Gab Social. All are welcome.

spec/controllers/auth/confirmations_controller_spec.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Auth::ConfirmationsController, type: :controller do
+  render_views
+
+  describe 'GET #new' do
+    it 'returns http success' do
+      @request.env['devise.mapping'] = Devise.mappings[:user]
+      get :new
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #show' do
+    context 'when user is unconfirmed' do
+      let!(:user) { Fabricate(:user, confirmation_token: 'foobar', confirmed_at: nil) }
+
+      before do
+        allow(BootstrapTimelineWorker).to receive(:perform_async)
+        @request.env['devise.mapping'] = Devise.mappings[:user]
+        get :show, params: { confirmation_token: 'foobar' }
+      end
+
+      it 'redirects to login' do
+        expect(response).to redirect_to(new_user_session_path)
+      end
+
+      it 'queues up bootstrapping of home timeline' do
+        expect(BootstrapTimelineWorker).to have_received(:perform_async).with(user.account_id)
+      end
+    end
+
+    context 'when user is updating email' do
+      let!(:user) { Fabricate(:user, confirmation_token: 'foobar', unconfirmed_email: 'new-email@example.com') }
+
+      before do
+        allow(BootstrapTimelineWorker).to receive(:perform_async)
+        @request.env['devise.mapping'] = Devise.mappings[:user]
+        get :show, params: { confirmation_token: 'foobar' }
+      end
+
+      it 'redirects to login' do
+        expect(response).to redirect_to(new_user_session_path)
+      end
+
+      it 'does not queue up bootstrapping of home timeline' do
+        expect(BootstrapTimelineWorker).to_not have_received(:perform_async)
+      end
+    end
+  end
+
+  describe 'GET #finish_signup' do
+    subject { get :finish_signup }
+
+    let(:user) { Fabricate(:user) }
+    before do
+      sign_in user, scope: :user
+      @request.env['devise.mapping'] = Devise.mappings[:user]
+    end
+
+    it 'renders finish_signup' do
+      is_expected.to render_template :finish_signup
+      expect(assigns(:user)).to have_attributes id: user.id
+    end
+  end
+
+  describe 'PATCH #finish_signup' do
+    subject { patch :finish_signup, params: { user: { email: email } } }
+
+    let(:user) { Fabricate(:user) }
+    before do
+      sign_in user, scope: :user
+      @request.env['devise.mapping'] = Devise.mappings[:user]
+    end
+
+    context 'when email is valid' do
+      let(:email) { 'new_' + user.email }
+
+      it 'redirects to root_path' do
+        is_expected.to redirect_to root_path
+      end
+    end
+
+    context 'when email is invalid' do
+      let(:email) { '' }
+
+      it 'renders finish_signup' do
+        is_expected.to render_template :finish_signup
+      end
+    end
+  end
+end

spec/controllers/auth/passwords_controller_spec.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Auth::PasswordsController, type: :controller do
+  include Devise::Test::ControllerHelpers
+
+  describe 'GET #new' do
+    it 'returns http success' do
+      @request.env['devise.mapping'] = Devise.mappings[:user]
+      get :new
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #edit' do
+    let(:user) { Fabricate(:user) }
+
+    before do
+      request.env['devise.mapping'] = Devise.mappings[:user]
+      @token = user.send_reset_password_instructions
+    end
+
+    context 'with valid reset_password_token' do
+      it 'returns http success' do
+        get :edit, params: { reset_password_token: @token }
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'with invalid reset_password_token' do
+      it 'redirects to #new' do
+        get :edit, params: { reset_password_token: 'some_invalid_value' }
+        expect(response).to redirect_to subject.new_password_path(subject.send(:resource_name))
+      end
+    end
+  end
+end

spec/controllers/auth/registrations_controller_spec.rb

@@ -0,0 +1,218 @@
+require 'rails_helper'
+
+RSpec.describe Auth::RegistrationsController, type: :controller do
+  render_views
+
+  shared_examples 'checks for enabled registrations' do |path|
+    around do |example|
+      registrations_mode = Setting.registrations_mode
+      example.run
+      Setting.registrations_mode = registrations_mode
+    end
+
+    it 'redirects if it is in single user mode while it is open for registration' do
+      Fabricate(:account)
+      Setting.registrations_mode = 'open'
+      expect(Rails.configuration.x).to receive(:single_user_mode).and_return(true)
+
+      get path
+
