
  180. end
  181. context do
  182. around do |example|
  183. old_blacklist = Rails.configuration.x.email_blacklist
  184. example.run
  185. Rails.configuration.x.email_domains_blacklist = old_blacklist
  186. end
  187. it 'should not allow a user to be created with a specific blacklisted subdomain even if the top domain is whitelisted' do
  188. Rails.configuration.x.email_domains_blacklist = 'blacklisted.mastodon.space'
  189. user = User.new(email: 'foo@blacklisted.mastodon.space', account: account, password: password)
  190. expect(user.valid?).to be_falsey
  191. end
  192. end
  193. end
  194. it_behaves_like 'Settings-extended' do
  195. def create!
  196. User.create!(account: Fabricate(:account), email: 'foo@mastodon.space', password: 'abcd1234', agreement: true)
  197. end
  198. def fabricate
  199. Fabricate(:user)
  200. end
  201. end
  202. describe 'token_for_app' do
  203. let(:user) { Fabricate(:user) }
  204. let(:app) { Fabricate(:application, owner: user) }
  205. it 'returns a token' do
  206. expect(user.token_for_app(app)).to be_a(Doorkeeper::AccessToken)
  207. end
  208. it 'persists a token' do
  209. t = user.token_for_app(app)
  210. expect(user.token_for_app(app)).to eql(t)
  211. end
  212. it 'is nil if user does not own app' do
  213. app.update!(owner: nil)
  214. expect(user.token_for_app(app)).to be_nil
  215. end
  216. end
  217. describe '#role' do
  218. it 'returns admin for admin' do
  219. user = User.new(admin: true)
  220. expect(user.role).to eq 'admin'
  221. end
  222. it 'returns moderator for moderator' do
  223. user = User.new(moderator: true)
  224. expect(user.role).to eq 'moderator'
  225. end
  226. it 'returns user otherwise' do
  227. user = User.new
  228. expect(user.role).to eq 'user'
  229. end
  230. end
  231. describe '#role?' do
  232. it 'returns false when invalid role requested' do
  233. user = User.new(admin: true)
  234. expect(user.role?('disabled')).to be false
  235. end
  236. it 'returns true when exact role match' do
  237. user = User.new
  238. mod = User.new(moderator: true)
  239. admin = User.new(admin: true)
  240. expect(user.role?('user')).to be true
  241. expect(mod.role?('moderator')).to be true
  242. expect(admin.role?('admin')).to be true
  243. end
  244. it 'returns true when role higher than needed' do
  245. mod = User.new(moderator: true)
  246. admin = User.new(admin: true)
  247. expect(mod.role?('user')).to be true
  248. expect(admin.role?('user')).to be true
  249. expect(admin.role?('moderator')).to be true
  250. end
  251. end
  252. describe '#disable!' do
  253. subject(:user) { Fabricate(:user, disabled: false, current_sign_in_at: current_sign_in_at, last_sign_in_at: nil) }
  254. let(:current_sign_in_at) { Time.zone.now }
  255. before do
  256. user.disable!
  257. end
  258. it 'disables user' do
  259. expect(user).to have_attributes(disabled: true)
  260. end
  261. end
  262. describe '#enable!' do
  263. subject(:user) { Fabricate(:user, disabled: true) }
  264. before do
  265. user.enable!
  266. end
  267. it 'enables user' do
  268. expect(user).to have_attributes(disabled: false)
  269. end
  270. end
  271. describe '#confirm!' do
  272. subject(:user) { Fabricate(:user, confirmed_at: confirmed_at) }
  273. before do
  274. ActionMailer::Base.deliveries.clear
  275. user.confirm!
