2019-04-15 06:17:05 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-04-21 14:55:54 -04:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2020-06-03 14:08:28 -04:00
|
|
|
RSpec.describe RegistrationsController do
|
2018-06-08 07:20:44 -04:00
|
|
|
include TermsHelper
|
|
|
|
|
2019-08-09 11:40:54 -04:00
|
|
|
before do
|
2020-11-16 10:09:23 -05:00
|
|
|
stub_application_setting(require_admin_approval_after_user_signup: false)
|
2019-08-09 11:40:54 -04:00
|
|
|
end
|
|
|
|
|
2019-10-23 11:06:29 -04:00
|
|
|
describe '#new' do
|
|
|
|
subject { get :new }
|
|
|
|
|
2020-11-02 22:08:56 -05:00
|
|
|
it 'renders new template and sets the resource variable' do
|
|
|
|
expect(subject).to render_template(:new)
|
|
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
|
|
expect(assigns(:resource)).to be_a(User)
|
2019-10-23 11:06:29 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-21 14:55:54 -04:00
|
|
|
describe '#create' do
|
2021-04-29 17:10:03 -04:00
|
|
|
let_it_be(:base_user_params) do
|
|
|
|
{ first_name: 'first', last_name: 'last', username: 'new_username', email: 'new@user.com', password: 'Any_password' }
|
|
|
|
end
|
|
|
|
|
|
|
|
let_it_be(:user_params) { { user: base_user_params } }
|
|
|
|
|
2021-04-27 23:09:58 -04:00
|
|
|
let(:session_params) { {} }
|
2017-01-03 02:08:21 -05:00
|
|
|
|
2021-04-27 23:09:58 -04:00
|
|
|
subject { post(:create, params: user_params, session: session_params) }
|
2020-10-08 11:08:17 -04:00
|
|
|
|
|
|
|
context '`blocked_pending_approval` state' do
|
2020-10-27 20:08:34 -04:00
|
|
|
context 'when the `require_admin_approval_after_user_signup` setting is turned on' do
|
2020-10-08 11:08:17 -04:00
|
|
|
before do
|
2020-10-27 20:08:34 -04:00
|
|
|
stub_application_setting(require_admin_approval_after_user_signup: true)
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
it 'signs up the user in `blocked_pending_approval` state' do
|
|
|
|
subject
|
|
|
|
created_user = User.find_by(email: 'new@user.com')
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
expect(created_user).to be_present
|
|
|
|
expect(created_user.blocked_pending_approval?).to eq(true)
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
it 'does not log in the user after sign up' do
|
|
|
|
subject
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
expect(controller.current_user).to be_nil
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
it 'shows flash message after signing up' do
|
|
|
|
subject
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
expect(response).to redirect_to(new_user_session_path(anchor: 'login-pane'))
|
|
|
|
expect(flash[:notice])
|
|
|
|
.to eq('You have signed up successfully. However, we could not sign you in because your account is awaiting approval from your GitLab administrator.')
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-11-12 19:09:49 -05:00
|
|
|
it 'emails the access request to approvers' do
|
|
|
|
expect_next_instance_of(NotificationService) do |notification|
|
|
|
|
allow(notification).to receive(:new_instance_access_request).with(User.find_by(email: 'new@user.com'))
|
|
|
|
end
|
|
|
|
|
|
|
|
subject
|
|
|
|
end
|
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
context 'email confirmation' do
|
|
|
|
context 'when `send_user_confirmation_email` is true' do
|
|
|
|
before do
|
|
|
|
stub_application_setting(send_user_confirmation_email: true)
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
it 'does not send a confirmation email' do
|
|
|
|
expect { subject }
|
|
|
|
.not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2021-01-28 01:08:59 -05:00
|
|
|
|
|
|
|
context 'audit events' do
|
|
|
|
context 'when not licensed' do
|
|
|
|
before do
|
|
|
|
stub_licensed_features(admin_audit_log: false)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not log any audit event' do
|
|
|
|
expect { subject }.not_to change(AuditEvent, :count)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
