2023-02-21 19:55:31 -05:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-11-17 06:29:11 -05:00
|
|
|
require 'rails_helper'
|
|
|
|
|
|
|
|
RSpec.describe Auth::RegistrationsController, type: :controller do
|
|
|
|
render_views
|
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
shared_examples 'checks for enabled registrations' do |path|
|
|
|
|
around do |example|
|
2019-03-14 00:28:30 -04:00
|
|
|
registrations_mode = Setting.registrations_mode
|
2017-06-25 15:42:55 -04:00
|
|
|
example.run
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = registrations_mode
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'redirects if it is in single user mode while it is open for registration' do
|
|
|
|
Fabricate(:account)
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = 'open'
|
2017-06-25 15:42:55 -04:00
|
|
|
expect(Rails.configuration.x).to receive(:single_user_mode).and_return(true)
|
|
|
|
|
|
|
|
get path
|
|
|
|
|
|
|
|
expect(response).to redirect_to '/'
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'redirects if it is not open for registration while it is not in single user mode' do
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = 'none'
|
2017-06-25 15:42:55 -04:00
|
|
|
expect(Rails.configuration.x).to receive(:single_user_mode).and_return(false)
|
|
|
|
|
|
|
|
get path
|
|
|
|
|
|
|
|
expect(response).to redirect_to '/'
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
2016-11-17 06:29:11 -05:00
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
describe 'GET #edit' do
|
2023-04-19 10:07:29 -04:00
|
|
|
before do
|
2023-02-18 17:38:14 -05:00
|
|
|
request.env['devise.mapping'] = Devise.mappings[:user]
|
2017-06-25 15:42:55 -04:00
|
|
|
sign_in(Fabricate(:user))
|
|
|
|
get :edit
|
2023-04-19 10:07:29 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns http success' do
|
2018-04-21 15:35:07 -04:00
|
|
|
expect(response).to have_http_status(200)
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
2023-04-19 10:07:29 -04:00
|
|
|
|
|
|
|
it 'returns private cache control header' do
|
|
|
|
expect(response.headers['Cache-Control']).to include('private, no-store')
|
|
|
|
end
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
describe 'GET #update' do
|
2023-04-19 10:07:29 -04:00
|
|
|
let(:user) { Fabricate(:user) }
|
|
|
|
|
|
|
|
before do
|
2023-02-18 17:38:14 -05:00
|
|
|
request.env['devise.mapping'] = Devise.mappings[:user]
|
2023-04-19 10:07:29 -04:00
|
|
|
sign_in(user, scope: :user)
|
2017-06-25 15:42:55 -04:00
|
|
|
post :update
|
2023-04-19 10:07:29 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns http success' do
|
2018-04-21 15:35:07 -04:00
|
|
|
expect(response).to have_http_status(200)
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
|
2023-04-19 10:07:29 -04:00
|
|
|
it 'returns private cache control headers' do
|
|
|
|
expect(response.headers['Cache-Control']).to include('private, no-store')
|
|
|
|
end
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
context 'when suspended' do
|
2023-04-19 10:07:29 -04:00
|
|
|
let(:user) { Fabricate(:user, account_attributes: { username: 'test', suspended_at: Time.now.utc }) }
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
it 'returns http forbidden' do
|
|
|
|
expect(response).to have_http_status(403)
|
|
|
|
end
|
|
|
|
end
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
2017-04-17 04:29:08 -04:00
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
describe 'GET #new' do
|
2016-11-17 06:29:11 -05:00
|
|
|
before do
|
2023-02-18 17:38:14 -05:00
|
|
|
request.env['devise.mapping'] = Devise.mappings[:user]
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
context do
|
|
|
|
around do |example|
|
2019-03-14 00:28:30 -04:00
|
|
|
registrations_mode = Setting.registrations_mode
|
2017-06-25 15:42:55 -04:00
|
|
|
example.run
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = registrations_mode
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns http success' do
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = 'open'
