From a5b2c4bccbf90799f16ff455e5fc378ed8f42ed4 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Thu, 23 Apr 2026 16:40:45 -0500
Subject: [PATCH] test: cover UserAuth, StatusLive handlers and UserNotifier

---
 test/aprsme/accounts/user_notifier_test.exs   |  44 ++++
 .../live/status_live/index_test.exs           |  70 +++++
 test/aprsme_web/user_auth_test.exs            | 245 ++++++++++++++++++
 3 files changed, 359 insertions(+)
 create mode 100644 test/aprsme/accounts/user_notifier_test.exs
 create mode 100644 test/aprsme_web/live/status_live/index_test.exs
 create mode 100644 test/aprsme_web/user_auth_test.exs

diff --git a/test/aprsme/accounts/user_notifier_test.exs b/test/aprsme/accounts/user_notifier_test.exs
new file mode 100644
index 0000000..72c0337
--- /dev/null
+++ b/test/aprsme/accounts/user_notifier_test.exs
@@ -0,0 +1,44 @@
+defmodule Aprsme.Accounts.UserNotifierTest do
+  use ExUnit.Case, async: true
+
+  import Swoosh.TestAssertions
+
+  alias Aprsme.Accounts.UserNotifier
+
+  defp user, do: %{email: "test@example.com"}
+
+  describe "deliver_confirmation_instructions/2" do
+    test "sends a confirmation email with the URL embedded in the body" do
+      assert {:ok, email} =
+               UserNotifier.deliver_confirmation_instructions(user(), "https://aprs.me/confirm/abc")
+
+      assert email.subject == "Confirmation instructions"
+      assert email.to == [{"", "test@example.com"}]
+      assert email.text_body =~ "You can confirm your account"
+      assert email.text_body =~ "https://aprs.me/confirm/abc"
+      assert_email_sent(email)
+    end
+  end
+
+  describe "deliver_reset_password_instructions/2" do
+    test "sends a password reset email with the URL embedded in the body" do
+      assert {:ok, email} =
+               UserNotifier.deliver_reset_password_instructions(user(), "https://aprs.me/reset/xyz")
+
+      assert email.subject == "Reset password instructions"
+      assert email.text_body =~ "reset your password"
+      assert email.text_body =~ "https://aprs.me/reset/xyz"
+    end
+  end
+
+  describe "deliver_update_email_instructions/2" do
+    test "sends an update-email email with the URL embedded in the body" do
+      assert {:ok, email} =
+               UserNotifier.deliver_update_email_instructions(user(), "https://aprs.me/update/123")
+
+      assert email.subject == "Update email instructions"
+      assert email.text_body =~ "change your email"
+      assert email.text_body =~ "https://aprs.me/update/123"
+    end
+  end
+end
diff --git a/test/aprsme_web/live/status_live/index_test.exs b/test/aprsme_web/live/status_live/index_test.exs
new file mode 100644
index 0000000..2685870
--- /dev/null
+++ b/test/aprsme_web/live/status_live/index_test.exs
@@ -0,0 +1,70 @@
+defmodule AprsmeWeb.StatusLive.IndexTest do
+  use AprsmeWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+
+  alias AprsmeWeb.StatusLive.Index
+  alias Phoenix.LiveView.Socket
+
+  describe "mount via HTTP" do
+    test "renders the status page", %{conn: conn} do
+      {:ok, _lv, html} = live(conn, ~p"/status", on_error: :warn)
+      assert html =~ "System Status"
+      assert html =~ "APRS-IS Connection"
+    end
+  end
+
+  describe "handle_info({:status_updated, status}, socket)" do
+    test "updates assigns with the new status" do
+      status = %{
+        connected: true,
+        server: "test-server",
+        port: 14_580,
+        connected_at: DateTime.utc_now(),
+        uptime_seconds: 60,
+        login_id: "TEST-ID",
+        filter: "r/0/0/100",
+        packet_stats: %{total_packets: 0, packets_per_second: 0, last_packet_at: nil},
+        stored_packet_count: 0,
+        oldest_packet_timestamp: nil
+      }
+
+      socket = %Socket{assigns: %{__changed__: %{}}}
+
+      assert {:noreply, new_socket} = Index.handle_info({:status_updated, status}, socket)
+      assert new_socket.assigns.aprs_status == status
+      assert new_socket.assigns.loading == false
+      assert %DateTime{} = new_socket.assigns.current_time
+      # Connected+uptime 60s → health score 2.
+      assert new_socket.assigns.health_score == 2
+    end
+  end
+
+  describe "handle_info({:aprs_status_update, status}, socket)" do
+    test "updates status without flipping loading flag" do
+      status = %{
+        connected: true,
+        server: "test-server",
+        port: 14_580,
+        connected_at: DateTime.utc_now(),
+        uptime_seconds: 100_000,
+        login_id: "TEST-ID",
+        filter: "r/0/0/100",
+        packet_stats: %{total_packets: 5, packets_per_second: 1, last_packet_at: DateTime.utc_now()},
+        stored_packet_count: 123,
+        oldest_packet_timestamp: DateTime.utc_now()
+      }
+
+      socket = %Socket{assigns: %{__changed__: %{}, loading: false}}
+
+      assert {:noreply, new_socket} =
+               Index.handle_info({:aprs_status_update, status}, socket)
+
+      assert new_socket.assigns.aprs_status == status
+      # Uptime > 86_400? 100_000 > 86_400 → yes → score 5.
