<%= notice %>
+ +Signed as <%= Current.user.email %>
+ +<%= alert %>
+ +<% if Current.user.verified? %> +We sent a verification email to the address below. Check that email and follow those instructions to confirm it's your email address.
+<%= button_to "Re-send verification email", identity_email_verification_path %>
+<% end %> + +<%= form_with(url: identity_email_path, method: :patch) do |form| %> + <% if @user.errors.any? %> +<%= alert %>
+ +<%= alert %>
+ +<%= notice %>
+ ++ User Agent: + <%= session.user_agent %> +
+ ++ Ip Address: + <%= session.ip_address %> +
+ ++ Created at: + <%= session.created_at %> +
+ ++ <%= button_to "Log out", session, method: :delete %> +
+ <% end %> +<%= notice %>
+<%= alert %>
+ +Hey there,
+ +This is to confirm that <%= @user.email %> is the email you want to use on your account. If you ever lose your password, that's where we'll email a reset link.
+ +You must hit the link below to confirm that you received this email.
+ +<%= link_to "Yes, use this email for my account", identity_email_verification_url(sid: @signed_id) %>
+ +Have questions or need help? Just reply to this email and our support team will help you sort it out.
diff --git a/app/views/user_mailer/password_reset.html.erb b/app/views/user_mailer/password_reset.html.erb new file mode 100644 index 0000000..c570a0a --- /dev/null +++ b/app/views/user_mailer/password_reset.html.erb @@ -0,0 +1,11 @@ +Hey there,
+ +Can't remember your password for <%= @user.email %>? That's OK, it happens. Just hit the link below to set a new one.
+ +<%= link_to "Reset my password", edit_identity_password_reset_url(sid: @signed_id) %>
+ +If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
+ +Have questions or need help? Just reply to this email and our support team will help you sort it out.
diff --git a/config/environments/test.rb b/config/environments/test.rb index 0c616a1..f62240e 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -6,6 +6,7 @@ require "active_support/core_ext/integer/time" # and recreated between test runs. Don't rely on the data there! Rails.application.configure do + config.action_mailer.default_url_options = { host: "localhost", port: 3000 } # Settings specified here will take precedence over those in config/application.rb. # While tests run files are not watched, reloading is not necessary. diff --git a/config/routes.rb b/config/routes.rb index 5a50506..664e467 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -1,4 +1,15 @@ Rails.application.routes.draw do + get "sign_in", to: "sessions#new" + post "sign_in", to: "sessions#create" + get "sign_up", to: "registrations#new" + post "sign_up", to: "registrations#create" + resources :sessions, only: [ :index, :show, :destroy ] + resource :password, only: [ :edit, :update ] + namespace :identity do + resource :email, only: [ :edit, :update ] + resource :email_verification, only: [ :show, :create ] + resource :password_reset, only: [ :new, :edit, :create, :update ] + end resources :jobs do member do patch "cancel" @@ -10,8 +21,8 @@ Rails.application.routes.draw do patch "increment_page", :din patch "decrement_page", :din end - end - end + end + end # Define your application routes per the DSL in https://guides.rubyonrails.org/routing.html # Reveal health status on /up that returns 200 if the app boots with no exceptions, otherwise 500. diff --git a/db/migrate/20240730214152_create_users.rb b/db/migrate/20240730214152_create_users.rb deleted file mode 100644 index 81b5a9f..0000000 --- a/db/migrate/20240730214152_create_users.rb +++ /dev/null @@ -1,13 +0,0 @@ -class CreateUsers < ActiveRecord::Migration[7.1] - def change - create_table :users do |t| - t.string :firstname - t.string :lastname - - t.timestamps - end - - add_foreign_key :jobs, :users, column: :operator_id - add_foreign_key :jobs, :users, column: :costumer_id - end -end diff --git a/db/migrate/20240826144015_create_users.rb b/db/migrate/20240826144015_create_users.rb new file mode 100644 index 0000000..c5391d3 --- /dev/null +++ b/db/migrate/20240826144015_create_users.rb @@ -0,0 +1,18 @@ +class CreateUsers < ActiveRecord::Migration[7.2] + def change + create_table :users do |t| + t.string :email, null: false, index: { unique: true } + t.string :password_digest, null: false + t.string :firstname + t.string :lastname + + t.integer :role, default: 0, index: true + + t.boolean :verified, null: