authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/account_existence_parity_test.rb.tt

@@ -0,0 +1,158 @@
+require "test_helper"
+
+class <%= identity.module_name %>::AccountExistenceParityTest < ActionDispatch::IntegrationTest
+  def queue_adapter_for_test = ActiveJob::QueueAdapters::TestAdapter.new
+
+  setup { @user = <%= identity.plural %>(:alice) }
+<%- if password? -%>
+
+  test "a failed sign-in does the same work for any address" do
+    assert_same_work(@user.<%= login_field %>, unknown_email) do |login|
+      post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: login, password: "wrong-password-0" }
+    end
+  end
+<%- end -%>
+<%- if recoverable? -%>
+
+  test "a password reset request does the same work for any address" do
+    assert_same_work(@user.email, unknown_email) do |email|
+      post <%= identity.route_scope %>_reset_password_path, params: { email: }
+    end
+  end
+<%- end -%>
+<%- if magic_link? -%>
+
+  test "a magic link request does the same work for any address" do
+    assert_same_work(@user.email, unknown_email) do |email|
+      post <%= identity.route_scope %>_magic_link_path, params: { email: }
+    end
+  end
+<%- end -%>
+<%- if sms_code? -%>
+
+  test "an SMS sign-in request does the same work for any number" do
+    assert_same_work(@user.phone, unknown_phone) do |phone|
+      post <%= identity.route_scope %>_sms_sign_in_path, params: { phone: }
+    end
+  end
+
+  test "an SMS sign-in code check does the same work for any number" do
+    works = [ @user.phone, unknown_phone ].map do |phone|
+      perform_enqueued_jobs(only: AuthnzElevenDeferredJob) do
+        post <%= identity.route_scope %>_sms_sign_in_path, params: { phone: }
+      end
+      work_of { patch <%= identity.route_scope %>_sms_sign_in_code_path, params: { code: "000000" } }
+    end
+
+    assert_equal(*works)
+  end
+<%- end -%>
+<%- if email_gated_registration? && !invite_only? -%>
+
+  test "signing up does the same work for any address" do
+    assert_same_work(@user.email, unknown_email) do |email|
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email:)
+    end
+  end
+
+  test "resending a sign-up link does the same work for any address" do
+    works = [ @user.email, unknown_email ].map do |email|
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params(email:)
+      work_of { post <%= identity.route_scope %>_verify_email_path }
+    end
+
+    assert_equal(*works)
+  end
+<%- end -%>
+<%- if email_change_verification? -%>
+
+  test "changing your email does the same work for any address" do
+    sign_in_as <%= identity.plural %>(:bob)
+    assert_same_work(@user.email, unknown_email) do |email|
+      patch <%= identity.settings_helper_prefix %>_email_path, params: { email:<%= settings_credential_pair %> }
+    end
+  end
+
+  test "resending an email change link does the same work for any address" do
+    sign_in_as <%= identity.plural %>(:bob)
+    works = [ @user.email, unknown_email ].map do |email|
+      patch <%= identity.settings_helper_prefix %>_email_path, params: { email:<%= settings_credential_pair %> }
+      work_of { post <%= identity.settings_helper_prefix %>_email_verification_path }
+    end
+
+    assert_equal(*works)
+  end
+<%- end -%>
+<%- if phone_change_verification? -%>
+
+  test "changing your phone does the same work for any number" do
+    sign_in_as <%= identity.plural %>(:bob)
+    assert_same_work(@user.phone, unknown_phone) do |phone|
+      patch <%= identity.settings_helper_prefix %>_phone_path, params: { phone:<%= settings_credential_pair %> }
+    end
+  end
+
+  test "resending a phone change code does the same work for any number" do
+    sign_in_as <%= identity.plural %>(:bob)
+    works = [ @user.phone, unknown_phone ].map do |phone|
+      patch <%= identity.settings_helper_prefix %>_phone_path, params: { phone:<%= settings_credential_pair %> }
+      work_of { post <%= identity.settings_helper_prefix %>_phone_verification_path }
+    end
+
+    assert_equal(*works)
+  end
+<%- end -%>
+<%- if invitable? -%>
+
+  test "inviting does the same work for anyone" do
+    sign_in_as <%= identity.plural %>(:bob)
+<%- if email_invitable? -%>
+    assert_same_work(@user.email, unknown_email) do |sent_to|
+<%- else -%>
+    assert_same_work(@user.phone, unknown_phone) do |sent_to|
+<%- end -%>
+      post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: }
+    end
+  end
+<%- end -%>
+
+  private
+
+  def assert_same_work(known, unknown, &request)
+    assert_equal work_of { request.(known) }, work_of { request.(unknown) }
+  end
+
+  def work_of
+    work = []
+    record = lambda do |event, *, payload|
+      if event == "sql.active_record"
+        work << [ without_literals(payload[:sql]), payload[:row_count] ] unless payload[:sql].start_with?("SELECT") || payload[:name] == "SCHEMA"
+      elsif !payload[:key].to_s.start_with?("rate-limit:")
+        work << [ event, payload[:job]&.class ]
+      end
+    end
+    ActiveSupport::Notifications.subscribed(record, /\A(sql\.active_record|cache_\w+\.active_support|enqueue\.active_job)\z/) { yield }
+    work
+  end
+
+  def without_literals(sql) = sql.gsub(/'(?:[^'\\]|\\.)*'|\b\d+\b/, "?")