+      assert new_socket.assigns.health_score == 5
+      # Loading flag is untouched (this code path doesn't toggle it).
+      assert new_socket.assigns.loading == false
+    end
+  end
+end
diff --git a/test/aprsme_web/user_auth_test.exs b/test/aprsme_web/user_auth_test.exs
new file mode 100644
index 0000000..897ce81
--- /dev/null
+++ b/test/aprsme_web/user_auth_test.exs
@@ -0,0 +1,245 @@
+defmodule AprsmeWeb.UserAuthTest do
+  use AprsmeWeb.ConnCase
+
+  import Aprsme.AccountsFixtures
+
+  alias Aprsme.Accounts
+  alias AprsmeWeb.UserAuth
+  alias Phoenix.LiveView
+
+  @remember_me_cookie "_aprs_web_user_remember_me"
+
+  setup %{conn: conn} do
+    conn =
+      conn
+      |> Map.replace!(:secret_key_base, AprsmeWeb.Endpoint.config(:secret_key_base))
+      |> init_test_session(%{})
+      |> Phoenix.ConnTest.fetch_flash()
+
+    %{user: user_fixture(), conn: conn}
+  end
+
+  describe "log_in_user/3" do
+    test "stores the user token in the session", %{conn: conn, user: user} do
+      conn = UserAuth.log_in_user(conn, user)
+      assert token = get_session(conn, :user_token)
+      assert get_session(conn, :live_socket_id) == "users_sessions:#{Base.url_encode64(token)}"
+      assert redirected_to(conn) == ~p"/"
+      assert Accounts.get_user_by_session_token(token)
+    end
+
+    test "clears everything previously stored in the session", %{conn: conn, user: user} do
+      conn = conn |> put_session(:to_be_removed, "value") |> UserAuth.log_in_user(user)
+      refute get_session(conn, :to_be_removed)
+    end
+
+    test "redirects to the configured return_to", %{conn: conn, user: user} do
+      conn = conn |> put_session(:user_return_to, "/hello") |> UserAuth.log_in_user(user)
+      assert redirected_to(conn) == "/hello"
+    end
+
+    test "writes the remember_me cookie when requested", %{conn: conn, user: user} do
+      conn = UserAuth.log_in_user(conn, user, %{"remember_me" => "true"})
+      # Session holds the raw token; the cookie holds a signed version of it.
+      assert %{value: signed_token, max_age: max_age} = conn.resp_cookies[@remember_me_cookie]
+      assert signed_token != get_session(conn, :user_token)
+      assert max_age == 60 * 60 * 24 * 60
+    end
+  end
+
+  describe "log_out_user/1" do
+    test "erases session and cookies", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+
+      conn =
+        conn
+        |> put_session(:user_token, user_token)
+        |> put_req_cookie(@remember_me_cookie, user_token)
+        |> fetch_cookies()
+        |> UserAuth.log_out_user()
+
+      refute get_session(conn, :user_token)
+      refute conn.cookies[@remember_me_cookie]
+      assert %{max_age: 0} = conn.resp_cookies[@remember_me_cookie]
+      assert redirected_to(conn) == ~p"/"
+      refute Accounts.get_user_by_session_token(user_token)
+    end
+
+    test "broadcasts to the given live_socket_id", %{conn: conn} do
+      live_socket_id = "users_sessions:abcdef-token"
+      AprsmeWeb.Endpoint.subscribe(live_socket_id)
+
+      conn
+      |> put_session(:live_socket_id, live_socket_id)
+      |> UserAuth.log_out_user()
+
+      assert_receive %Phoenix.Socket.Broadcast{event: "disconnect", topic: ^live_socket_id}
+    end
+
+    test "works even if the user is already logged out", %{conn: conn} do
+      conn = conn |> fetch_cookies() |> UserAuth.log_out_user()
+      refute get_session(conn, :user_token)
+      assert %{max_age: 0} = conn.resp_cookies[@remember_me_cookie]
+      assert redirected_to(conn) == ~p"/"
+    end
+  end
+
+  describe "fetch_current_user/2" do
+    test "authenticates a user from the session", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+      conn = conn |> put_session(:user_token, user_token) |> UserAuth.fetch_current_user([])
+      assert conn.assigns.current_user.id == user.id
+    end
+
+    test "authenticates a user from the remember_me cookie", %{conn: conn, user: user} do
+      logged_in_conn =
+        conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})
+
+      signed_token = logged_in_conn.resp_cookies[@remember_me_cookie].value
+
+      conn =
+        conn
+        |> put_req_cookie(@remember_me_cookie, signed_token)
+        |> UserAuth.fetch_current_user([])
+
+      assert conn.assigns.current_user.id == user.id
+      assert get_session(conn, :user_token)
+    end
+
+    test "does not authenticate without a valid token", %{conn: conn} do
+      _ = UserAuth.fetch_current_user(conn, [])
+      conn = UserAuth.fetch_current_user(conn, [])
