yak(behavior-tests-web-controllers-and-auth-edge-cases-o04i): behavior tests: web controllers and auth edge cases

app/test/firehose_web/controllers/user_session_controller_test.exs

@@ -61,13 +61,37 @@ defmodule FirehoseWeb.UserSessionControllerTest do
       assert html =~ "Keep me logged in on this device"
     end
 
-    test "raises error for invalid token", %{conn: conn} do
+    # The two ways a magic link can be dead arrive here through different arms
+    # of `Firehose.Accounts.get_user_by_magic_link_token/1`: a token that is
+    # not base64 at all fails to decode (`UserToken.verify_magic_link_token_query/1`
+    # returns `:error`), while a well-formed token simply matches no row. Both
+    # must land the visitor back on the log-in page with the error flash, not
+    # raise or 404.
+    test "sends the visitor back to log-in when the magic link token is not valid base64",
+         %{conn: conn} do
+      # 13 characters is not decodable with `padding: false`; the 0 hits on the
+      # magic-link `:error` line in cover/ show this test is what covers it.
+      assert :error = Base.url_decode64("invalid-token", padding: false)
+
       response = conn |> get(~p"/users/log-in/invalid-token")
       assert redirected_to(response) == ~p"/users/log-in"
 
       assert Phoenix.Flash.get(response.assigns.flash, :error) ==
                "Magic link is invalid or it has expired."
     end
+
+    test "sends the visitor back to log-in for a decodable but unknown token", %{conn: conn} do
+      # The assertion keeps this case distinct from the not-base64 one above:
+      # if this token ever stopped decoding, the two tests would silently pin
+      # the same arm.
+      assert {:ok, _decoded} = Base.url_decode64("invalidtoken", padding: false)
+
+      response = conn |> get(~p"/users/log-in/invalidtoken")
+      assert redirected_to(response) == ~p"/users/log-in"
+
+      assert Phoenix.Flash.get(response.assigns.flash, :error) ==
+               "Magic link is invalid or it has expired."
+    end
   end
 
   describe "POST /users/log-in - email and password" do