+      expect(response).to redirect_to '/'
+    end
+
+    it 'redirects if it is not open for registration while it is not in single user mode' do
+      Setting.registrations_mode = 'none'
+      expect(Rails.configuration.x).to receive(:single_user_mode).and_return(false)
+
+      get path
+
+      expect(response).to redirect_to '/'
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'returns http success' do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+      sign_in(Fabricate(:user))
+      get :edit
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #update' do
+    it 'returns http success' do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+      sign_in(Fabricate(:user), scope: :user)
+      post :update
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #new' do
+    before do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+    end
+
+    context do
+      around do |example|
+        registrations_mode = Setting.registrations_mode
+        example.run
+        Setting.registrations_mode = registrations_mode
+      end
+
+      it 'returns http success' do
+        Setting.registrations_mode = 'open'
+        get :new
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    include_examples 'checks for enabled registrations', :new
+  end
+
+  describe 'POST #create' do
+    let(:accept_language) { Rails.application.config.i18n.available_locales.sample.to_s }
+
+    around do |example|
+      current_locale = I18n.locale
+      example.run
+      I18n.locale = current_locale
+    end
+
+    before { request.env["devise.mapping"] = Devise.mappings[:user] }
+
+    context do
+      around do |example|
+        registrations_mode = Setting.registrations_mode
+        example.run
+        Setting.registrations_mode = registrations_mode
+      end
+
+      subject do
+        Setting.registrations_mode = 'open'
+        request.headers["Accept-Language"] = accept_language
+        post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678' } }
+      end
+
+      it 'redirects to login page' do
+        subject
+        expect(response).to redirect_to new_user_session_path
+      end
+
+      it 'creates user' do
+        subject
+        user = User.find_by(email: 'test@example.com')
+        expect(user).to_not be_nil
+        expect(user.locale).to eq(accept_language)
+      end
+    end
+
+    context 'approval-based registrations without invite' do
+      around do |example|
+        registrations_mode = Setting.registrations_mode
+        example.run
+        Setting.registrations_mode = registrations_mode
+      end
+
+      subject do
+        Setting.registrations_mode = 'approved'
+        request.headers["Accept-Language"] = accept_language
+        post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678' } }
+      end
+
+      it 'redirects to login page' do
+        subject
+        expect(response).to redirect_to new_user_session_path
+      end
+
+      it 'creates user' do
+        subject
+        user = User.find_by(email: 'test@example.com')
+        expect(user).to_not be_nil
+        expect(user.locale).to eq(accept_language)
+        expect(user.approved).to eq(false)
+      end
+    end
+
+    context 'approval-based registrations with expired invite' do
+      around do |example|
+        registrations_mode = Setting.registrations_mode
+        example.run
+        Setting.registrations_mode = registrations_mode
+      end
+
+      subject do
+        Setting.registrations_mode = 'approved'
+        request.headers["Accept-Language"] = accept_language
+        invite = Fabricate(:invite, max_uses: nil, expires_at: 1.hour.ago)
+        post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', 'invite_code': invite.code } }
+      end
+
+      it 'redirects to login page' do
+        subject
+        expect(response).to redirect_to new_user_session_path
+      end
+
+      it 'creates user' do
+        subject
+        user = User.find_by(email: 'test@example.com')
+        expect(user).to_not be_nil
+        expect(user.locale).to eq(accept_language)
+        expect(user.approved).to eq(false)
+      end
+    end
+
+    context 'approval-based registrations with valid invite' do
+      around do |example|
+        registrations_mode = Setting.registrations_mode
+        example.run
+        Setting.registrations_mode = registrations_mode
+      end
+
+      subject do
+        Setting.registrations_mode = 'approved'
+        request.headers["Accept-Language"] = accept_language
