Merge branch 'CLDC-571-allow-users-to-login-and-change-password' of https://github.com/communitiesuk/mhclg-data-collection-beta into CLDC-571-allow-users-to-login-and-change-password

app/controllers/case_logs_controller.rb

@@ -1,7 +1,6 @@
 class CaseLogsController < ApplicationController
   skip_before_action :verify_authenticity_token, if: :json_api_request?
   before_action :authenticate, if: :json_api_request?
-  # TODO: determine if it's worth splitting out an API controller
   before_action :authenticate_user!, unless: :json_api_request?
 
   def index

app/controllers/users/passwords_controller.rb

@@ -1,6 +1,7 @@
 class Users::PasswordsController < Devise::PasswordsController
   def reset_confirmation
     @email = params["email"]
+    flash[:notice] = "Reset password instructions have been sent to #{@email}"
     render "devise/confirmations/reset"
   end
 
@@ -14,6 +15,6 @@ class Users::PasswordsController < Devise::PasswordsController
 protected
 
   def after_sending_reset_password_instructions_path_for(_resource)
-    confirmations_reset_path(email: params.dig("user", "email")) if is_navigational_format?
+    confirmations_reset_path(email: params.dig("user", "email"))
   end
 end

config/environments/test.rb

@@ -43,6 +43,7 @@ Rails.application.configure do
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
   config.action_mailer.delivery_method = :test
+  config.action_mailer.default_options = { from: "test@gmail.com" }
 
   # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr

lib/tasks/form_definition.rake

@@ -1,6 +1,6 @@
 require "json"
 require "json-schema"
-# rubocop:disable Lint/ShadowingOuterLocalVariable
+
 def get_all_form_paths(directories)
   form_paths = []
   directories.each do |directory|

spec/rails_helper.rb

@@ -114,9 +114,6 @@ RSpec.configure do |config|
   # spec
   Capybara.server = :puma, { Silent: true }
 
-  # For Devise > 4.1.1
   config.include Devise::Test::ControllerHelpers, type: :controller
   config.include Devise::Test::IntegrationHelpers, type: :request
-  # Use the following instead if you are on Devise <= 4.1.1
-  # config.include Devise::TestHelpers, :type => :controller
 end

spec/requests/users/passwords_controller_spec.rb

@@ -0,0 +1,39 @@
+require "rails_helper"
+require_relative "../../support/devise"
+
+RSpec.describe Users::PasswordsController, type: :request do
+  let(:params) { { user: { email: email } } }
+
+  context "when a password reset is requested for a valid email" do
+    let(:user) { FactoryBot.create(:user) }
+    let(:email) { user.email }
+
+    it "redirects to the email sent page anyway" do
+      post "/users/password", params: params
+      expect(response).to have_http_status(:redirect)
+      follow_redirect!
+      expect(response.body).to match(/Check your email/)
+    end
+  end
+
+  context "when a password reset is requested with an email that doesn't exist in the system" do
+    before do
+      allow_any_instance_of(Users::PasswordsController).to receive(:is_navigational_format?).and_return(false)
+    end
+
+    let(:email) { "madeup_email@test.com" }
+
+    it "redirects to the email sent page anyway" do
+      post "/users/password", params: params
+      expect(response).to have_http_status(:redirect)
+      follow_redirect!
+      expect(response.body).to match(/Check your email/)
+    end
+
+    it "shows a flash banner" do
+      post "/users/password", params: params
+      follow_redirect!
+      expect(flash[:notice]).to be_present
+    end
+  end
+end

spec/support/devise.rb

@@ -1,9 +1,6 @@
 require_relative "./controller_macros"
 
 RSpec.configure do |config|
-  # For Devise > 4.1.1
   config.include Devise::Test::ControllerHelpers, type: :controller
-  # Use the following instead if you are on Devise <= 4.1.1
-  # config.include Devise::TestHelpers, :type => :controller
   config.extend ControllerMacros, type: :controller
 end