context 'when the `require_admin_approval_after_user_signup` setting is turned off' do
|
|
|
|
it 'signs up the user in `active` state' do
|
|
|
|
subject
|
|
|
|
created_user = User.find_by(email: 'new@user.com')
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
expect(created_user).to be_present
|
|
|
|
expect(created_user.active?).to eq(true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not show any flash message after signing up' do
|
|
|
|
subject
|
|
|
|
|
|
|
|
expect(flash[:notice]).to be_nil
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
|
2020-11-12 19:09:49 -05:00
|
|
|
it 'does not email the approvers' do
|
|
|
|
expect(NotificationService).not_to receive(:new)
|
|
|
|
|
|
|
|
subject
|
|
|
|
end
|
|
|
|
|
2020-10-27 20:08:34 -04:00
|
|
|
context 'email confirmation' do
|
|
|
|
context 'when `send_user_confirmation_email` is true' do
|
|
|
|
before do
|
|
|
|
stub_application_setting(send_user_confirmation_email: true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sends a confirmation email' do
|
|
|
|
expect { subject }
|
|
|
|
.to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
2017-01-03 02:08:21 -05:00
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
end
|
2020-10-08 11:08:17 -04:00
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
context 'email confirmation' do
|
2017-01-03 02:08:21 -05:00
|
|
|
context 'when send_user_confirmation_email is false' do
|
|
|
|
it 'signs the user in' do
|
2019-03-06 07:12:04 -05:00
|
|
|
stub_application_setting(send_user_confirmation_email: false)
|
2017-01-03 02:08:21 -05:00
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
expect { subject }.not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).not_to be_nil
|
2017-01-03 02:08:21 -05:00
|
|
|
end
|
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
|
2017-01-03 02:08:21 -05:00
|
|
|
context 'when send_user_confirmation_email is true' do
|
2019-07-31 10:49:52 -04:00
|
|
|
before do
|
2019-03-06 07:12:04 -05:00
|
|
|
stub_application_setting(send_user_confirmation_email: true)
|
2019-07-31 10:49:52 -04:00
|
|
|
end
|
|
|
|
|
2020-03-11 20:09:34 -04:00
|
|
|
context 'when soft email confirmation is not enabled' do
|
2020-02-11 07:08:52 -05:00
|
|
|
before do
|
2020-03-11 20:09:34 -04:00
|
|
|
stub_feature_flags(soft_email_confirmation: false)
|
|
|
|
allow(User).to receive(:allow_unconfirmed_access_for).and_return 0
|
2020-02-11 07:08:52 -05:00
|
|
|
end
|
2019-07-31 10:49:52 -04:00
|
|
|
|
2020-03-11 20:09:34 -04:00
|
|
|
it 'does not authenticate the user and sends a confirmation email' do
|
2020-10-08 11:08:17 -04:00
|
|
|
expect { subject }.to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).to be_nil
|
2020-02-11 07:08:52 -05:00
|
|
|
end
|
2021-04-27 23:09:58 -04:00
|
|
|
|
|
|
|
context 'when registration is triggered from an accepted invite' do
|
2021-04-29 17:10:03 -04:00
|
|
|
context 'when it is part of our invite email experiment', :experiment do
|
|
|
|
let_it_be(:member) { create(:project_member, :invited, invite_email: user_params.dig(:user, :email)) }
|
|
|
|
|
|
|
|
let(:originating_member_id) { member.id }
|
|
|
|
let(:session_params) do
|
|
|
|
{
|
|
|
|
invite_email: user_params.dig(:user, :email),
|
|
|
|
originating_member_id: originating_member_id
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when member exists from the session key value' do
|
|
|
|
it 'tracks the experiment' do
|
|
|
|
expect(experiment('members/invite_email')).to track(:accepted)
|
|
|
|
.with_context(actor: member)
|
|
|
|
.on_next_instance
|
|
|
|
|
|
|
|
subject
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when member does not exist from the session key value' do
|
|
|
|
let(:originating_member_id) { -1 }
|
|
|
|
|
|
|
|
it 'tracks the experiment' do
|
|
|
|
expect(experiment('members/invite_email')).not_to track(:accepted)
|
|
|
|
|
|
|
|
subject
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-04-27 23:09:58 -04:00