false, default: false + + t.timestamps + end + add_foreign_key :jobs, :users, column: :operator_id + add_foreign_key :jobs, :users, column: :costumer_id + end +end diff --git a/db/migrate/20240826144016_create_sessions.rb b/db/migrate/20240826144016_create_sessions.rb new file mode 100644 index 0000000..a828909 --- /dev/null +++ b/db/migrate/20240826144016_create_sessions.rb @@ -0,0 +1,11 @@ +class CreateSessions < ActiveRecord::Migration[7.2] + def change + create_table :sessions do |t| + t.references :user, null: false, foreign_key: true + t.string :user_agent + t.string :ip_address + + t.timestamps + end + end +end diff --git a/db/schema.rb b/db/schema.rb index 056dc55..d751713 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,7 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema[7.2].define(version: 2024_08_01_153403) do +ActiveRecord::Schema[7.2].define(version: 2024_08_26_144016) do create_table "active_storage_attachments", force: :cascade do |t| t.string "name", null: false t.string "record_type", null: false @@ -69,15 +69,31 @@ ActiveRecord::Schema[7.2].define(version: 2024_08_01_153403) do t.index ["status"], name: "index_jobs_on_status" end - create_table "users", force: :cascade do |t| - t.string "firstname" - t.string "lastname" + create_table "sessions", force: :cascade do |t| + t.integer "user_id", null: false + t.string "user_agent" + t.string "ip_address" t.datetime "created_at", null: false t.datetime "updated_at", null: false + t.index ["user_id"], name: "index_sessions_on_user_id" + end + + create_table "users", force: :cascade do |t| + t.string "email", null: false + t.string "password_digest", null: false + t.string "firstname" + t.string "lastname" + t.integer "role", default: 0 + t.boolean "verified", default: false, null: false + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index ["email"], name: "index_users_on_email", unique: true + t.index ["role"], name: "index_users_on_role" end add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id" add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id" add_foreign_key "jobs", "users", column: "costumer_id" add_foreign_key "jobs", "users", column: "operator_id" + add_foreign_key "sessions", "users" end diff --git a/db/seeds.rb b/db/seeds.rb index 724779e..681e3b6 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -10,28 +10,28 @@ Faker::Config.locale = :de -10.times do - User.new(firstname: Faker::Name.unique.first_name, lastname: Faker::Name.unique.last_name).save +# Admin +User.create!(email: "david.boehm@hs-rm.de", firstname: "David", lastname: "Böhm", role: :admin, password_digest: BCrypt::Password.create("admin"), verified: true) + +# Students +students = [] +5.times do + firstname = Faker::Name.unique.first_name + lastname = Faker::Name.unique.last_name + students << User.new(email: firstname + "." + lastname + "@student.hs-rm.de", firstname: firstname, lastname: lastname, password_digest: BCrypt::Password.create("password"), verified: true) + students.last.save! end [ 'GanzWichtig.pdf', 'IchBinIn5MinDran.pdf', 'DerPlanDerImmerProblemeMacht.pdf', 'DieFarbenGefallenMirNicht.pdf', 'MachHinIchHabsEilig.pdf', 'WarumDauertDasSoLange.pdf', 'DenPlanBezahleIchNicht.pdf', 'IchWarAlsErstesDran.pdf', 'WarumIstDerPlotterDefekt.pdf', 'DasNächsteMalGeheIchWoAndersHin.pdf' ].shuffle.each do |pdf| - # a0 = rand(0...7) - # a1 = rand(0...7) - # a2 = rand(0...7) - # a3 = rand(0...7) - # a0.zero? || a1 = 0 && a2 = 0 && a3 = 0 - # a1.zero? || a2 = 0 && a3 = 0 - # a2.zero? || a3 = 0 - status = %i[open open open open open - printing pickup paid canceled].sample + status = %i[open open open open open printing pickup paid canceled].sample job = Job.new(costumer_firstname: Faker::Name.unique.first_name, costumer_lastname: Faker::Name.unique.last_name, + costumer_id: students[rand(0...4)].id, # number_of_plans_a0: a0, number_of_plans_a1: a1, number_of_plans_a2: a2, number_of_plans_a3: a3, status:, privacy_policy_accepted: true) job.pdf = File.open(Rails.root.join('db/pdfs/', pdf)) job.save! - # sleep 1 # for testing broadcasting end diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb index d19212a..f3db1f4 100644 --- a/test/application_system_test_case.rb +++ b/test/application_system_test_case.rb @@ -1,5 +1,15 @@ require "test_helper" class ApplicationSystemTestCase < ActionDispatch::SystemTestCase - driven_by :selenium, using: :chrome, screen_size: [1400, 1400] + driven_by :selenium, using: :headless_chrome, screen_size: [1400, 1400] + + def sign_in_as(user) + visit sign_in_url + fill_in :email, with: user.email + fill_in :password, with: "Secret1*3*5*" + click_on "Sign in" + + assert_current_path root_url + user + end end diff --git a/test/controllers/identity/email_verifications_controller_test.rb b/test/controllers/identity/email_verifications_controller_test.rb new file mode 100644 index 0000000..90d8513 --- /dev/null +++ b/test/controllers/identity/email_verifications_controller_test.rb @@ -0,0 +1,34 @@ +require "test_helper" + +class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest + setup do + @user = sign_in_as(users(:lazaro_nixon)) + @user.update! verified: false + end + + test "should send a verification email" do + assert_enqueued_email_with UserMailer, :email_verification, params: { user: @user } do + post identity_email_verification_url + end + + assert_redirected_to root_url + end + + test "should verify email" do + sid = @user.generate_token_for(:email_verification) + + get identity_email_verification_url(sid: sid, email: @user.email) + assert_redirected_to root_url + end + + test "should not verify email with expired token" do + sid = @user.generate_token_for(:email_verification) + + travel 3.days + + get identity_email_verification_url(sid: sid, email: @user.email) + + assert_redirected_to edit_identity_email_url + assert_equal "That email verification link is invalid", flash[:alert] + end +end diff --git a/test/controllers/identity/emails_controller_test.rb b/test/controllers/identity/emails_controller_test.rb new file mode 100644 index 0000000..dc8ecc4 --- /dev/null +++ b/test/controllers/identity/emails_controller_test.rb @@ -0,0 +1,25 @@ +require "test_helper" + +class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest + setup do + @user = sign_in_as(users(:lazaro_nixon)) + end + + test "should get edit" do + get edit_identity_email_url + assert_response :success + end + + test "should update email" do + patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "Secret1*3*5*" } + assert_redirected_to root_url + end + + + test "should not update email with wrong password challenge" do + patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "SecretWrong1*3" } + + assert_response :unprocessable_entity + assert_select "li", /Password challenge is invalid/ + end +end diff --git a/test/controllers/identity/password_resets_controller_test.rb b/test/controllers/identity/password_resets_controller_test.rb new file mode 100644 index 0000000..5b807c5 --- /dev/null +++ b/test/controllers/identity/password_resets_controller_test.rb @@ -0,0 +1,65 @@ +require "test_helper" + +class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest + setup do + @user = users(:lazaro_nixon) + end + + test "should get new" do + get new_identity_password_reset_url + assert_response :success + end + + test "should get edit" do + sid = @user.generate_token_for(:password_reset) + + get edit_identity_password_reset_url(sid: sid) + assert_response :success + end + + test "should send a password reset email" do + assert_enqueued_email_with UserMailer, :password_reset, params: { user: @user } do + post identity_password_reset_url, params: { email: @user.email } + end + + assert_redirected_to sign_in_url + end + + test "should not send a password reset email to a nonexistent email" do + assert_no_enqueued_emails do + post identity_password_reset_url, params: { email: "invalid_email@hey.com" } + end + + assert_redirected_to new_identity_password_reset_url + assert_equal "You can't reset your password until you verify your email", flash[:alert] + end + + test "should not send a password reset email to a unverified email" do + @user.update! verified: false + + assert_no_enqueued_emails do + post identity_password_reset_url, params: { email: @user.email } + end + + assert_redirected_to new_identity_password_reset_url + assert_equal "You can't reset your password until you verify your email", flash[:alert] + end + + test "should update password" do + sid = @user.generate_token_for(:password_reset) + + patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" } + assert_redirected_to sign_in_url + end + + test "should not update password with expired token" do + sid = @user.generate_token_for(:password_reset) + + travel 30.minutes + + patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" } + + assert_redirected_to new_identity_password_reset_url + assert_equal "That password reset link is invalid", flash[:alert] + end +end diff --git a/test/controllers/passwords_controller_test.rb b/test/controllers/passwords_controller_test.rb new file mode 100644 index 0000000..430f1a1 --- /dev/null +++ b/test/controllers/passwords_controller_test.rb @@ -0,0 +1,24 @@ +require "test_helper" + +class PasswordsControllerTest < ActionDispatch::IntegrationTest + setup do + @user = sign_in_as(users(:lazaro_nixon)) + end + + test "should get edit" do + get edit_password_url + assert_response :success + end + + test "should update password" do + patch password_url, params: { password_challenge: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" } + assert_redirected_to root_url + end + + test "should not update password with wrong password challenge" do + patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" } + + assert_response :unprocessable_entity + assert_select "li", /Password challenge is invalid/ + end +end diff --git a/test/controllers/registrations_controller_test.rb b/test/controllers/registrations_controller_test.rb new file mode 100644 index 0000000..1636fd8 --- /dev/null +++ b/test/controllers/registrations_controller_test.rb @@ -0,0 +1,16 @@ +require "test_helper" + +class RegistrationsControllerTest < ActionDispatch::IntegrationTest + test "should get new" do + get sign_up_url + assert_response :success + end + + test "should sign up" do + assert_difference("User.count") do + post sign_up_url, params: { email: "lazaronixon@hey.com", password: "Secret1*3*5*", password_confirmation: "Secret1*3*5*" } + end + + assert_redirected_to root_url + end +end diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb new file mode 100644 index 0000000..975c1ca --- /dev/null +++ b/test/controllers/sessions_controller_test.rb @@ -0,0 +1,46 @@ +require "test_helper" + +class SessionsControllerTest < ActionDispatch::IntegrationTest + setup do + @user = users(:lazaro_nixon) + end + + test "should get index" do + sign_in_as @user + + get sessions_url + assert_response :success + end + + test "should get new" do + get sign_in_url + assert_response :success + end + + test "should sign in" do + post sign_in_url, params: { email: @user.email, password: "Secret1*3*5*" } + assert_redirected_to root_url + + get root_url + assert_response :success + end + + test "should not sign in with wrong credentials" do + post sign_in_url, params: { email: @user.email, password: "SecretWrong1*3" } + assert_redirected_to sign_in_url(email_hint: @user.email) + assert_equal "That email or password is incorrect", flash[:alert] + + get root_url + assert_redirected_to sign_in_url + end + + test "should sign out" do + sign_in_as @user + + delete session_url(@user.sessions.last) + assert_redirected_to sessions_url + + follow_redirect! + assert_redirected_to sign_in_url + end +end diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index e7ec08b..4c5f5d7 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -1,9 +1,6 @@ # Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html -one: - firstname: MyString - lastname: MyString - -two: - firstname: MyString - lastname: MyString +lazaro_nixon: + email: lazaronixon@hotmail.com + password_digest: <%= BCrypt::Password.create("Secret1*3*5*") %> + verified: true diff --git a/test/mailers/user_mailer_test.rb b/test/mailers/user_mailer_test.rb new file mode 100644 index 0000000..e74b76e --- /dev/null +++ b/test/mailers/user_mailer_test.rb @@ -0,0 +1,19 @@ +require "test_helper" + +class UserMailerTest < ActionMailer::TestCase + setup do + @user = users(:lazaro_nixon) + end + + test "password_reset" do + mail = UserMailer.with(user: @user).password_reset + assert_equal "Reset your password", mail.subject + assert_equal [@user.email], mail.to + end + + test "email_verification" do + mail = UserMailer.with(user: @user).email_verification + assert_equal "Verify your email", mail.subject + assert_equal [@user.email], mail.to + end +end diff --git a/test/system/identity/emails_test.rb b/test/system/identity/emails_test.rb new file mode 100644 index 0000000..c681a77 --- /dev/null +++ b/test/system/identity/emails_test.rb @@ -0,0 +1,26 @@ +require "application_system_test_case" + +class Identity::EmailsTest < ApplicationSystemTestCase + setup