1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
|
use strict;
use warnings;
use Test::More;
use FixMyStreet::TestMech;
my $mech = FixMyStreet::TestMech->new;
my $test_email = 'test@example.com';
my $test_password = 'foobar';
$mech->delete_user($test_email);
END {
$mech->delete_user($test_email);
done_testing();
}
$mech->get_ok('/auth');
# check that we can't reach a page that is only available to authenticated users
$mech->not_logged_in_ok;
# check that submitting form with no / bad email creates an error.
$mech->get_ok('/auth');
for my $test (
[ '' => 'enter your email' ],
[ 'not an email' => 'check your email address is correct' ],
[ 'bob@foo' => 'check your email address is correct' ],
[ 'bob@foonaoedudnueu.co.uk' => 'check your email address is correct' ],
)
{
my ( $email, $error_message ) = @$test;
pass "--- testing bad email '$email' gives error '$error_message'";
$mech->get_ok('/auth');
$mech->content_lacks($error_message);
$mech->submit_form_ok(
{
form_name => 'general_auth',
fields => { email => $email, },
button => 'email_login',
},
"try to create an account with email '$email'"
);
is $mech->uri->path, '/auth', "still on auth page";
$mech->content_contains($error_message);
}
# create a new account
$mech->clear_emails_ok;
$mech->get_ok('/auth');
$mech->submit_form_ok(
{
form_name => 'general_auth',
fields => { email => $test_email, },
button => 'email_login',
},
"create an account for '$test_email'"
);
is $mech->uri->path, '/auth/token', "redirected to welcome page";
# check that we are not logged in yet
$mech->not_logged_in_ok;
# check that we got one email
{
$mech->email_count_is(1);
my $email = $mech->get_email;
$mech->clear_emails_ok;
is $email->header('Subject'), "Your FixMyStreet.com account details",
"subject is correct";
is $email->header('To'), $test_email, "to is correct";
# extract the link
my ($link) = $email->body =~ m{(http://\S+)};
ok $link, "Found a link in email '$link'";
# check that the user does not exist
sub get_user {
FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
}
ok !get_user(), "no user exists";
# visit the confirm link (with bad token) and check user no confirmed
$mech->get_ok( $link . 'XXX' );
ok !get_user(), "no user exists";
$mech->not_logged_in_ok;
# visit the confirm link and check user is confirmed
$mech->get_ok($link);
ok get_user(), "user created";
is $mech->uri->path, '/my', "redirected to the 'my' section of site";
$mech->logged_in_ok;
# logout and try to use the token again
$mech->log_out_ok;
$mech->get_ok($link);
is $mech->uri, $link, "not logged in";
$mech->content_contains( 'Link too old or already used',
'token now invalid' );
$mech->not_logged_in_ok;
}
# get a login email and change password
{
$mech->clear_emails_ok;
$mech->get_ok('/auth');
$mech->submit_form_ok(
{
form_name => 'general_auth',
fields => { email => "$test_email", },
button => 'email_login',
},
"email_login with '$test_email'"
);
is $mech->uri->path, '/auth/token', "redirected to token page";
# rest is as before so no need to test
# follow link and change password - check not prompted for old password
$mech->not_logged_in_ok;
$mech->email_count_is(1);
my $email = $mech->get_email;
$mech->clear_emails_ok;
my ($link) = $email->body =~ m{(http://\S+)};
$mech->get_ok($link);
$mech->follow_link_ok( { url => '/auth/change_password' } );
ok my $form = $mech->form_name('change_password'),
"found change password form";
is_deeply [ sort grep { $_ } map { $_->name } $form->inputs ], #
[ 'confirm', 'new_password' ],
"check we got expected fields (ie not old_password)";
# check the various ways the form can be wrong
for my $test (
{ new => '', conf => '', err => 'enter a password', },
{ new => 'secret', conf => '', err => 'do not match', },
{ new => '', conf => 'secret', err => 'do not match', },
{ new => 'secret', conf => 'not_secret', err => 'do not match', },
)
{
$mech->get_ok('/auth/change_password');
$mech->content_lacks( $test->{err}, "did not find expected error" );
$mech->submit_form_ok(
{
form_name => 'change_password',
fields =>
{ new_password => $test->{new}, confirm => $test->{conf}, },
},
"change_password with '$test->{new}' and '$test->{conf}'"
);
$mech->content_contains( $test->{err}, "found expected error" );
}
my $user =
FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
ok $user, "got a user";
ok !$user->password, "user has no password";
$mech->get_ok('/auth/change_password');
$mech->submit_form_ok(
{
form_name => 'change_password',
fields =>
{ new_password => $test_password, confirm => $test_password, },
},
"change_password with '$test_password' and '$test_password'"
);
is $mech->uri->path, '/auth/change_password',
"still on change password page";
$mech->content_contains( 'password has been changed',
"found password changed" );
$user->discard_changes();
ok $user->password, "user now has a password";
}
foreach my $remember_me ( '1', '0' ) {
subtest "login using valid details (remember_me => '$remember_me')" => sub {
$mech->get_ok('/auth');
$mech->submit_form_ok(
{
form_name => 'general_auth',
fields => {
email => $test_email,
password => $test_password,
remember_me => ( $remember_me ? 1 : undef ),
},
button => 'login',
},
"login with '$test_email' & '$test_password"
);
is $mech->uri->path, '/my', "redirected to correct page";
# check that the cookie has no expiry set
my $expiry = $mech->session_cookie_expiry;
is( $expiry, 0, "no expiry time" );
#$remember_me
# ? cmp_ok( $expiry, '>', 86400, "long expiry time" )
# : is( $expiry, 0, "no expiry time" );
# logout
$mech->log_out_ok;
};
}
# try to login with bad details
$mech->get_ok('/auth');
$mech->submit_form_ok(
{
form_name => 'general_auth',
fields => {
email => $test_email,
password => 'not the password',
},
button => 'login',
},
"login with '$test_email' & '$test_password"
);
is $mech->uri->path, '/auth', "redirected to correct page";
$mech->content_contains( 'Email or password wrong', 'found error message' );
# more test:
# TODO: test that email are always lowercased
|
