sessions_controller_spec.rb 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282
  1. # frozen_string_literal: true
  2. require 'rails_helper'
  3. RSpec.describe Auth::SessionsController, type: :controller do
  4. render_views
  5. describe 'GET #new' do
  6. before do
  7. request.env['devise.mapping'] = Devise.mappings[:user]
  8. end
  9. it 'returns http success' do
  10. get :new
  11. expect(response).to have_http_status(200)
  12. end
  13. end
  14. describe 'DELETE #destroy' do
  15. let(:user) { Fabricate(:user) }
  16. before do
  17. request.env['devise.mapping'] = Devise.mappings[:user]
  18. end
  19. context 'with a regular user' do
  20. it 'redirects to home after sign out' do
  21. sign_in(user, scope: :user)
  22. delete :destroy
  23. expect(response).to redirect_to(new_user_session_path)
  24. end
  25. it 'does not delete redirect location with continue=true' do
  26. sign_in(user, scope: :user)
  27. controller.store_location_for(:user, '/authorize')
  28. delete :destroy, params: { continue: 'true' }
  29. expect(controller.stored_location_for(:user)).to eq '/authorize'
  30. end
  31. end
  32. context 'with a suspended user' do
  33. it 'redirects to home after sign out' do
  34. Fabricate(:account, user: user, suspended: true)
  35. sign_in(user, scope: :user)
  36. delete :destroy
  37. expect(response).to redirect_to(new_user_session_path)
  38. end
  39. end
  40. end
  41. describe 'POST #create' do
  42. before do
  43. request.env['devise.mapping'] = Devise.mappings[:user]
  44. end
  45. context 'using PAM authentication', if: ENV['PAM_ENABLED'] == 'true' do
  46. context 'using a valid password' do
  47. before do
  48. post :create, params: { user: { email: "pam_user1", password: '123456' } }
  49. end
  50. it 'redirects to home' do
  51. expect(response).to redirect_to(root_path)
  52. end
  53. it 'logs the user in' do
  54. expect(controller.current_user).to be_instance_of(User)
  55. end
  56. end
  57. context 'using an invalid password' do
  58. before do
  59. post :create, params: { user: { email: "pam_user1", password: 'WRONGPW' } }
  60. end
  61. it 'shows a login error' do
  62. expect(flash[:alert]).to match I18n.t('devise.failure.invalid', authentication_keys: 'Email')
  63. end
  64. it "doesn't log the user in" do
  65. expect(controller.current_user).to be_nil
  66. end
  67. end
  68. context 'using a valid email and existing user' do
  69. let(:user) do
  70. account = Fabricate.build(:account, username: 'pam_user1')
  71. account.save!(validate: false)
  72. user = Fabricate(:user, email: 'pam@example.com', password: nil, account: account)
  73. user
  74. end
  75. before do
  76. post :create, params: { user: { email: user.email, password: '123456' } }
  77. end
  78. it 'redirects to home' do
  79. expect(response).to redirect_to(root_path)
  80. end
  81. it 'logs the user in' do
  82. expect(controller.current_user).to eq user
  83. end
  84. end
  85. end
  86. context 'using password authentication' do
  87. let(:user) { Fabricate(:user, email: 'foo@bar.com', password: 'abcdefgh') }
  88. context 'using a valid password' do
  89. before do
  90. post :create, params: { user: { email: user.email, password: user.password } }
  91. end
  92. it 'redirects to home' do
  93. expect(response).to redirect_to(root_path)
  94. end
  95. it 'logs the user in' do
  96. expect(controller.current_user).to eq user
  97. end
  98. end
  99. context 'using email with uppercase letters' do
  100. before do
  101. post :create, params: { user: { email: user.email.upcase, password: user.password } }
  102. end
  103. it 'redirects to home' do
  104. expect(response).to redirect_to(root_path)
  105. end
  106. it 'logs the user in' do
  107. expect(controller.current_user).to eq user
  108. end
  109. end
  110. context 'using an invalid password' do
  111. before do
  112. post :create, params: { user: { email: user.email, password: 'wrongpw' } }
  113. end
  114. it 'shows a login error' do
  115. expect(flash[:alert]).to match I18n.t('devise.failure.invalid', authentication_keys: 'Email')