do + @user = sign_in_as(users(:lazaro_nixon)) + end + + test "updating the email" do + click_on "Change email address" + + fill_in "New email", with: "new_email@hey.com" + fill_in "Password challenge", with: "Secret1*3*5*" + click_on "Save changes" + + assert_text "Your email has been changed" + end + + test "sending a verification email" do + @user.update! verified: false + + click_on "Change email address" + click_on "Re-send verification email" + + assert_text "We sent a verification email to your email address" + end +end diff --git a/test/system/identity/password_resets_test.rb b/test/system/identity/password_resets_test.rb new file mode 100644 index 0000000..1c254ab --- /dev/null +++ b/test/system/identity/password_resets_test.rb @@ -0,0 +1,28 @@ +require "application_system_test_case" + +class Identity::PasswordResetsTest < ApplicationSystemTestCase + setup do + @user = users(:lazaro_nixon) + @sid = @user.generate_token_for(:password_reset) + end + + test "sending a password reset email" do + visit sign_in_url + click_on "Forgot your password?" + + fill_in "Email", with: @user.email + click_on "Send password reset email" + + assert_text "Check your email for reset instructions" + end + + test "updating password" do + visit edit_identity_password_reset_url(sid: @sid) + + fill_in "New password", with: "Secret6*4*2*" + fill_in "Confirm new password", with: "Secret6*4*2*" + click_on "Save changes" + + assert_text "Your password was reset successfully. Please sign in" + end +end diff --git a/test/system/passwords_test.rb b/test/system/passwords_test.rb new file mode 100644 index 0000000..486fdf9 --- /dev/null +++ b/test/system/passwords_test.rb @@ -0,0 +1,18 @@ +require "application_system_test_case" + +class PasswordsTest < ApplicationSystemTestCase + setup do + @user = sign_in_as(users(:lazaro_nixon)) + end + + test "updating the password" do + click_on "Change password" + + fill_in "Password challenge", with: "Secret1*3*5*" + fill_in "New password", with: "Secret6*4*2*" + fill_in "Confirm new password", with: "Secret6*4*2*" + click_on "Save changes" + + assert_text "Your password has been changed" + end +end diff --git a/test/system/registrations_test.rb b/test/system/registrations_test.rb new file mode 100644 index 0000000..da7c0db --- /dev/null +++ b/test/system/registrations_test.rb @@ -0,0 +1,14 @@ +require "application_system_test_case" + +class RegistrationsTest < ApplicationSystemTestCase + test "signing up" do + visit sign_up_url + + fill_in "Email", with: "lazaronixon@hey.com" + fill_in "Password", with: "Secret6*4*2*" + fill_in "Password confirmation", with: "Secret6*4*2*" + click_on "Sign up" + + assert_text "Welcome! You have signed up successfully" + end +end diff --git a/test/system/sessions_test.rb b/test/system/sessions_test.rb new file mode 100644 index 0000000..640c626 --- /dev/null +++ b/test/system/sessions_test.rb @@ -0,0 +1,30 @@ +require "application_system_test_case" + +class SessionsTest < ApplicationSystemTestCase + setup do + @user = users(:lazaro_nixon) + end + + test "visiting the index" do + sign_in_as @user + + click_on "Devices & Sessions" + assert_selector "h1", text: "Sessions" + end + + test "signing in" do + visit sign_in_url + fill_in "Email", with: @user.email + fill_in "Password", with: "Secret1*3*5*" + click_on "Sign in" + + assert_text "Signed in successfully" + end + + test "signing out" do + sign_in_as @user + + click_on "Log out" + assert_text "That session has been logged out" + end +end diff --git a/test/test_helper.rb b/test/test_helper.rb index 0c22470..3631664 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -2,14 +2,15 @@ ENV["RAILS_ENV"] ||= "test" require_relative "../config/environment" require "rails/test_help" -module ActiveSupport - class TestCase - # Run tests in parallel with specified workers - parallelize(workers: :number_of_processors) +class ActiveSupport::TestCase + # Run tests in parallel with specified workers + parallelize(workers: :number_of_processors) - # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. - fixtures :all + # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. + fixtures :all - # Add more helper methods to be used by all tests here... + # Add more helper methods to be used by all tests here... + def sign_in_as(user) + post(sign_in_url, params: { email: user.email, password: "Secret1*3*5*" }); user end end