+        invite = Fabricate(:invite, max_uses: nil, expires_at: 1.hour.from_now)
+        post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', 'invite_code': invite.code } }
+      end
+
+      it 'redirects to login page' do
+        subject
+        expect(response).to redirect_to new_user_session_path
+      end
+
+      it 'creates user' do
+        subject
+        user = User.find_by(email: 'test@example.com')
+        expect(user).to_not be_nil
+        expect(user.locale).to eq(accept_language)
+        expect(user.approved).to eq(true)
+      end
+    end
+
+    it 'does nothing if user already exists' do
+      Fabricate(:user, account: Fabricate(:account, username: 'test'))
+      subject
+    end
+
+    include_examples 'checks for enabled registrations', :create
+  end
+
+  describe 'DELETE #destroy' do
+    let(:user) { Fabricate(:user) }
+
+    before do
+      request.env['devise.mapping'] = Devise.mappings[:user]
+      sign_in(user, scope: :user)
+      delete :destroy
+    end
+
+    it 'returns http not found' do
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'does not delete user' do
+      expect(User.find(user.id)).to_not be_nil
+    end
+  end
+end

spec/controllers/auth/sessions_controller_spec.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Auth::SessionsController, type: :controller do
+  render_views
+
+  describe 'GET #new' do
+    before do
+      request.env['devise.mapping'] = Devise.mappings[:user]
+    end
+
+    it 'returns http success' do
+      get :new
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    let(:user) { Fabricate(:user) }
+
+    before do
+      request.env['devise.mapping'] = Devise.mappings[:user]
+    end
+
+    context 'with a regular user' do
+      it 'redirects to home after sign out' do
+        sign_in(user, scope: :user)
+        delete :destroy
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+
+      it 'does not delete redirect location with continue=true' do
+        sign_in(user, scope: :user)
+        controller.store_location_for(:user, '/authorize')
+        delete :destroy, params: { continue: 'true' }
+        expect(controller.stored_location_for(:user)).to eq '/authorize'
+      end
+    end
+
+    context 'with a suspended user' do
+      it 'redirects to home after sign out' do
+        Fabricate(:account, user: user, suspended: true)
+        sign_in(user, scope: :user)
+        delete :destroy
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+
+  describe 'POST #create' do
+    before do
+      request.env['devise.mapping'] = Devise.mappings[:user]
+    end
+
+    context 'using PAM authentication', if: ENV['PAM_ENABLED'] == 'true' do
+      context 'using a valid password' do
+        before do
+          post :create, params: { user: { email: "pam_user1", password: '123456' } }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to be_instance_of(User)
+        end
+      end
+
+      context 'using an invalid password' do
+        before do
+          post :create, params: { user: { email: "pam_user1", password: 'WRONGPW' } }
+        end
+
+        it 'shows a login error' do
+          expect(flash[:alert]).to match I18n.t('devise.failure.invalid', authentication_keys: 'Email')
+        end
+
+        it "doesn't log the user in" do
+          expect(controller.current_user).to be_nil
+        end
+      end
+
+      context 'using a valid email and existing user' do
+        let(:user) do
+          account = Fabricate.build(:account, username: 'pam_user1')
+          account.save!(validate: false)
+          user = Fabricate(:user, email: 'pam@example.com', password: nil, account: account)
+          user
+        end
+
+        before do
+          post :create, params: { user: { email: user.email, password: '123456' } }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to eq user
+        end
+      end
+    end
+
+    context 'using password authentication' do
+      let(:user) { Fabricate(:user, email: 'foo@bar.com', password: 'abcdefgh') }
+
+      context 'using a valid password' do
+        before do
+          post :create, params: { user: { email: user.email, password: user.password } }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to eq user
+        end
+      end
+
+      context 'using email with uppercase letters' do
+        before do
+          post :create, params: { user: { email: user.email.upcase, password: user.password } }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to eq user
