Files
app
bin
config
db
docs
lib
log
public
spec
controllers
admin
api
auth
concerns
oauth
settings
exports
two_factor_authentication
exports_controller_spec.rb
follower_domains_controller_spec.rb
imports_controller_spec.rb
preferences_controller_spec.rb
profiles_controller_spec.rb
two_factor_authentications_controller_spec.rb
well_known
about_controller_spec.rb
account_follow_controller_spec.rb
account_unfollow_controller_spec.rb
accounts_controller_spec.rb
authorize_follows_controller_spec.rb
follower_accounts_controller_spec.rb
following_accounts_controller_spec.rb
home_controller_spec.rb
media_controller_spec.rb
remote_follow_controller_spec.rb
statuses_controller_spec.rb
stream_entries_controller_spec.rb
tags_controller_spec.rb
fabricators
features
fixtures
helpers
javascript
lib
mailers
models
presenters
requests
routing
services
support
views
workers
rails_helper.rb
spec_helper.rb
storybook
streaming
vendor
.babelrc
.buildpacks
.codeclimate.yml
.dockerignore
.editorconfig
.env.production.sample
.env.test
.env.vagrant
.eslintignore
.eslintrc.yml
.foreman
.gitignore
.haml-lint.yml
.nvmrc
.postcssrc.yml
.rspec
.rubocop.yml
.ruby-version
.scss-lint.yml
.slugignore
.travis.yml
CONTRIBUTING.md
Capfile
Dockerfile
Gemfile
Gemfile.lock
ISSUE_TEMPLATE.md
LICENSE
Procfile
Procfile.dev
README.md
Rakefile
Vagrantfile
app.json
config.ru
docker-compose.yml
package.json
scalingo.json
yarn.lock
hometown/spec/controllers/settings/two_factor_authentications_controller_spec.rb
Matt Jankowski 67dea31b0f 2FA controller cleanup ()
* Add spec coverage for settings/two_factor_auth area

* extract setup method for qr code

* Move otp required check to before action

* Merge method only used once

* Remove duplicate view

* Consolidate creation of @codes for backup

* Move settings/2fq#recovery_codes to settings/recovery_codes#create

* Rename settings/two_factor_auth#disable to #destroy

* Add coverage for the otp required path on 2fa#show

* Clean up the recovery codes list styles

* Move settings/two_factor_auth to settings/two_factor_authentication

* Reorganize the settings two factor auth area

Updated to use a flow like:

- settings/two_factor_authentication goes to a #show view which has a button
  either enable or disable 2fa on the account
- the disable button turns off the otp requirement for the user
- the enable button cycles the user secret and redirects to a confirmation page
- the confirmation page is a #new view which shows the QR code for user
- that page posts to #create which verifies the code, and creates the recovery
  codes
- that create action shares a view with a recovery codes controller which can be
  used separately to reset codes if needed
2017-04-22 04:23:17 +02:00

67 lines
1.6 KiB
Ruby

# frozen_string_literal: true
require 'rails_helper'
describe Settings::TwoFactorAuthenticationsController do
render_views
let(:user) { Fabricate(:user) }
before do
sign_in user, scope: :user
end
describe 'GET #show' do
describe 'when user requires otp for login already' do
it 'returns http success' do
user.update(otp_required_for_login: true)
get :show
expect(response).to have_http_status(:success)
end
end
describe 'when user does not require otp for login' do
it 'returns http success' do
user.update(otp_required_for_login: false)
get :show
expect(response).to have_http_status(:success)
end
end
end
describe 'POST #create' do
describe 'when user requires otp for login already' do
it 'redirects to show page' do
user.update(otp_required_for_login: true)
post :create
expect(response).to redirect_to(settings_two_factor_authentication_path)
end
end
describe 'when creation succeeds' do
it 'updates user secret' do
before = user.otp_secret
post :create
expect(user.reload.otp_secret).not_to eq(before)
expect(response).to redirect_to(new_settings_two_factor_authentication_confirmation_path)
end
end
end
describe 'POST #destroy' do
before do
user.update(otp_required_for_login: true)
end
it 'turns off otp requirement' do
post :destroy
expect(response).to redirect_to(settings_two_factor_authentication_path)
user.reload
expect(user.otp_required_for_login).to eq(false)
end
end
end