|
2017-06-25 15:42:55 -04:00
|
|
|
get :new
|
2018-04-21 15:35:07 -04:00
|
|
|
expect(response).to have_http_status(200)
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
include_examples 'checks for enabled registrations', :new
|
|
|
|
end
|
|
|
|
|
|
|
|
describe 'POST #create' do
|
|
|
|
let(:accept_language) { Rails.application.config.i18n.available_locales.sample.to_s }
|
|
|
|
|
2020-12-10 00:27:26 -05:00
|
|
|
before do
|
|
|
|
session[:registration_form_time] = 5.seconds.ago
|
|
|
|
end
|
|
|
|
|
2018-04-21 17:37:07 -04:00
|
|
|
around do |example|
|
2023-04-30 08:07:03 -04:00
|
|
|
I18n.with_locale(I18n.locale) do
|
|
|
|
example.run
|
|
|
|
end
|
2018-04-21 17:37:07 -04:00
|
|
|
end
|
|
|
|
|
2023-02-18 17:38:14 -05:00
|
|
|
before { request.env['devise.mapping'] = Devise.mappings[:user] }
|
2017-06-25 15:42:55 -04:00
|
|
|
|
|
|
|
context do
|
|
|
|
subject do
|
2019-03-14 00:28:30 -04:00
|
|
|
Setting.registrations_mode = 'open'
|
2023-02-18 17:38:14 -05:00
|
|
|
request.headers['Accept-Language'] = accept_language
|
2020-02-16 06:56:53 -05:00
|
|
|
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', agreement: 'true' } }
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
|
|
|
|
2023-02-19 23:24:14 -05:00
|
|
|
around do |example|
|
|
|
|
registrations_mode = Setting.registrations_mode
|
|
|
|
example.run
|
|
|
|
Setting.registrations_mode = registrations_mode
|
|
|
|
end
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
it 'redirects to setup' do
|
2017-06-25 15:42:55 -04:00
|
|
|
subject
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
expect(response).to redirect_to auth_setup_path
|
2017-06-25 15:42:55 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'creates user' do
|
|
|
|
subject
|
|
|
|
user = User.find_by(email: 'test@example.com')
|
|
|
|
expect(user).to_not be_nil
|
|
|
|
expect(user.locale).to eq(accept_language)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-02-16 06:56:53 -05:00
|
|
|
context 'when user has not agreed to terms of service' do
|
|
|
|
subject do
|
|
|
|
Setting.registrations_mode = 'open'
|
2023-02-18 17:38:14 -05:00
|
|
|
request.headers['Accept-Language'] = accept_language
|
2020-02-16 06:56:53 -05:00
|
|
|
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', agreement: 'false' } }
|
|
|
|
end
|
|
|
|
|
2023-02-19 23:24:14 -05:00
|
|
|
around do |example|
|
|
|
|
registrations_mode = Setting.registrations_mode
|
|
|
|
example.run
|
|
|
|
Setting.registrations_mode = registrations_mode
|
|
|
|
end
|
|
|
|
|
2020-02-16 06:56:53 -05:00
|
|
|
it 'does not create user' do
|
|
|
|
subject
|
|
|
|
user = User.find_by(email: 'test@example.com')
|
|
|
|
expect(user).to be_nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2023-05-03 23:49:08 -04:00
|
|
|
context 'with Approval-based registrations without invite' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject do
|
|
|
|
Setting.registrations_mode = 'approved'
|
2023-02-18 17:38:14 -05:00
|
|
|
request.headers['Accept-Language'] = accept_language
|
2020-02-16 06:56:53 -05:00
|
|
|
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', agreement: 'true' } }
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
2023-02-19 23:24:14 -05:00
|
|
|
around do |example|
|
|
|
|
registrations_mode = Setting.registrations_mode
|
|
|
|
example.run
|
|
|
|
Setting.registrations_mode = registrations_mode
|
|
|
|
end
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
it 'redirects to setup' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
expect(response).to redirect_to auth_setup_path
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'creates user' do
|
|
|
|
subject
|
|
|
|
user = User.find_by(email: 'test@example.com')
|
|
|
|
expect(user).to_not be_nil
|
|
|
|
expect(user.locale).to eq(accept_language)
|
2023-02-20 00:14:50 -05:00
|
|
|
expect(user.approved).to be(false)
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2023-05-03 23:49:08 -04:00
|
|
|