|
|
|
context 'when invite email matches email used on registration' do
|
|
|
|
let(:session_params) { { invite_email: user_params.dig(:user, :email) } }
|
|
|
|
|
|
|
|
it 'signs the user in without sending a confirmation email', :aggregate_failures do
|
|
|
|
expect { subject }.not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).to be_confirmed
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when invite email does not match the email used on registration' do
|
|
|
|
let(:session_params) { { invite_email: 'bogus@email.com' } }
|
|
|
|
|
|
|
|
it 'does not authenticate the user and sends a confirmation email', :aggregate_failures do
|
|
|
|
expect { subject }.to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).to be_nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2020-02-11 07:08:52 -05:00
|
|
|
end
|
|
|
|
|
2020-03-11 20:09:34 -04:00
|
|
|
context 'when soft email confirmation is enabled' do
|
2020-02-11 07:08:52 -05:00
|
|
|
before do
|
2020-03-11 20:09:34 -04:00
|
|
|
stub_feature_flags(soft_email_confirmation: true)
|
|
|
|
allow(User).to receive(:allow_unconfirmed_access_for).and_return 2.days
|
2020-02-11 07:08:52 -05:00
|
|
|
end
|
|
|
|
|
2020-03-11 20:09:34 -04:00
|
|
|
it 'authenticates the user and sends a confirmation email' do
|
2020-10-08 11:08:17 -04:00
|
|
|
expect { subject }.to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).to be_present
|
2020-09-10 11:09:10 -04:00
|
|
|
expect(response).to redirect_to(users_sign_up_welcome_path)
|
2020-02-11 07:08:52 -05:00
|
|
|
end
|
2021-04-27 23:09:58 -04:00
|
|
|
|
|
|
|
context 'when invite email matches email used on registration' do
|
|
|
|
let(:session_params) { { invite_email: user_params.dig(:user, :email) } }
|
|
|
|
|
|
|
|
it 'signs the user in without sending a confirmation email', :aggregate_failures do
|
|
|
|
expect { subject }.not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).to be_confirmed
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when invite email does not match the email used on registration' do
|
|
|
|
let(:session_params) { { invite_email: 'bogus@email.com' } }
|
|
|
|
|
|
|
|
it 'authenticates the user and sends a confirmation email without confirming', :aggregate_failures do
|
|
|
|
expect { subject }.to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
|
|
|
|
expect(controller.current_user).not_to be_confirmed
|
|
|
|
end
|
|
|
|
end
|
2017-01-03 02:08:21 -05:00
|
|
|
end
|
2017-03-27 05:37:24 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
context 'when signup_enabled? is false' do
|
|
|
|
it 'redirects to sign_in' do
|
2019-03-06 07:12:04 -05:00
|
|
|
stub_application_setting(signup_enabled: false)
|
2017-03-27 05:37:24 -04:00
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
expect { subject }.not_to change(User, :count)
|
2017-03-27 05:37:24 -04:00
|
|
|
expect(response).to redirect_to(new_user_session_path)
|
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-03 02:08:21 -05:00
|
|
|
context 'when reCAPTCHA is enabled' do
|
|
|
|
before do
|
|
|
|
stub_application_setting(recaptcha_enabled: true)
|
|
|
|
end
|
|
|
|
|
2019-09-05 12:38:19 -04:00
|
|
|
after do
|
|
|
|
# Avoid test ordering issue and ensure `verify_recaptcha` returns true
|
|
|
|
unless Recaptcha.configuration.skip_verify_env.include?('test')
|
|
|
|
Recaptcha.configuration.skip_verify_env << 'test'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-03 02:08:21 -05:00
|
|
|
it 'displays an error when the reCAPTCHA is not solved' do
|
2019-09-06 13:54:58 -04:00
|
|
|
allow_any_instance_of(described_class).to receive(:verify_recaptcha).and_return(false)
|
2016-04-21 14:55:54 -04:00
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
subject
|
2017-01-03 02:08:21 -05:00
|
|
|
|
|
|
|
expect(response).to render_template(:new)
|
2019-12-12 07:07:33 -05:00
|
|
|
expect(flash[:alert]).to eq(_('There was an error with the reCAPTCHA. Please solve the reCAPTCHA again.'))