+        end
+      end
+
+      context 'using an invalid password' do
+        before do
+          post :create, params: { user: { email: user.email, password: 'wrongpw' } }
+        end
+
+        it 'shows a login error' do
+          expect(flash[:alert]).to match I18n.t('devise.failure.invalid', authentication_keys: 'Email')
+        end
+
+        it "doesn't log the user in" do
+          expect(controller.current_user).to be_nil
+        end
+      end
+
+      context 'using an unconfirmed password' do
+        before do
+          request.headers['Accept-Language'] = accept_language
+          post :create, params: { user: { email: unconfirmed_user.email, password: unconfirmed_user.password } }
+        end
+
+        let(:unconfirmed_user) { user.tap { |u| u.update!(confirmed_at: nil) } }
+        let(:accept_language) { 'fr' }
+
+        it 'shows a translated login error' do
+          expect(flash[:alert]).to eq(I18n.t('devise.failure.unconfirmed', locale: accept_language))
+        end
+      end
+
+      context "logging in from the user's page" do
+        before do
+          allow(controller).to receive(:single_user_mode?).and_return(single_user_mode)
+          allow(controller).to receive(:stored_location_for).with(:user).and_return("/@#{user.account.username}")
+          post :create, params: { user: { email: user.email, password: user.password } }
+        end
+
+        context "in single user mode" do
+          let(:single_user_mode) { true }
+
+          it 'redirects to home' do
+            expect(response).to redirect_to(root_path)
+          end
+        end
+
+        context "in non-single user mode" do
+          let(:single_user_mode) { false }
+
+          it "redirects back to the user's page" do
+            expect(response).to redirect_to(short_account_path(username: user.account))
+          end
+        end
+      end
+    end
+
+    context 'using two-factor authentication' do
+      let(:user) do
+        Fabricate(:user, email: 'x@y.com', password: 'abcdefgh',
+                         otp_required_for_login: true, otp_secret: User.generate_otp_secret(32))
+      end
+      let(:recovery_codes) do
+        codes = user.generate_otp_backup_codes!
+        user.save
+        return codes
+      end
+
+      context 'using email and password' do
+        before do
+          post :create, params: { user: { email: user.email, password: user.password } }
+        end
+
+        it 'renders two factor authentication page' do
+          expect(controller).to render_template("two_factor")
+        end
+      end
+
+      context 'using upcase email and password' do
+        before do
+          post :create, params: { user: { email: user.email.upcase, password: user.password } }
+        end
+
+        it 'renders two factor authentication page' do
+          expect(controller).to render_template("two_factor")
+        end
+      end
+
+      context 'using a valid OTP' do
+        before do
+          post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to eq user
+        end
+      end
+
+      context 'when the server has an decryption error' do
+        before do
+          allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_raise(OpenSSL::Cipher::CipherError)
+          post :create, params: { user: { otp_attempt: user.current_otp } }, session: { otp_user_id: user.id }
+        end
+
+        it 'shows a login error' do
+          expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
+        end
+
+        it "doesn't log the user in" do
+          expect(controller.current_user).to be_nil
+        end
+      end
+
+      context 'using a valid recovery code' do
+        before do
+          post :create, params: { user: { otp_attempt: recovery_codes.first } }, session: { otp_user_id: user.id }
+        end
+
+        it 'redirects to home' do
+          expect(response).to redirect_to(root_path)
+        end
+
+        it 'logs the user in' do
+          expect(controller.current_user).to eq user
+        end
+      end
+
+      context 'using an invalid OTP' do
+        before do
+          post :create, params: { user: { otp_attempt: 'wrongotp' } }, session: { otp_user_id: user.id }
+        end
+
+        it 'shows a login error' do
+          expect(flash[:alert]).to match I18n.t('users.invalid_otp_token')
+        end
+
+        it "doesn't log the user in" do
+          expect(controller.current_user).to be_nil
+        end
+      end
+    end
+  end
+end