89 lines
2.9 KiB
Elixir
89 lines
2.9 KiB
Elixir
defmodule ToweropsWeb.UserConfirmationControllerTest do
|
|
use ToweropsWeb.ConnCase, async: true
|
|
|
|
import Towerops.AccountsFixtures
|
|
|
|
alias Towerops.Accounts
|
|
|
|
describe "GET /users/confirm" do
|
|
test "renders the confirmation instructions page", %{conn: conn} do
|
|
conn = get(conn, ~p"/users/confirm")
|
|
|
|
response = html_response(conn, 200)
|
|
assert response =~ "confirm"
|
|
end
|
|
end
|
|
|
|
describe "POST /users/confirm" do
|
|
test "sends confirmation email for unconfirmed user", %{conn: conn} do
|
|
user = unconfirmed_user_fixture()
|
|
|
|
conn =
|
|
post(conn, ~p"/users/confirm", %{"user" => %{"email" => user.email}})
|
|
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "If your email is in our system"
|
|
end
|
|
|
|
test "does not reveal if email exists (non-existent email)", %{conn: conn} do
|
|
conn =
|
|
post(conn, ~p"/users/confirm", %{"user" => %{"email" => "nobody@example.com"}})
|
|
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "If your email is in our system"
|
|
end
|
|
|
|
test "does not send email for already confirmed user", %{conn: conn} do
|
|
user = user_fixture()
|
|
# user_fixture auto-confirms, so this should not send an email
|
|
|
|
conn =
|
|
post(conn, ~p"/users/confirm", %{"user" => %{"email" => user.email}})
|
|
|
|
# Should still show the generic success message (no email enumeration)
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "If your email is in our system"
|
|
end
|
|
end
|
|
|
|
describe "GET /users/confirm/:token" do
|
|
test "confirms user with valid token", %{conn: conn} do
|
|
user = unconfirmed_user_fixture()
|
|
|
|
token =
|
|
extract_user_token(fn url ->
|
|
Accounts.deliver_user_confirmation_instructions(user, url)
|
|
end)
|
|
|
|
conn = get(conn, ~p"/users/confirm/#{token}")
|
|
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "confirmed"
|
|
end
|
|
|
|
test "rejects invalid token", %{conn: conn} do
|
|
conn = get(conn, ~p"/users/confirm/invalid-token-value")
|
|
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :error) =~ "invalid or has expired"
|
|
end
|
|
|
|
test "rejects already-used token", %{conn: conn} do
|
|
user = unconfirmed_user_fixture()
|
|
|
|
token =
|
|
extract_user_token(fn url ->
|
|
Accounts.deliver_user_confirmation_instructions(user, url)
|
|
end)
|
|
|
|
# Use the token once
|
|
assert {:ok, _} = Accounts.confirm_user(token)
|
|
|
|
# Try to use again
|
|
conn = get(conn, ~p"/users/confirm/#{token}")
|
|
|
|
assert redirected_to(conn) == ~p"/users/log-in"
|
|
assert Phoenix.Flash.get(conn.assigns.flash, :error) =~ "invalid or has expired"
|
|
end
|
|
end
|
|
end
|