firehose/app/test/firehose_web/controllers/user_session_controller_test.exs

defmodule FirehoseWeb.UserSessionControllerTest do
  use FirehoseWeb.ConnCase, async: true

  import Firehose.AccountsFixtures
  alias Firehose.Accounts

  setup do
    %{unconfirmed_user: unconfirmed_user_fixture(), user: user_fixture()}
  end

  describe "GET /users/log-in" do
    test "renders login page", %{conn: conn} do
      response = conn |> get(~p"/users/log-in") |> html_response(200)
      assert response =~ "Log in"
      assert response =~ ~p"/users/register"
      assert response =~ "Log in with email"
    end

    test "renders login page with password mode", %{conn: conn} do
      response = conn |> get(~p"/users/log-in?mode=password") |> html_response(200)
      assert response =~ "Log in"
      assert response =~ ~p"/users/register"
      assert response =~ "Log in with email"
    end

    test "renders login page with email filled in (sudo mode)", %{conn: conn, user: user} do
      html =
        conn
        |> log_in_user(user)
        |> get(~p"/users/log-in")
        |> html_response(200)

      assert html =~ "You need to reauthenticate"
      refute html =~ "Register"
      assert html =~ "Log in with email"

      assert html =~
               ~s(<input type="email" name="user[email]" id="login_form_magic_email" value="#{user.email}")
    end
  end

  describe "GET /users/log-in/:token" do
    test "renders confirmation page for unconfirmed user", %{conn: conn, unconfirmed_user: user} do
      token =
        extract_user_token(fn url ->
          Accounts.deliver_login_instructions(user, url)
        end)

      assert conn |> get(~p"/users/log-in/#{token}") |> html_response(200) =~
               "Confirm and stay logged in"
    end

    test "renders login page for confirmed user", %{conn: conn, user: user} do
      token =
        extract_user_token(fn url ->
          Accounts.deliver_login_instructions(user, url)
        end)

      html = conn |> get(~p"/users/log-in/#{token}") |> html_response(200)
      refute html =~ "Confirm my account"
      assert html =~ "Keep me logged in on this device"
    end

    # The two ways a magic link can be dead arrive here through different arms
    # of `Firehose.Accounts.get_user_by_magic_link_token/1`: a token that is
    # not base64 at all fails to decode (`UserToken.verify_magic_link_token_query/1`
    # returns `:error`), while a well-formed token simply matches no row. Both
    # must land the visitor back on the log-in page with the error flash, not
    # raise or 404.
    test "sends the visitor back to log-in when the magic link token is not valid base64",
         %{conn: conn} do
      # 13 characters is not decodable with `padding: false`; the 0 hits on the
      # magic-link `:error` line in cover/ show this test is what covers it.
      assert :error = Base.url_decode64("invalid-token", padding: false)

      response = conn |> get(~p"/users/log-in/invalid-token")
      assert redirected_to(response) == ~p"/users/log-in"

      assert Phoenix.Flash.get(response.assigns.flash, :error) ==
               "Magic link is invalid or it has expired."
    end

    test "sends the visitor back to log-in for a decodable but unknown token", %{conn: conn} do
      # The assertion keeps this case distinct from the not-base64 one above:
      # if this token ever stopped decoding, the two tests would silently pin
      # the same arm.
      assert {:ok, _decoded} = Base.url_decode64("invalidtoken", padding: false)

      response = conn |> get(~p"/users/log-in/invalidtoken")
      assert redirected_to(response) == ~p"/users/log-in"

      assert Phoenix.Flash.get(response.assigns.flash, :error) ==
               "Magic link is invalid or it has expired."
    end
  end

  describe "POST /users/log-in - email and password" do
    test "logs the user in", %{conn: conn, user: user} do
      user = set_password(user)

      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{"email" => user.email, "password" => valid_user_password()}
        })

      assert get_session(response, :user_token)
      assert redirected_to(response) == ~p"/"
    end

    test "logs the user in with remember me", %{conn: conn, user: user} do
      user = set_password(user)

      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{
            "email" => user.email,
            "password" => valid_user_password(),
            "remember_me" => "true"
          }
        })

      assert response.resp_cookies["_firehose_web_user_remember_me"]
      assert redirected_to(response) == ~p"/"
    end

    test "logs the user in with return to", %{conn: conn, user: user} do
      user = set_password(user)

      response =
        conn
        |> init_test_session(user_return_to: "/foo/bar")
        |> post(~p"/users/log-in", %{
          "user" => %{
            "email" => user.email,
            "password" => valid_user_password()
          }
        })

      assert redirected_to(response) == "/foo/bar"
      assert Phoenix.Flash.get(response.assigns.flash, :info) =~ "Welcome back!"
    end

    test "emits error message with invalid credentials", %{conn: conn, user: user} do
      response =
        conn
        |> post(~p"/users/log-in?mode=password", %{
          "user" => %{"email" => user.email, "password" => "invalid_password"}
        })
        |> html_response(200)

      assert response =~ "Log in"
      assert response =~ "Invalid email or password"
    end
  end

  describe "POST /users/log-in - magic link" do
    test "sends magic link email when user exists", %{conn: conn, user: user} do
      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{"email" => user.email}
        })

      assert Phoenix.Flash.get(response.assigns.flash, :info) =~ "If your email is in our system"
      assert Firehose.Repo.get_by!(Accounts.UserToken, user_id: user.id).context == "login"
    end

    test "logs the user in", %{conn: conn, user: user} do
      {token, _hashed_token} = generate_user_magic_link_token(user)

      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{"token" => token}
        })

      assert get_session(response, :user_token)
      assert redirected_to(response) == ~p"/"
    end

    test "confirms unconfirmed user", %{conn: conn, unconfirmed_user: user} do
      {token, _hashed_token} = generate_user_magic_link_token(user)
      refute user.confirmed_at

      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{"token" => token},
          "_action" => "confirmed"
        })

      assert get_session(response, :user_token)
      assert redirected_to(response) == ~p"/"
      assert Phoenix.Flash.get(response.assigns.flash, :info) =~ "User confirmed successfully."

      assert Accounts.get_user!(user.id).confirmed_at
    end

    test "emits error message when magic link is invalid", %{conn: conn} do
      response =
        conn
        |> post(~p"/users/log-in", %{
          "user" => %{"token" => "invalid"}
        })
        |> html_response(200)

      assert response =~ "The link is invalid or it has expired."
    end
  end

  describe "DELETE /users/log-out" do
    test "logs the user out", %{conn: conn, user: user} do
      conn = conn |> log_in_user(user) |> delete(~p"/users/log-out")
      assert redirected_to(conn) == ~p"/"
      refute get_session(conn, :user_token)
      assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "Logged out successfully"
    end

    test "succeeds even if the user is not logged in", %{conn: conn} do
      response = conn |> delete(~p"/users/log-out")
      assert redirected_to(response) == ~p"/"
      refute get_session(response, :user_token)
      assert Phoenix.Flash.get(response.assigns.flash, :info) =~ "Logged out successfully"
    end
  end
end