From 45f25778050b4137a0ce69fcb149be9aa3d4de7b Mon Sep 17 00:00:00 2001 From: Paul Robert Lloyd Date: Mon, 21 Mar 2022 11:58:12 +0000 Subject: [PATCH] Update tests for user account routes --- config/initializers/rack_attack.rb | 2 +- spec/features/auth/user_lockout_spec.rb | 4 ++-- spec/features/organisation_spec.rb | 2 +- spec/features/start_page_spec.rb | 2 +- spec/features/user_spec.rb | 20 +++++++++---------- .../auth/passwords_controller_spec.rb | 8 ++++---- spec/requests/bulk_upload_controller_spec.rb | 4 ++-- spec/requests/case_logs_controller_spec.rb | 2 +- spec/requests/form_controller_spec.rb | 6 +++--- .../requests/organisations_controller_spec.rb | 6 +++--- spec/requests/rack_attack_spec.rb | 6 +++--- spec/requests/users_controller_spec.rb | 12 +++++------ 12 files changed, 37 insertions(+), 37 deletions(-) diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 899d4b2d3..6f1335293 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -9,7 +9,7 @@ else end Rack::Attack.throttle("password reset requests", limit: 5, period: 60.seconds) do |request| - if request.params["user"].present? && request.path == "/users/password" && request.post? + if request.params["user"].present? && request.path == "/account/password" && request.post? request.params["user"]["email"].to_s.downcase.gsub(/\s+/, "") end end diff --git a/spec/features/auth/user_lockout_spec.rb b/spec/features/auth/user_lockout_spec.rb index 871dee26a..64656756d 100644 --- a/spec/features/auth/user_lockout_spec.rb +++ b/spec/features/auth/user_lockout_spec.rb @@ -9,7 +9,7 @@ RSpec.describe "User Lockout" do context "when login-in with the wrong user password up to a maximum number of attempts" do before do - visit("/users/sign-in") + visit("/account/sign-in") max_login_attempts.times do fill_in("user[email]", with: user.email) fill_in("user[password]", with: "wrong_password") @@ -18,7 +18,7 @@ RSpec.describe "User Lockout" do end it "locks the user account" do - visit("/users/sign-in") + visit("/account/sign-in") fill_in("user[email]", with: user.email) fill_in("user[password]", with: user.password) click_button("Sign in") diff --git a/spec/features/organisation_spec.rb b/spec/features/organisation_spec.rb index 04c602c9a..5129d2588 100644 --- a/spec/features/organisation_spec.rb +++ b/spec/features/organisation_spec.rb @@ -55,7 +55,7 @@ RSpec.describe "User Features" do name: "New User", email: "new_user@example.com", organisation: organisation.name, - link: "http://localhost:3000/users/password/edit?reset_password_token=#{reset_password_token}", + link: "http://localhost:3000/account/password/edit?reset_password_token=#{reset_password_token}", }, }, ) diff --git a/spec/features/start_page_spec.rb b/spec/features/start_page_spec.rb index d703a8439..625c4130b 100644 --- a/spec/features/start_page_spec.rb +++ b/spec/features/start_page_spec.rb @@ -20,7 +20,7 @@ RSpec.describe "Start Page Features" do it "takes you to sign in and then to logs" do visit("/") click_link("Start now") - expect(page).to have_current_path("/users/sign-in?start=true") + expect(page).to have_current_path("/account/sign-in?start=true") fill_in("user[email]", with: user.email) fill_in("user[password]", with: user.password) click_button("Sign in") diff --git a/spec/features/user_spec.rb b/spec/features/user_spec.rb index bb08854db..5f68bcc62 100644 --- a/spec/features/user_spec.rb +++ b/spec/features/user_spec.rb @@ -17,7 +17,7 @@ RSpec.describe "User Features" do context "when the user navigates to case logs" do it " is required to log in" do visit("/logs") - expect(page).to have_current_path("/users/sign-in") + expect(page).to have_current_path("/account/sign-in") expect(page).to have_content("Sign in to your account to submit CORE data") end @@ -59,11 +59,11 @@ RSpec.describe "User Features" do it " is redirected to the reset password page when they click the reset password link" do visit("/logs") click_link("reset your password") - expect(page).to have_current_path("/users/password/new") + expect(page).to have_current_path("/account/password/new") end it " is shown an error message if they submit without entering an email address" do - visit("/users/password/new") + visit("/account/password/new") click_button("Send email") expect(page).to have_selector("#error-summary-title") expect(page).to have_selector("#user-email-field-error") @@ -71,7 +71,7 @@ RSpec.describe "User Features" do end it " is shown an error message if they submit an invalid email address" do - visit("/users/password/new") + visit("/account/password/new") fill_in("user[email]", with: "thisisn'tanemail") click_button("Send email") expect(page).to have_selector("#error-summary-title") @@ -80,24 +80,24 @@ RSpec.describe "User Features" do end it " is redirected to check your email page after submitting an email on the reset password page" do - visit("/users/password/new") + visit("/account/password/new") fill_in("user[email]", with: user.email) click_button("Send email") expect(page).to have_content("Check your email") end it " is shown their email on the password reset confirmation page" do - visit("/users/password/new") + visit("/account/password/new") fill_in("user[email]", with: user.email) click_button("Send email") expect(page).to have_content(user.email) end it " is shown the reset password confirmation page even if their email doesn't exist in the system" do - visit("/users/password/new") + visit("/account/password/new") fill_in("user[email]", with: "idontexist@example.com") click_button("Send email") - expect(page).to have_current_path("/confirmations/reset?email=idontexist%40example.com") + expect(page).to have_current_path("/account/password/reset-confirmation?email=idontexist%40example.com") end it " is sent a reset password email via Notify" do @@ -109,11 +109,11 @@ RSpec.describe "User Features" do name: user.name, email: user.email, organisation: user.organisation.name, - link: "http://localhost:3000/users/password/edit?reset_password_token=#{reset_password_token}", + link: "http://localhost:3000/account/password/edit?reset_password_token=#{reset_password_token}", }, }, ) - visit("/users/password/new") + visit("/account/password/new") fill_in("user[email]", with: user.email) click_button("Send email") end diff --git a/spec/requests/auth/passwords_controller_spec.rb b/spec/requests/auth/passwords_controller_spec.rb index 4dd4dccdd..0243f75e2 100644 --- a/spec/requests/auth/passwords_controller_spec.rb +++ b/spec/requests/auth/passwords_controller_spec.rb @@ -20,7 +20,7 @@ RSpec.describe Auth::PasswordsController, type: :request do let(:email) { user.email } it "redirects to the email sent page" do - post "/users/password", params: params + post "/account/password", params: params expect(response).to have_http_status(:redirect) follow_redirect! expect(response.body).to match(/Check your email/) @@ -35,7 +35,7 @@ RSpec.describe Auth::PasswordsController, type: :request do let(:email) { "madeup_email@test.com" } it "redirects to the email sent page anyway" do - post "/users/password", params: params + post "/account/password", params: params expect(response).to have_http_status(:redirect) follow_redirect! expect(response.body).to match(/Check your email/) @@ -59,12 +59,12 @@ RSpec.describe Auth::PasswordsController, type: :request do let(:message) { "Your password has been changed successfully. You are now signed in" } it "changes the password" do - expect { put "/users/password", params: update_password_params } + expect { put "/account/password", params: update_password_params } .to(change { user.reload.encrypted_password }) end it "after password change, the user is signed in" do - put "/users/password", params: update_password_params + put "/account/password", params: update_password_params # Devise redirects once after re-sign in with new password and then root redirects as well. follow_redirect! follow_redirect! diff --git a/spec/requests/bulk_upload_controller_spec.rb b/spec/requests/bulk_upload_controller_spec.rb index 2ea3c450d..4e10ef797 100644 --- a/spec/requests/bulk_upload_controller_spec.rb +++ b/spec/requests/bulk_upload_controller_spec.rb @@ -17,7 +17,7 @@ RSpec.describe BulkUploadController, type: :request do before { get url, headers: headers, params: {} } it "does not let you see the bulk upload page" do - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end @@ -25,7 +25,7 @@ RSpec.describe BulkUploadController, type: :request do before { post url, params: { bulk_upload: { case_log_bulk_upload: valid_file } } } it "does not let you submit bulk uploads" do - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end end diff --git a/spec/requests/case_logs_controller_spec.rb b/spec/requests/case_logs_controller_spec.rb index 4c396aaa7..ea58cbd28 100644 --- a/spec/requests/case_logs_controller_spec.rb +++ b/spec/requests/case_logs_controller_spec.rb @@ -200,7 +200,7 @@ RSpec.describe CaseLogsController, type: :request do context "with a user that is not signed in" do it "does not let the user get case log tasklist pages they don't have access to" do get "/logs/#{case_log.id}", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end diff --git a/spec/requests/form_controller_spec.rb b/spec/requests/form_controller_spec.rb index bed33d616..1fc4ceb12 100644 --- a/spec/requests/form_controller_spec.rb +++ b/spec/requests/form_controller_spec.rb @@ -24,19 +24,19 @@ RSpec.describe FormController, type: :request do describe "GET" do it "does not let you get case logs pages you don't have access to" do get "/logs/#{case_log.id}/person-1-age", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end it "does not let you get case log check answer pages you don't have access to" do get "/logs/#{case_log.id}/household-characteristics/check-answers", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end describe "POST" do it "does not let you post form answers to case logs you don't have access to" do post "/logs/#{case_log.id}/form", params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end end diff --git a/spec/requests/organisations_controller_spec.rb b/spec/requests/organisations_controller_spec.rb index b92c8da53..5c077b3a7 100644 --- a/spec/requests/organisations_controller_spec.rb +++ b/spec/requests/organisations_controller_spec.rb @@ -13,17 +13,17 @@ RSpec.describe OrganisationsController, type: :request do describe "#show" do it "does not let you see organisation details from org route" do get "/organisations/#{organisation.id}", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end it "does not let you see organisation details from details route" do get "/organisations/#{organisation.id}/details", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end it "does not let you see organisation users" do get "/organisations/#{organisation.id}/users", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end end diff --git a/spec/requests/rack_attack_spec.rb b/spec/requests/rack_attack_spec.rb index a265261ab..b030feb14 100644 --- a/spec/requests/rack_attack_spec.rb +++ b/spec/requests/rack_attack_spec.rb @@ -31,7 +31,7 @@ describe "Rack::Attack" do context "when the number of requests is under the throttle limit" do it "does not throttle" do under_limit.times do - post "/users/password", params: params + post "/account/password", params: params follow_redirect! end last_response = response @@ -42,7 +42,7 @@ describe "Rack::Attack" do context "when the number of requests is at the throttle limit" do it "does not throttle" do limit.times do - post "/users/password", params: params + post "/account/password", params: params follow_redirect! end last_response = response @@ -53,7 +53,7 @@ describe "Rack::Attack" do context "when the number of requests is over the throttle limit" do it "throttles" do over_limit.times do - post "/users/password", params: params + post "/account/password", params: params follow_redirect! end last_response = response diff --git a/spec/requests/users_controller_spec.rb b/spec/requests/users_controller_spec.rb index 674607179..fb4623e28 100644 --- a/spec/requests/users_controller_spec.rb +++ b/spec/requests/users_controller_spec.rb @@ -20,35 +20,35 @@ RSpec.describe UsersController, type: :request do describe "#show" do it "does not let you see user details" do get "/users/#{user.id}", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end describe "#edit" do it "does not let you edit user details" do get "/users/#{user.id}/edit", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end describe "#password" do it "does not let you edit user passwords" do get "/users/#{user.id}/password/edit", headers: headers, params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end describe "#patch" do it "does not let you update user details" do patch "/logs/#{user.id}", params: {} - expect(response).to redirect_to("/users/sign-in") + expect(response).to redirect_to("/account/sign-in") end end describe "reset password" do it "renders the user edit password view" do _raw, enc = Devise.token_generator.generate(User, :reset_password_token) - get "/users/password/edit?reset_password_token=#{enc}" + get "/account/password/edit?reset_password_token=#{enc}" expect(page).to have_css("h1", class: "govuk-heading-l", text: "Reset your password") end @@ -88,7 +88,7 @@ RSpec.describe UsersController, type: :request do before do allow(User).to receive(:find_or_initialize_with_error_by).and_return(user) allow(user).to receive(:reset_password_sent_at).and_return(4.hours.ago) - put "/users/password", headers: headers, params: params + put "/account/password", headers: headers, params: params end it "shows an error" do