From 0a57c06d15cdd914642f9d072863bdb7e401737d Mon Sep 17 00:00:00 2001
From: Ross Kaffenberger <rosskaff@gmail.com>
Date: Mon, 7 Apr 2014 19:12:02 -0400
Subject: [PATCH] feature spec for checking max attempts before show

---
 .../two_factor_authentication_controller.rb       |  5 ++---
 spec/features/two_factor_authenticatable_spec.rb  | 15 +++++++++++++--
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/app/controllers/devise/two_factor_authentication_controller.rb b/app/controllers/devise/two_factor_authentication_controller.rb
index 05c6027..1f2ac65 100644
--- a/app/controllers/devise/two_factor_authentication_controller.rb
+++ b/app/controllers/devise/two_factor_authentication_controller.rb
@@ -35,11 +35,10 @@ class Devise::TwoFactorAuthenticationController < DeviseController
 
     def prepare_and_validate
       redirect_to :root and return if resource.nil?
-      @limit = resource.class.max_login_attempts
+      @limit = resource.max_login_attempts
       if resource.max_login_attempts?
-        binding.pry
         sign_out(resource)
-        render :template => 'devise/two_factor_authentication/max_login_attempts_reached' and return
+        render :max_login_attempts_reached and return
       end
     end
 end
diff --git a/spec/features/two_factor_authenticatable_spec.rb b/spec/features/two_factor_authenticatable_spec.rb
index 899cd5b..ff9995f 100644
--- a/spec/features/two_factor_authenticatable_spec.rb
+++ b/spec/features/two_factor_authenticatable_spec.rb
@@ -42,10 +42,12 @@ feature "User of two factor authentication" do
       expect(page).to have_content("You are signed in as Marissa")
     end
 
-    scenario "is locked out after 3 failed attempts" do
+    scenario "is locked out after max failed attempts" do
       visit user_two_factor_authentication_path
 
-      3.times do
+      max_attempts = User.max_login_attempts
+
+      max_attempts.times do
         fill_in "code", with: "incorrect#{rand(100)}"
         click_button "Submit"
 
@@ -57,5 +59,14 @@ feature "User of two factor authentication" do
       expect(page).to have_content("Access completely denied")
       expect(page).to have_content("You are signed out")
     end
+
+    scenario "cannot retry authentication after max attempts" do
+      user.update_attribute(:second_factor_attempts_count, User.max_login_attempts)
+
+      visit user_two_factor_authentication_path
+
+      expect(page).to have_content("Access completely denied")
+      expect(page).to have_content("You are signed out")
+    end
   end
 end