|
2017-01-03 02:08:21 -05:00
|
|
|
end
|
|
|
|
|
2020-09-10 11:09:10 -04:00
|
|
|
it 'redirects to the welcome page when the reCAPTCHA is solved' do
|
2020-10-08 11:08:17 -04:00
|
|
|
subject
|
2017-01-03 02:08:21 -05:00
|
|
|
|
2020-09-10 11:09:10 -04:00
|
|
|
expect(response).to redirect_to(users_sign_up_welcome_path)
|
2016-04-21 14:55:54 -04:00
|
|
|
end
|
|
|
|
end
|
2018-06-08 07:20:44 -04:00
|
|
|
|
2019-08-09 11:40:54 -04:00
|
|
|
context 'when invisible captcha is enabled' do
|
|
|
|
before do
|
2021-01-12 10:10:37 -05:00
|
|
|
stub_application_setting(invisible_captcha_enabled: true)
|
2019-08-09 11:40:54 -04:00
|
|
|
InvisibleCaptcha.timestamp_threshold = treshold
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:treshold) { 4 }
|
|
|
|
let(:session_params) { { invisible_captcha_timestamp: form_rendered_time.iso8601 } }
|
|
|
|
let(:form_rendered_time) { Time.current }
|
|
|
|
let(:submit_time) { form_rendered_time + treshold }
|
2019-08-14 08:05:24 -04:00
|
|
|
let(:auth_log_attributes) do
|
|
|
|
{
|
|
|
|
message: auth_log_message,
|
|
|
|
env: :invisible_captcha_signup_bot_detected,
|
2019-08-20 14:12:28 -04:00
|
|
|
remote_ip: '0.0.0.0',
|
2019-08-14 08:05:24 -04:00
|
|
|
request_method: 'POST',
|
2019-08-20 14:12:28 -04:00
|
|
|
path: '/users'
|
2019-08-14 08:05:24 -04:00
|
|
|
}
|
|
|
|
end
|
2019-08-09 11:40:54 -04:00
|
|
|
|
|
|
|
describe 'the honeypot has not been filled and the signup form has not been submitted too quickly' do
|
|
|
|
it 'creates an account' do
|
|
|
|
travel_to(submit_time) do
|
|
|
|
expect { post(:create, params: user_params, session: session_params) }.to change(User, :count).by(1)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-08-14 08:05:24 -04:00
|
|
|
describe 'honeypot spam detection' do
|
2019-08-09 11:40:54 -04:00
|
|
|
let(:user_params) { super().merge(firstname: 'Roy', lastname: 'Batty') }
|
2019-08-14 08:05:24 -04:00
|
|
|
let(:auth_log_message) { 'Invisible_Captcha_Honeypot_Request' }
|
2019-08-09 11:40:54 -04:00
|
|
|
|
2019-08-14 08:05:24 -04:00
|
|
|
it 'logs the request, refuses to create an account and renders an empty body' do
|
2019-08-09 11:40:54 -04:00
|
|
|
travel_to(submit_time) do
|
2019-08-14 08:05:24 -04:00
|
|
|
expect(Gitlab::Metrics).to receive(:counter)
|
|
|
|
.with(:bot_blocked_by_invisible_captcha_honeypot, 'Counter of blocked sign up attempts with filled honeypot')
|
|
|
|
.and_call_original
|
|
|
|
expect(Gitlab::AuthLogger).to receive(:error).with(auth_log_attributes).once
|
2019-08-09 11:40:54 -04:00
|
|
|
expect { post(:create, params: user_params, session: session_params) }.not_to change(User, :count)
|
2020-01-27 07:08:35 -05:00
|
|
|
expect(response).to have_gitlab_http_status(:ok)
|
2019-08-09 11:40:54 -04:00
|
|
|
expect(response.body).to be_empty
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-08-14 08:05:24 -04:00
|
|
|
describe 'timestamp spam detection' do
|
|
|
|
let(:auth_log_message) { 'Invisible_Captcha_Timestamp_Request' }
|
2019-08-09 11:40:54 -04:00
|
|
|
|
2019-08-14 08:05:24 -04:00
|
|
|
context 'the sign up form has been submitted without the invisible_captcha_timestamp parameter' do
|
|
|
|
let(:session_params) { nil }
|
|
|
|
|
|
|
|
it 'logs the request, refuses to create an account and displays a flash alert' do
|
|
|
|
travel_to(submit_time) do
|
|
|
|
expect(Gitlab::Metrics).to receive(:counter)
|
|
|
|
.with(:bot_blocked_by_invisible_captcha_timestamp, 'Counter of blocked sign up attempts with invalid timestamp')
|
|
|
|
.and_call_original
|
|
|
|
expect(Gitlab::AuthLogger).to receive(:error).with(auth_log_attributes).once
|
|
|
|