  116. end
  117. it "doesn't log the user in" do
  118. expect(controller.current_user).to be_nil
  119. end
  120. end
  121. context 'using an unconfirmed password' do
  122. before do
  123. request.headers['Accept-Language'] = accept_language
  124. post :create, params: { user: { email: unconfirmed_user.email, password: unconfirmed_user.password } }
  125. end
  126. let(:unconfirmed_user) { user.tap { |u| u.update!(confirmed_at: nil) } }
  127. let(:accept_language) { 'fr' }
  128. it 'shows a translated login error' do
  129. expect(flash[:alert]).to eq(I18n.t('devise.failure.unconfirmed', locale: accept_language))
  130. end
  131. end
  132. context "logging in from the user's page" do
  133. before do
  134. allow(controller).to receive(:single_user_mode?).and_return(single_user_mode)
  135. allow(controller).to receive(:stored_location_for).with(:user).and_return("/@#{user.account.username}")
  136. post :create, params: { user: { email: user.email, password: user.password } }
  137. end
  138. context "in single user mode" do
  139. let(:single_user_mode) { true }
  140. it 'redirects to home' do
  141. expect(response).to redirect_to(root_path)
  142. end
  143. end
  144. context "in non-single user mode" do
  145. let(:single_user_mode) { false }
  146. it "redirects back to the user's page" do
  147. expect(response).to redirect_to(short_account_path(username: user.account))
  148. end
  149. end
  150. end
  151. end
  152. context 'using two-factor authentication' do
  153. let(:user) do
  154. Fabricate(:user, email: 'x@y.com', password: 'abcdefgh',
  155. otp_required_for_login: true, otp_secret: User.generate_otp_secret(32))
  156. end
  157. let(:recovery_codes) do
  158. codes = user.generate_otp_backup_codes!
  159. user.save
  160. return codes
  161. end
  162. context 'using email and password' do
  163. before do
  164. post :create, params: { user: { email: user.email, password: user.password } }
  165. end
  166. it 'renders two factor authentication page' do
  167. expect(controller).to render_template("two_factor")
  168. end
  169. end
  170. context 'using upcase email and password' do
  171. before do
  172. post :create, params: { user: { email: user.email.upcase, password: user.password } }
  173. end
  174. it 'renders two factor authentication page' do
  175. expect(controller).to render_template("two_factor")
  176. end
  177. end
  178. context 'using a valid OTP' do
  179. before do
  180. post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
  181. end
  182. it 'redirects to home' do
  183. expect(response).to redirect_to(root_path)
  184. end
  185. it 'logs the user in' do
  186. expect(controller.current_user).to eq user
  187. end
  188. end
  189. context 'when the server has an decryption error' do
  190. before do
  191. allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_raise(OpenSSL::Cipher::CipherError)
  192. post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
  193. end
  194. it 'shows a login error' do
  195. expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
  196. end
  197. it "doesn't log the user in" do
  198. expect(controller.current_user).to be_nil
  199. end
  200. end
  201. context 'using a valid recovery code' do
  202. before do
  203. post :create, params: { user: { otp_attempt: recovery_codes.first } }, session: { otp_user_id: user.id }
  204. end
  205. it 'redirects to home' do
  206. expect(response).to redirect_to(root_path)
  207. end
  208. it 'logs the user in' do
  209. expect(controller.current_user).to eq user
  210. end
  211. end
  212. context 'using an invalid OTP' do
  213. before do
  214. post :create, params: { user: { otp_attempt: 'wrongotp' } }, session: { otp_user_id: user.id }
  215. end
  216. it 'shows a login error' do
  217. expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
  218. end
  219. it "doesn't log the user in" do
  220. expect(controller.current_user).to be_nil
  221. end
  222. end
  223. end
  224. end
  225. end