yak(behavior-tests-web-controllers-and-auth-edge-cases-o04i): behavior tests: web controllers and auth edge cases

app/test/firehose_web/user_auth_test.exs

@@ -363,4 +363,27 @@ defmodule FirehoseWeb.UserAuthTest do
       refute conn.status
     end
   end
+
+  describe "a session token that no longer exists" do
+    # This is the plug-layer contract that keeps UserAuth's LiveView-side
+    # defences unreachable in this app: the router wraps /editor/dashboard in
+    # `pipe_through [:browser, :require_authenticated_user]`, so the plug
+    # redirects before `on_mount {UserAuth, :ensure_authenticated}` can run and
+    # its halt arm never fires for a stale token. The same goes for the nil
+    # scope fallbacks in `scope_from_session/1`.
+    test "is treated as logged out", %{conn: conn, user: user} do
+      conn = log_in_user(conn, user)
+      token = get_session(conn, :user_token)
+      assert Accounts.get_user_by_session_token(token)
+
+      :ok = Accounts.delete_user_session_token(token)
+
+      response = conn |> get(~p"/users/settings")
+
+      assert redirected_to(response) == ~p"/users/log-in"
+
+      assert Phoenix.Flash.get(response.assigns.flash, :error) ==
+               "You must log in to access this page."
+    end
+  end
 end