+
+  def unknown_email = "nobody-#{SecureRandom.hex(4)}@example.com"
+<%- if principals.phone -%>
+  def unknown_phone = "+14158264010"
+<%- end -%>
+<%- if email_change_verification? || phone_change_verification? || invitable? -%>
+
+  def sign_in_as(user)
+    perform_enqueued_jobs(only: AuthnzElevenDeferredJob) do
+<%= test_sign_in_body.gsub(/^(?=.)/, "  ") %>
+    end
+  end
+<%- end -%>
+<%- if email_gated_registration? && !invite_only? -%>
+
+  def sign_up_params(**overrides)
+    <%= sign_up_fixture_literal(indent: 4) %>.merge(overrides)
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/admin/access_test.rb.tt

@@ -0,0 +1,139 @@
+require "test_helper"
+
+class <%= admin_module %>::AccessTest < ActionDispatch::IntegrationTest
+  test "the admin area is a 404 for anonymous visitors" do
+    get <%= admin_helper("root_path") %>
+    assert_response :not_found
+  end
+<%- if password? -%>
+
+  test "the admin area is a 404 for a signed-in non-admin" do
+    sign_in_as <%= identity.plural %>(:bob)
+    get <%= admin_helper("root_path") %>
+    assert_response :not_found
+  end
+
+<%- if password_rotatable? -%>
+
+  test "the admin area is a 404 for a non-admin held at a completion gate" do
+    sign_in_as <%= identity.plural %>(:bob)
+<%- if password_rotatable? -%>
+    <%= identity.plural %>(:bob).update!(password_changed_at: 1.year.ago)
+<%- end -%>
+
+    get <%= admin_helper("root_path") %>
+    assert_response :not_found
+  end
+<%- end -%>
+
+  test "an admin can reach the dashboard" do
+    sign_in_as <%= identity.plural %>(:alice)
+<%- if admin_mfa_gate? -%>
+    <%= enroll_second_factor_expr("#{identity.plural}(:alice)") %>
+<%- end -%>
+    get <%= admin_helper("root_path") %>
+    assert_response :success
+  end
+
+  test "the destructive actions refuse an admin target" do
+    sign_in_as <%= identity.plural %>(:alice)
+<%- if admin_mfa_gate? -%>
+    <%= enroll_second_factor_expr("#{identity.plural}(:alice)") %>
+<%- end -%>
+
+    [ <%= identity.plural %>(:carol), <%= identity.plural %>(:alice) ].each do |admin|
+      delete <%= admin_helper("user_path") %>(admin)
+      assert_redirected_to <%= admin_helper("users_path") %>
+      assert <%= identity.class_name %>.exists?(admin.id), "an admin must not be deleted here"
+<%- if bannable? -%>
+
+      post ban_<%= admin_helper("user_path") %>(admin)
+      assert_not admin.reload.banned?, "an admin must not be suspended here"
+<%- end -%>
+<%- if second_factor? -%>
+
+      <%= enroll_second_factor_expr("admin") %> unless admin.second_factor_enrolled?
+      post reset_second_factor_<%= admin_helper("user_path") %>(admin)
+      assert admin.reload.second_factor_enrolled?, "an admin's second factor must survive"
+<%- end -%>
+    end
+  end
+<%- if impersonatable? && !admin_mfa_gate? -%>
+
+  test "an admin can impersonate another user, and stop" do
+    sign_in_as <%= identity.plural %>(:alice)
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:bob))
+    assert_redirected_to <%= identity.nested_helper("root_path") %>
+
+    get <%= admin_helper("root_path") %>
+    assert_response :not_found
+
+    delete <%= identity.nested_helper("impersonation_path") %>
+    assert_redirected_to <%= admin_helper("root_path") %>
+
+    get <%= admin_helper("root_path") %>
+    assert_response :success
+  end
+
+  test "impersonation expires on its own" do
+    sign_in_as <%= identity.plural %>(:alice)
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:bob))
+
+    travel <%= identity.config_reference %>.impersonation.duration + 1.minute do
+      get <%= identity.nested_helper("root_path") %>
+      assert_redirected_to <%= admin_helper("root_path") %>
+
+      get <%= admin_helper("root_path") %>
+      assert_response :success, "alice should be herself again"
+    end
+  end
+
+  test "an admin cannot impersonate an admin, including themselves" do
+    sign_in_as <%= identity.plural %>(:alice)
+
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:carol))
+    assert_redirected_to <%= admin_helper("users_path") %>
+
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:alice))
+    assert_redirected_to <%= admin_helper("users_path") %>
+
+    get <%= admin_helper("root_path") %>
+    assert_response :success, "alice should still be herself, with her admin access intact"
+  end
+<%- if trackable? -%>
+
+  test "impersonation is recorded at both ends" do
+    sign_in_as <%= identity.plural %>(:alice)
