blob: 4db3b740db23ab775a1c27645327e2f67671f7ed (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
# frozen_string_literal: true
require 'rails_helper'
RSpec.describe ChallengableConcern, type: :controller do
controller(ApplicationController) do
include ChallengableConcern
before_action :require_challenge!
def foo
render plain: 'foo'
end
def bar
render plain: 'bar'
end
end
before do
routes.draw do
get 'foo' => 'anonymous#foo'
post 'bar' => 'anonymous#bar'
end
end
context 'with a no-password user' do
let(:user) { Fabricate(:user, external: true, password: nil) }
before do
sign_in user
end
context 'for GET requests' do
before { get :foo }
it 'does not ask for password' do
expect(response.body).to eq 'foo'
end
end
context 'for POST requests' do
before { post :bar }
it 'does not ask for password' do
expect(response.body).to eq 'bar'
end
end
end
context 'with recent challenge in session' do
let(:password) { 'foobar12345' }
let(:user) { Fabricate(:user, password: password) }
before do
sign_in user
end
context 'for GET requests' do
before { get :foo, session: { challenge_passed_at: Time.now.utc } }
it 'does not ask for password' do
expect(response.body).to eq 'foo'
end
end
context 'for POST requests' do
before { post :bar, session: { challenge_passed_at: Time.now.utc } }
it 'does not ask for password' do
expect(response.body).to eq 'bar'
end
end
end
context 'with a password user' do
let(:password) { 'foobar12345' }
let(:user) { Fabricate(:user, password: password) }
before do
sign_in user
end
context 'for GET requests' do
before { get :foo }
it 'renders challenge' do
expect(response).to render_template('auth/challenges/new')
end
# See Auth::ChallengesControllerSpec
end
context 'for POST requests' do
before { post :bar }
it 'renders challenge' do
expect(response).to render_template('auth/challenges/new')
end
it 'accepts correct password' do
post :bar, params: { form_challenge: { current_password: password } }
expect(response.body).to eq 'bar'
expect(session[:challenge_passed_at]).to_not be_nil
end
it 'rejects wrong password' do
post :bar, params: { form_challenge: { current_password: 'dddfff888123' } }
expect(response.body).to render_template('auth/challenges/new')
expect(session[:challenge_passed_at]).to be_nil
end
end
end
end
|