expect { post(:create, params: user_params, session: session_params) }.not_to change(User, :count)
|
|
|
|
expect(response).to redirect_to(new_user_session_path)
|
2019-12-12 07:07:33 -05:00
|
|
|
expect(flash[:alert]).to eq(I18n.t('invisible_captcha.timestamp_error_message'))
|
2019-08-14 08:05:24 -04:00
|
|
|
end
|
2019-08-09 11:40:54 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-08-14 08:05:24 -04:00
|
|
|
context 'the sign up form has been submitted too quickly' do
|
|
|
|
let(:submit_time) { form_rendered_time }
|
|
|
|
|
|
|
|
it 'logs the request, refuses to create an account and displays a flash alert' do
|
|
|
|
travel_to(submit_time) do
|
|
|
|
expect(Gitlab::Metrics).to receive(:counter)
|
|
|
|
.with(:bot_blocked_by_invisible_captcha_timestamp, 'Counter of blocked sign up attempts with invalid timestamp')
|
|
|
|
.and_call_original
|
|
|
|
expect(Gitlab::AuthLogger).to receive(:error).with(auth_log_attributes).once
|
|
|
|
expect { post(:create, params: user_params, session: session_params) }.not_to change(User, :count)
|
|
|
|
expect(response).to redirect_to(new_user_session_path)
|
2019-12-12 07:07:33 -05:00
|
|
|
expect(flash[:alert]).to eq(I18n.t('invisible_captcha.timestamp_error_message'))
|
2019-08-14 08:05:24 -04:00
|
|
|
end
|
2019-08-09 11:40:54 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-10-12 14:08:31 -04:00
|
|
|
context 'terms of service' do
|
|
|
|
context 'when terms are enforced' do
|
2020-08-05 08:09:45 -04:00
|
|
|
before do
|
2020-10-12 14:08:31 -04:00
|
|
|
enforce_terms
|
2020-08-05 08:09:45 -04:00
|
|
|
end
|
|
|
|
|
2020-10-12 14:08:31 -04:00
|
|
|
it 'creates the user with accepted terms' do
|
|
|
|
subject
|
2020-08-05 08:09:45 -04:00
|
|
|
|
2020-10-12 14:08:31 -04:00
|
|
|
expect(controller.current_user).to be_present
|
|
|
|
expect(controller.current_user.terms_accepted?).to be(true)
|
2020-08-05 08:09:45 -04:00
|
|
|
end
|
|
|
|
end
|
2020-09-03 20:09:08 -04:00
|
|
|
|
2020-10-12 14:08:31 -04:00
|
|
|
context 'when terms are not enforced' do
|
|
|
|
it 'creates the user without accepted terms' do
|
2020-09-03 20:09:08 -04:00
|
|
|
subject
|
2020-08-05 08:09:45 -04:00
|
|
|
|
2020-10-12 14:08:31 -04:00
|
|
|
expect(controller.current_user).to be_present
|
|
|
|
expect(controller.current_user.terms_accepted?).to be(false)
|
2020-08-05 08:09:45 -04:00
|
|
|
end
|
|
|
|
end
|
2019-10-23 11:06:29 -04:00
|
|
|
end
|
|
|
|
|
2019-06-25 18:32:54 -04:00
|
|
|
it "logs a 'User Created' message" do
|
|
|
|
expect(Gitlab::AppLogger).to receive(:info).with(/\AUser Created: username=new_username email=new@user.com.+\z/).and_call_original
|
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
subject
|
2019-06-25 18:32:54 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'handles when params are new_user' do
|
|
|
|
post(:create, params: { new_user: base_user_params })
|
|
|
|
|
2020-10-08 11:08:17 -04:00
|
|
|
expect(controller.current_user).not_to be_nil
|
2019-06-25 18:32:54 -04:00
|
|
|
end
|
2020-01-17 04:08:24 -05:00
|
|
|
|
2020-10-07 17:08:21 -04:00
|
|
|
it 'sets name from first and last name' do
|
|
|
|
post :create, params: { new_user: base_user_params }
|
2020-01-17 04:08:24 -05:00
|
|
|
|
2020-10-07 17:08:21 -04:00
|
|
|
expect(User.last.first_name).to eq(base_user_params[:first_name])
|
|
|
|
expect(User.last.last_name).to eq(base_user_params[:last_name])
|
|
|
|
expect(User.last.name).to eq("#{base_user_params[:first_name]} #{base_user_params[:last_name]}")
|
2020-01-17 04:08:24 -05:00
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
end
|
2017-04-01 00:29:51 -04:00
|
|
|
|
|
|
|
describe '#destroy' do
|
|
|
|