+      refute get_session(conn, :user_token)
+      refute conn.assigns.current_user
+    end
+  end
+
+  describe "on_mount :mount_current_user" do
+    test "assigns current_user based on a valid user_token", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+      session = conn |> put_session(:user_token, user_token) |> get_session()
+
+      {:cont, updated_socket} =
+        UserAuth.on_mount(:mount_current_user, %{}, session, %LiveView.Socket{})
+
+      assert updated_socket.assigns.current_user.id == user.id
+    end
+
+    test "assigns nil to current_user assign if no valid user_token is given" do
+      session = %{"user_token" => "invalid-token"}
+
+      {:cont, updated_socket} =
+        UserAuth.on_mount(:mount_current_user, %{}, session, %LiveView.Socket{})
+
+      assert is_nil(updated_socket.assigns.current_user)
+    end
+
+    test "assigns nil to current_user assign if no user_token is in the session" do
+      session = %{}
+
+      {:cont, updated_socket} =
+        UserAuth.on_mount(:mount_current_user, %{}, session, %LiveView.Socket{})
+
+      assert is_nil(updated_socket.assigns.current_user)
+    end
+  end
+
+  describe "on_mount :ensure_authenticated" do
+    test "authenticates a user based on a user_token", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+      session = conn |> put_session(:user_token, user_token) |> get_session()
+
+      {:cont, updated_socket} =
+        UserAuth.on_mount(:ensure_authenticated, %{}, session, %LiveView.Socket{})
+
+      assert updated_socket.assigns.current_user.id == user.id
+    end
+
+    test "redirects to login page if no user_token is found", %{conn: conn} do
+      session = get_session(conn)
+
+      socket = %LiveView.Socket{
+        endpoint: AprsmeWeb.Endpoint,
+        assigns: %{__changed__: %{}, flash: %{}}
+      }
+
+      {:halt, updated_socket} =
+        UserAuth.on_mount(:ensure_authenticated, %{}, session, socket)
+
+      assert updated_socket.assigns.current_user == nil
+    end
+  end
+
+  describe "on_mount :redirect_if_user_is_authenticated" do
+    test "redirects if there is an authenticated user", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+      session = conn |> put_session(:user_token, user_token) |> get_session()
+
+      assert {:halt, _updated_socket} =
+               UserAuth.on_mount(
+                 :redirect_if_user_is_authenticated,
+                 %{},
+                 session,
+                 %LiveView.Socket{}
+               )
+    end
+
+    test "does NOT redirect if there is no authenticated user" do
+      session = %{}
+
+      assert {:cont, _updated_socket} =
+               UserAuth.on_mount(
+                 :redirect_if_user_is_authenticated,
+                 %{},
+                 session,
+                 %LiveView.Socket{}
+               )
+    end
+  end
+
+  describe "redirect_if_user_is_authenticated/2" do
+    test "redirects authenticated users and halts", %{conn: conn, user: user} do
+      conn = conn |> assign(:current_user, user) |> UserAuth.redirect_if_user_is_authenticated([])
+      assert conn.halted
+      assert redirected_to(conn) == ~p"/"
+    end
+
+    test "does not redirect when no user is logged in", %{conn: conn} do
+      conn = UserAuth.redirect_if_user_is_authenticated(conn, [])
+      refute conn.halted
+      refute conn.status
+    end
+  end
+
+  describe "require_authenticated_user/2" do
+    test "redirects anonymous users to the login page with flash and return_to", %{conn: conn} do
+      conn =
+        conn
+        |> Map.replace!(:request_path, "/foo?bar")
+        |> Map.replace!(:method, "GET")
+        |> UserAuth.require_authenticated_user([])
+
+      assert conn.halted
+      assert redirected_to(conn) == ~p"/users/log_in"
+      assert Phoenix.Flash.get(conn.assigns.flash, :error) == "You must log in to access this page."
+    end
+
+    test "does not store return_to for non-GET requests", %{conn: conn} do
+      conn =
+        conn
+        |> Map.replace!(:request_path, "/foo?bar")
+        |> Map.replace!(:method, "POST")
+        |> UserAuth.require_authenticated_user([])
+
+      assert conn.halted
+      assert redirected_to(conn) == ~p"/users/log_in"
+      refute get_session(conn, :user_return_to)
+    end
+
+    test "does not redirect authenticated users", %{conn: conn, user: user} do
+      conn = conn |> assign(:current_user, user) |> UserAuth.require_authenticated_user([])
+      refute conn.halted
+      refute conn.status
+    end
+  end
+end