Retrospring/spec/controllers/user/sessions_controller_spec.rb

# frozen_string_literal: true

require "rails_helper"

describe User::SessionsController do
  before do
    # Required for devise to register routes
    @request.env["devise.mapping"] = Devise.mappings[:user]
  end

  describe "#create" do
    let(:user) { FactoryBot.create(:user, password: "/bin/animals64") }

    subject { post :create, params: { user: { login: user.email, password: user.password } } }

    it "logs in users without 2FA enabled without any further input" do
      expect(subject).to redirect_to :root
    end

    it "prompts users with 2FA enabled to enter a code" do
      user.otp_module = :enabled
      user.save

      expect(subject).to have_rendered("auth/two_factor_authentication")
    end

    context "2fa sign in attempt" do
      subject do
        post :create,
             params:  { user: { otp_attempt: code_input } },
             session: { user_sign_in_uid: user.id }
      end

      before do
        user.otp_module = :enabled
        user.save
      end

      context "incorrect code" do
        let(:code_input) { 123456 }

        it "redirects to the sign in page" do
          expect(subject).to redirect_to :new_user_session
        end
      end

      context "correct code" do
        let(:code_input) { user.otp_code }

        it "redirects to the timeline" do
          expect(subject).to redirect_to :root
        end
      end

      context "correct recovery code" do
        let(:code_input) { "raccoons" }

        before do
          user.totp_recovery_codes << TotpRecoveryCode.create(code: "raccoons")
        end

        it "consumes the recovery code" do
          expect { subject }.to change { user.totp_recovery_codes.count }.by(-1)
          expect(response).to redirect_to :root
        end
      end

      context "incorrect recovery code" do
        let(:code_input) { "abcdefgh" }

        it "redirects to the sign in page" do
          expect(subject).to redirect_to :new_user_session
          expect(flash[:error]).to eq I18n.t("errors.invalid_otp")
        end
      end
    end

    context "permanently banned user sign in attempt" do
      before do
        user.ban(nil, "Do not feed the animals")
      end

      it "redirects to the sign in page" do
        expect(subject).to redirect_to :new_user_session
        expect(flash[:notice]).to eq "#{I18n.t('user.sessions.create.banned', name: user.screen_name)}\n#{I18n.t('user.sessions.create.reason', reason: 'Do not feed the animals')}\n#{I18n.t('user.sessions.create.permanent')}"
      end
    end

    context "temporarily banned user sign in attempt" do
      let(:expiry) { DateTime.now.utc + 3.hours }

      before do
        user.ban(expiry, "Do not feed the animals")
      end

      it "redirects to the sign in page" do
        expect(subject).to redirect_to :new_user_session
        expect(flash[:notice]).to eq I18n.t("user.sessions.create.banned", name: user.screen_name) +
          "\n#{I18n.t('user.sessions.create.reason', reason: 'Do not feed the animals')}" \
          "\n#{I18n.t('user.sessions.create.until', time: expiry)}"
      end
    end
  end
end