155 lines
4.9 KiB
Ruby
155 lines
4.9 KiB
Ruby
require "rails_helper"
|
|
|
|
RSpec.describe Api::SessionsController, type: :controller do
|
|
let!(:user) { User.create!(nickname: "AdmiralNelson", password: "securepassword") }
|
|
let(:token) { JwtService.encode(user_id: user.id) }
|
|
|
|
describe "POST #create" do
|
|
context "with valid credentials" do
|
|
it "returns 200 OK with user info and JWT token" do
|
|
post :create, params: { nickname: "AdmiralNelson", password: "securepassword" }
|
|
|
|
expect(response).to have_http_status(:ok)
|
|
json = JSON.parse(response.body)
|
|
expect(json["token"]).to be_present
|
|
expect(json["user"]).to include(
|
|
"id" => user.id,
|
|
"nickname" => "AdmiralNelson",
|
|
"avatar_url" => nil
|
|
)
|
|
|
|
decoded = JwtService.decode(json["token"])
|
|
expect(decoded[:user_id]).to eq(user.id)
|
|
end
|
|
end
|
|
|
|
context "with invalid credentials" do
|
|
it "returns 401 when password does not match" do
|
|
post :create, params: { nickname: "AdmiralNelson", password: "wrongpassword" }
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Invalid nickname or password")
|
|
expect(json["token"]).to be_nil
|
|
end
|
|
|
|
it "returns 401 when user does not exist" do
|
|
post :create, params: { nickname: "GhostCaptain", password: "securepassword" }
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Invalid nickname or password")
|
|
end
|
|
|
|
it "returns 401 when nickname is omitted" do
|
|
post :create, params: { password: "securepassword" }
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Invalid nickname or password")
|
|
end
|
|
|
|
it "returns 401 when password is omitted" do
|
|
post :create, params: { nickname: "AdmiralNelson" }
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Invalid nickname or password")
|
|
end
|
|
|
|
it "returns 401 when credentials are blank" do
|
|
post :create, params: { nickname: "", password: "" }
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Invalid nickname or password")
|
|
end
|
|
end
|
|
end
|
|
|
|
describe "DELETE #destroy" do
|
|
context "when authenticated" do
|
|
it "returns 200 with success message" do
|
|
request.headers["Authorization"] = "Bearer #{token}"
|
|
delete :destroy
|
|
|
|
expect(response).to have_http_status(:ok)
|
|
json = JSON.parse(response.body)
|
|
expect(json["message"]).to eq("Signed out successfully")
|
|
end
|
|
end
|
|
|
|
context "when unauthenticated" do
|
|
it "returns 401 unauthorized" do
|
|
delete :destroy
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Unauthorized")
|
|
end
|
|
end
|
|
end
|
|
|
|
describe "GET #me" do
|
|
context "when authenticated with Authorization header" do
|
|
it "returns 200 with user data" do
|
|
request.headers["Authorization"] = "Bearer #{token}"
|
|
get :me
|
|
|
|
expect(response).to have_http_status(:ok)
|
|
json = JSON.parse(response.body)
|
|
expect(json["user"]).to include(
|
|
"id" => user.id,
|
|
"nickname" => "AdmiralNelson",
|
|
"avatar_url" => nil
|
|
)
|
|
end
|
|
|
|
it "includes avatar_url when user has an attached avatar" do
|
|
user.avatar.attach(
|
|
io: StringIO.new("\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15c4"),
|
|
filename: "avatar.png",
|
|
content_type: "image/png"
|
|
)
|
|
|
|
request.headers["Authorization"] = "Bearer #{token}"
|
|
get :me
|
|
|
|
expect(response).to have_http_status(:ok)
|
|
json = JSON.parse(response.body)
|
|
expect(json["user"]["avatar_url"]).to be_present
|
|
end
|
|
end
|
|
|
|
context "when authenticated with token in query params" do
|
|
it "returns 200 with user data" do
|
|
get :me, params: { token: token }
|
|
|
|
expect(response).to have_http_status(:ok)
|
|
json = JSON.parse(response.body)
|
|
expect(json["user"]["id"]).to eq(user.id)
|
|
end
|
|
end
|
|
|
|
context "when unauthenticated" do
|
|
it "returns 401 unauthorized" do
|
|
get :me
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
json = JSON.parse(response.body)
|
|
expect(json["error"]).to eq("Unauthorized")
|
|
end
|
|
end
|
|
|
|
context "when token is expired" do
|
|
it "returns 401 unauthorized" do
|
|
expired_token = JwtService.encode(user_id: user.id, exp: 1.hour.ago.to_i)
|
|
request.headers["Authorization"] = "Bearer #{expired_token}"
|
|
get :me
|
|
|
|
expect(response).to have_http_status(:unauthorized)
|
|
end
|
|
end
|
|
end
|
|
end
|