context 'with Approval-based registrations with expired invite' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject do
|
|
|
|
Setting.registrations_mode = 'approved'
|
2023-02-18 17:38:14 -05:00
|
|
|
request.headers['Accept-Language'] = accept_language
|
2019-05-01 22:30:12 -04:00
|
|
|
invite = Fabricate(:invite, max_uses: nil, expires_at: 1.hour.ago)
|
2023-02-17 21:23:49 -05:00
|
|
|
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', invite_code: invite.code, agreement: 'true' } }
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
2023-02-19 23:24:14 -05:00
|
|
|
around do |example|
|
|
|
|
registrations_mode = Setting.registrations_mode
|
|
|
|
example.run
|
|
|
|
Setting.registrations_mode = registrations_mode
|
|
|
|
end
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
it 'redirects to setup' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
expect(response).to redirect_to auth_setup_path
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'creates user' do
|
|
|
|
subject
|
|
|
|
user = User.find_by(email: 'test@example.com')
|
|
|
|
expect(user).to_not be_nil
|
|
|
|
expect(user.locale).to eq(accept_language)
|
2023-02-20 00:14:50 -05:00
|
|
|
expect(user.approved).to be(false)
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2023-05-03 23:49:08 -04:00
|
|
|
context 'with Approval-based registrations with valid invite and required invite text' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject do
|
2020-09-15 08:37:58 -04:00
|
|
|
inviter = Fabricate(:user, confirmed_at: 2.days.ago)
|
2019-05-01 22:30:12 -04:00
|
|
|
Setting.registrations_mode = 'approved'
|
2020-12-22 11:14:32 -05:00
|
|
|
Setting.require_invite_text = true
|
2023-02-18 17:38:14 -05:00
|
|
|
request.headers['Accept-Language'] = accept_language
|
2020-09-15 08:37:58 -04:00
|
|
|
invite = Fabricate(:invite, user: inviter, max_uses: nil, expires_at: 1.hour.from_now)
|
2023-02-17 21:23:49 -05:00
|
|
|
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', invite_code: invite.code, agreement: 'true' } }
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
2023-02-19 23:24:14 -05:00
|
|
|
around do |example|
|
|
|
|
registrations_mode = Setting.registrations_mode
|
|
|
|
require_invite_text = Setting.require_invite_text
|
|
|
|
example.run
|
|
|
|
Setting.require_invite_text = require_invite_text
|
|
|
|
Setting.registrations_mode = registrations_mode
|
|
|
|
end
|
|
|
|
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
it 'redirects to setup' do
|
2019-05-01 22:30:12 -04:00
|
|
|
subject
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 04:48:50 -04:00
|
|
|
expect(response).to redirect_to auth_setup_path
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'creates user' do
|
|
|
|
subject
|
|
|
|
user = User.find_by(email: 'test@example.com')
|
|
|
|
expect(user).to_not be_nil
|
|
|
|
expect(user.locale).to eq(accept_language)
|
2023-02-20 00:14:50 -05:00
|
|
|
expect(user.approved).to be(true)
|
2019-05-01 22:30:12 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-06-25 15:42:55 -04:00
|
|
|
it 'does nothing if user already exists' do
|
2022-01-27 18:46:42 -05:00
|
|
|
Fabricate(:account, username: 'test')
|
2017-06-25 15:42:55 -04:00
|
|
|
subject
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
2017-06-25 15:42:55 -04:00
|
|
|
|
|
|
|
include_examples 'checks for enabled registrations', :create
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|
2017-05-23 15:32:42 -04:00
|
|
|
|
|
|
|
describe 'DELETE #destroy' do
|
|
|
|
let(:user) { Fabricate(:user) }
|
|
|
|
|
|
|
|
before do
|
|
|
|
request.env['devise.mapping'] = Devise.mappings[:user]
|
|
|
|
sign_in(user, scope: :user)
|
|
|
|
delete :destroy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns http not found' do
|
2023-02-19 21:16:40 -05:00
|
|
|
expect(response).to have_http_status(404)
|
2017-05-23 15:32:42 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not delete user' do
|
|
|
|
expect(User.find(user.id)).to_not be_nil
|
|
|
|
end
|
|
|
|
end
|
2016-11-17 06:29:11 -05:00
|
|
|
end
|