test/controllers/sessions_controller_test.rb

Rama main · réplica de lectura del repositorio original.

require "test_helper"

class SessionsControllerTest < ActionDispatch::IntegrationTest
  test "new" do
    untenanted do
      get new_session_path
    end

    assert_response :success
  end

  test "new redirects authenticated users" do
    sign_in_as :kevin

    untenanted do
      get new_session_path
      assert_redirected_to root_url
    end
  end

  test "create" do
    identity = identities(:kevin)

    untenanted do
      assert_difference -> { MagicLink.count }, 1 do
        post session_path, params: { email_address: identity.email_address }
      end

      assert_redirected_to session_magic_link_path
      assert_nil flash[:magic_link_code]
    end
  end

  test "create for a new user" do
    untenanted do
      assert_difference -> { MagicLink.count }, +1 do
        assert_difference -> { Identity.count }, +1 do
          post session_path,
            params: { email_address: "nonexistent-#{SecureRandom.hex(6)}@example.com" }
        end
      end

      assert_redirected_to session_magic_link_path
      assert MagicLink.last.for_sign_up?
    end
  end

  test "create for a new user when single tenant mode already has a tenant" do
    with_multi_tenant_mode(false) do
      untenanted do
        assert_no_difference -> { MagicLink.count } do
          assert_no_difference -> { Identity.count } do
            post session_path,
              params: { email_address: "nonexistent-#{SecureRandom.hex(6)}@example.com" }
          end
        end

        assert_redirected_to session_magic_link_path
      end
    end
  end

  test "create with invalid email address" do
    # Avoid Sentry exceptions when attackers try to stuff invalid emails. The browser performs form
    # field validation that should normally prevent this from occurring, so I'm not worried about
    # returning proper validation errors.
    without_action_dispatch_exception_handling do
      untenanted do
        assert_no_difference -> { Identity.count } do
          post session_path, params: { email_address: "not-a-valid-email" }
        end

        assert_response :redirect
        assert_redirected_to new_session_path
      end
    end
  end

  test "destroy" do
    sign_in_as :kevin

    untenanted do
      delete session_path

      assert_redirected_to new_session_path
      assert_not cookies[:session_token].present?
    end
  end

  test "destroy closes every remote connection for the signed-out identity and lets valid sessions reconnect" do
    kevin = users(:kevin)
    other_account_user = User.create!(identity: kevin.identity, account: accounts(:initech), role: "member", name: "Kevin Elsewhere")

    sign_in_as :kevin

    disconnected_users = []
    reconnect_flags = []
    remote_connections = Object.new
    remote_connections.define_singleton_method(:where) { |current_user:| disconnected_users << current_user; self }
    remote_connections.define_singleton_method(:disconnect) { |reconnect:| reconnect_flags << reconnect }
    ActionCable.server.stubs(:remote_connections).returns(remote_connections)

    untenanted do
      delete session_path
    end

    assert_equal [ kevin, other_account_user ].map(&:id).sort, disconnected_users.map(&:id).sort,
      "sign-out must disconnect every per-account user of the signed-out identity"
    assert_equal [ true, true ], reconnect_flags,
      "reconnect must stay true so still-valid sessions on other devices recover"
  end

  test "create via JSON" do
    untenanted do
      post session_path(format: :json), params: { email_address: identities(:david).email_address }
      assert_response :created
    end
  end

  test "create for a new user via JSON" do
    new_email = "new-user-#{SecureRandom.hex(6)}@example.com"

    untenanted do
      assert_difference -> { Identity.count }, 1 do
        assert_difference -> { MagicLink.count }, 1 do
          post session_path(format: :json), params: { email_address: new_email }
        end
      end
      assert_response :created
      assert @response.parsed_body["pending_authentication_token"].present?
      assert MagicLink.last.for_sign_up?
    end
  end

  test "create with invalid email address via JSON" do
    untenanted do
      assert_no_difference -> { Identity.count } do
        post session_path(format: :json), params: { email_address: "not-a-valid-email" }
      end
      assert_response :unprocessable_entity
    end
  end

  test "destroy via JSON" do
    sign_in_as :kevin

    untenanted do
      delete session_path(format: :json)

      assert_response :no_content
      assert_not cookies[:session_token].present?
    end
  end
end