  276. end
  277. after { ActionMailer::Base.deliveries.clear }
  278. context 'when user is new' do
  279. let(:confirmed_at) { nil }
  280. it 'confirms user' do
  281. expect(user.confirmed_at).to be_present
  282. end
  283. it 'delivers mails' do
  284. expect(ActionMailer::Base.deliveries.count).to eq 2
  285. end
  286. end
  287. context 'when user is not new' do
  288. let(:confirmed_at) { Time.zone.now }
  289. it 'confirms user' do
  290. expect(user.confirmed_at).to be_present
  291. end
  292. it 'does not deliver mail' do
  293. expect(ActionMailer::Base.deliveries.count).to eq 0
  294. end
  295. end
  296. end
  297. describe '#promote!' do
  298. subject(:user) { Fabricate(:user, admin: is_admin, moderator: is_moderator) }
  299. before do
  300. user.promote!
  301. end
  302. context 'when user is an admin' do
  303. let(:is_admin) { true }
  304. context 'when user is a moderator' do
  305. let(:is_moderator) { true }
  306. it 'changes moderator filed false' do
  307. expect(user).to be_admin
  308. expect(user).not_to be_moderator
  309. end
  310. end
  311. context 'when user is not a moderator' do
  312. let(:is_moderator) { false }
  313. it 'does not change status' do
  314. expect(user).to be_admin
  315. expect(user).not_to be_moderator
  316. end
  317. end
  318. end
  319. context 'when user is not admin' do
  320. let(:is_admin) { false }
  321. context 'when user is a moderator' do
  322. let(:is_moderator) { true }
  323. it 'changes user into an admin' do
  324. expect(user).to be_admin
  325. expect(user).not_to be_moderator
  326. end
  327. end
  328. context 'when user is not a moderator' do
  329. let(:is_moderator) { false }
  330. it 'changes user into a moderator' do
  331. expect(user).not_to be_admin
  332. expect(user).to be_moderator
  333. end
  334. end
  335. end
  336. end
  337. describe '#demote!' do
  338. subject(:user) { Fabricate(:user, admin: admin, moderator: moderator) }
  339. before do
  340. user.demote!
  341. end
  342. context 'when user is an admin' do
  343. let(:admin) { true }
  344. context 'when user is a moderator' do
  345. let(:moderator) { true }
  346. it 'changes user into a moderator' do
  347. expect(user).not_to be_admin
  348. expect(user).to be_moderator
  349. end
  350. end
  351. context 'when user is not a moderator' do
  352. let(:moderator) { false }
  353. it 'changes user into a moderator' do
  354. expect(user).not_to be_admin
  355. expect(user).to be_moderator
  356. end
  357. end
  358. end
  359. context 'when user is not an admin' do
  360. let(:admin) { false }
  361. context 'when user is a moderator' do
  362. let(:moderator) { true }
  363. it 'changes user into a plain user' do
  364. expect(user).not_to be_admin
  365. expect(user).not_to be_moderator
  366. end
  367. end
  368. context 'when user is not a moderator' do
  369. let(:moderator) { false }
  370. it 'does not change any fields' do
  371. expect(user).not_to be_admin
  372. expect(user).not_to be_moderator
  373. end
  374. end
  375. end
  376. end
  377. describe '#active_for_authentication?' do
  378. subject { user.active_for_authentication? }
  379. let(:user) { Fabricate(:user, disabled: disabled, confirmed_at: confirmed_at) }
  380. context 'when user is disabled' do
  381. let(:disabled) { true }
  382. context 'when user is confirmed' do
  383. let(:confirmed_at) { Time.zone.now }
  384. it { is_expected.to be true }
  385. end
  386. context 'when user is not confirmed' do
  387. let(:confirmed_at) { nil }
  388. it { is_expected.to be true }
  389. end
  390. end
  391. context 'when user is not disabled' do
  392. let(:disabled) { false }
  393. context 'when user is confirmed' do
  394. let(:confirmed_at) { Time.zone.now }
  395. it { is_expected.to be true }
  396. end
  397. context 'when user is not confirmed' do
  398. let(:confirmed_at) { nil }
  399. it { is_expected.to be true }
  400. end
  401. end
  402. end
  403. end