let(:user) { create(:user) }
|
|
|
|
|
|
|
|
before do
|
|
|
|
sign_in(user)
|
|
|
|
end
|
|
|
|
|
2017-10-06 16:40:41 -04:00
|
|
|
def expect_failure(message)
|
|
|
|
expect(flash[:alert]).to eq(message)
|
2020-03-31 17:08:05 -04:00
|
|
|
expect(response).to have_gitlab_http_status(:see_other)
|
2017-10-06 16:40:41 -04:00
|
|
|
expect(response).to redirect_to profile_account_path
|
|
|
|
end
|
|
|
|
|
|
|
|
def expect_password_failure
|
2019-12-12 07:07:33 -05:00
|
|
|
expect_failure(s_('Profiles|Invalid password'))
|
2017-10-06 16:40:41 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def expect_username_failure
|
2019-12-12 07:07:33 -05:00
|
|
|
expect_failure(s_('Profiles|Invalid username'))
|
2017-10-06 16:40:41 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def expect_success
|
2019-12-12 07:07:33 -05:00
|
|
|
expect(flash[:notice]).to eq s_('Profiles|Account scheduled for removal.')
|
2020-03-31 17:08:05 -04:00
|
|
|
expect(response).to have_gitlab_http_status(:see_other)
|
2017-10-06 16:40:41 -04:00
|
|
|
expect(response).to redirect_to new_user_session_path
|
|
|
|
end
|
2017-04-01 00:29:51 -04:00
|
|
|
|
2017-10-06 16:40:41 -04:00
|
|
|
context 'user requires password confirmation' do
|
|
|
|
it 'fails if password confirmation is not provided' do
|
|
|
|
post :destroy
|
2017-04-01 00:29:51 -04:00
|
|
|
|
2017-10-06 16:40:41 -04:00
|
|
|
expect_password_failure
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails if password confirmation is wrong' do
|
2018-12-17 17:52:17 -05:00
|
|
|
post :destroy, params: { password: 'wrong password' }
|
2017-10-06 16:40:41 -04:00
|
|
|
|
|
|
|
expect_password_failure
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds if password is confirmed' do
|
2018-12-17 17:52:17 -05:00
|
|
|
post :destroy, params: { password: '12345678' }
|
2017-10-06 16:40:41 -04:00
|
|
|
|
|
|
|
expect_success
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'user does not require password confirmation' do
|
|
|
|
before do
|
2017-11-23 08:16:14 -05:00
|
|
|
stub_application_setting(password_authentication_enabled_for_web: false)
|
|
|
|
stub_application_setting(password_authentication_enabled_for_git: false)
|
2017-10-06 16:40:41 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails if username confirmation is not provided' do
|
|
|
|
post :destroy
|
|
|
|
|
|
|
|
expect_username_failure
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails if username confirmation is wrong' do
|
2018-12-17 17:52:17 -05:00
|
|
|
post :destroy, params: { username: 'wrong username' }
|
2017-10-06 16:40:41 -04:00
|
|
|
|
|
|
|
expect_username_failure
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds if username is confirmed' do
|
2018-12-17 17:52:17 -05:00
|
|
|
post :destroy, params: { username: user.username }
|
2017-10-06 16:40:41 -04:00
|
|
|
|
|
|
|
expect_success
|
|
|
|
end
|
2017-04-01 00:29:51 -04:00
|
|
|
end
|
2020-10-01 14:10:20 -04:00
|
|
|
|
|
|
|
context 'prerequisites for account deletion' do
|
|
|
|
context 'solo-owned groups' do
|
|
|
|
let(:group) { create(:group) }
|
|
|
|
|
|
|
|
context 'if the user is the sole owner of at least one group' do
|
|
|
|
before do
|
|
|
|
create(:group_member, :owner, group: group, user: user)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails' do
|
|
|
|
delete :destroy, params: { password: '12345678' }
|
|
|
|
|
|
|
|
expect_failure(s_('Profiles|You must transfer ownership or delete groups you are an owner of before you can delete your account'))
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2017-04-01 00:29:51 -04:00
|
|
|
end
|
2016-04-21 14:55:54 -04:00
|
|
|
end
|