123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124 |
- # frozen_string_literal: true
- require 'rails_helper'
- describe Settings::TwoFactorAuthenticationsController do
- render_views
- let(:user) { Fabricate(:user) }
- describe 'GET #show' do
- context 'when signed in' do
- before do
- sign_in user, scope: :user
- end
- describe 'when user requires otp for login already' do
- it 'returns http success' do
- user.update(otp_required_for_login: true)
- get :show
- expect(response).to have_http_status(:success)
- end
- end
- describe 'when user does not require otp for login' do
- it 'returns http success' do
- user.update(otp_required_for_login: false)
- get :show
- expect(response).to have_http_status(:success)
- end
- end
- end
- context 'when not signed in' do
- it 'redirects' do
- get :show
- expect(response).to redirect_to '/auth/sign_in'
- end
- end
- end
- describe 'POST #create' do
- context 'when signed in' do
- before do
- sign_in user, scope: :user
- end
- describe 'when user requires otp for login already' do
- it 'redirects to show page' do
- user.update(otp_required_for_login: true)
- post :create
- expect(response).to redirect_to(settings_two_factor_authentication_path)
- end
- end
- describe 'when creation succeeds' do
- it 'updates user secret' do
- before = user.otp_secret
- post :create
- expect(user.reload.otp_secret).not_to eq(before)
- expect(response).to redirect_to(new_settings_two_factor_authentication_confirmation_path)
- end
- end
- end
- context 'when not signed in' do
- it 'redirects' do
- get :show
- expect(response).to redirect_to '/auth/sign_in'
- end
- end
- end
- describe 'POST #destroy' do
- before do
- user.update(otp_required_for_login: true)
- end
- context 'when signed in' do
- before do
- sign_in user, scope: :user
- end
- it 'turns off otp requirement with correct code' do
- expect_any_instance_of(User).to receive(:validate_and_consume_otp!) do |value, arg|
- expect(value).to eq user
- expect(arg).to eq '123456'
- true
- end
- post :destroy, params: { form_two_factor_confirmation: { code: '123456' } }
- expect(response).to redirect_to(settings_two_factor_authentication_path)
- user.reload
- expect(user.otp_required_for_login).to eq(false)
- end
- it 'does not turn off otp if code is incorrect' do
- expect_any_instance_of(User).to receive(:validate_and_consume_otp!) do |value, arg|
- expect(value).to eq user
- expect(arg).to eq '057772'
- false
- end
- post :destroy, params: { form_two_factor_confirmation: { code: '057772' } }
- user.reload
- expect(user.otp_required_for_login).to eq(true)
- end
- it 'raises ActionController::ParameterMissing if code is missing' do
- expect { post :destroy }.to raise_error(ActionController::ParameterMissing)
- end
- end
- it 'redirects if not signed in' do
- get :show
- expect(response).to redirect_to '/auth/sign_in'
- end
- end
- end
|