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:bob))
+    delete <%= identity.nested_helper("impersonation_path") %>
+
+    events = <%= identity.plural %>(:bob).events.chronological.last(2)
+    assert_equal [ "<%= identity.singular %>.impersonation_started", "<%= identity.singular %>.impersonation_stopped" ],
+                 events.map(&:event_type)
+    assert_equal [ <%= identity.plural %>(:alice), <%= identity.plural %>(:alice) ], events.map(&:actor)
+  end
+<%- end -%>
+
+  test "a non-admin cannot impersonate" do
+    sign_in_as <%= identity.plural %>(:bob)
+    post <%= admin_helper("impersonate_user_path") %>(<%= identity.plural %>(:alice))
+    assert_response :not_found
+  end
+
+  test "the stop-impersonating route is a 404 when nobody is impersonating" do
+    delete <%= identity.nested_helper("impersonation_path") %>
+    assert_response :not_found
+
+    sign_in_as <%= identity.plural %>(:bob)
+    delete <%= identity.nested_helper("impersonation_path") %>
+    assert_response :not_found
+  end
+<%- end -%>
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/admin/multi_factor_authentication_test.rb.tt

@@ -0,0 +1,65 @@
+require "test_helper"
+
+class <%= admin_module %>::MultiFactorAuthenticationTest < ActionDispatch::IntegrationTest
+  setup { @admin = <%= identity.plural %>(:alice) }
+
+  test "an MFA-less admin is held: an admin page bounces to the enrollment screen" do
+    assert_not @admin.second_factor_enrolled?
+    sign_in_as @admin
+
+    get <%= admin_helper("users_path") %>
+    assert_redirected_to <%= admin_mfa_hold_path %>
+  end
+
+  test "the enrollment screen stays reachable while held" do
+    sign_in_as @admin
+<%- if sudo_test_mode == :answer -%>
+    post <%= identity.route_scope %>_sudo_path, params: { <%= sudo_test_answer %> }
+<%- end -%>
+
+    get <%= admin_mfa_hold_path %>
+    assert_response :success
+  end
+<%- if sudo_test_mode == :answer -%>
+
+  test "the sudo page stays reachable while held, so the enrollment screen can ask for confirmation" do
+    sign_in_as @admin
+
+    get new_<%= identity.route_scope %>_sudo_path
+    assert_response :success
+  end
+<%- end -%>
+
+  test "enrolling a second factor clears the gate for the rest of the admin area" do
+    sign_in_as @admin
+    get <%= admin_helper("users_path") %>
+    assert_redirected_to <%= admin_mfa_hold_path %>, "held before a second factor is enrolled"
+
+    <%= enroll_second_factor_expr("@admin") %>
+    assert @admin.reload.second_factor_enrolled?
+
+    get <%= admin_helper("users_path") %>
+    assert_response :success, "cleared once a second factor is enrolled"
+  end
+
+
+  test "an admin clears every second factor a user holds" do
+    stranded = <%= identity.plural %>(:bob)
+    <%= enroll_second_factor_expr("stranded") %>
+    <%= identity.recovery_code_class %>.regenerate_for(stranded)
+
+    sign_in_as @admin
+    <%= enroll_second_factor_expr("@admin") %>
+    post reset_second_factor_<%= admin_helper("user_path") %>(stranded)
+
+    assert_not stranded.reload.second_factor_enrolled?
+    assert_empty stranded.recovery_codes.reload,
+                 "codes guarding nothing are live sign-in secrets"
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/api_token_authentication_test.rb.tt

@@ -0,0 +1,45 @@
+require "test_helper"
+
+class <%= identity.class_name %>ApiTokenProbeController < ActionController::API
+  include <%= identity.nested_module("ApiTokenAuthentication") %>
+
+  def index
+    render json: { user_id: current_api_user.id, token_id: current_api_token.id }
+  end
+end
+
+class <%= identity.class_name %>ApiTokenAuthenticationTest < ActionController::TestCase
+  tests <%= identity.class_name %>ApiTokenProbeController
+
+  setup do
+    @routes = ActionDispatch::Routing::RouteSet.new
+    @routes.draw { get "api_token_probe", to: "<%= identity.class_name.underscore %>_api_token_probe#index" }
+    @user = <%= identity.plural %>(:bob)
+    @token, @secret = <%= identity.api_token_class %>.issue!(user: @user, name: "Integration")
+  end
+
+  test "bearer token authenticates without a browser session" do
+    @request.headers["Authorization"] = "Bearer #{@secret}"
+    get :index
+
+    assert_response :success
+    assert_equal @user.id, response.parsed_body["user_id"]
+    assert_equal @token.id, response.parsed_body["token_id"]
+    assert_nil <%= identity.current_class %>.session
+  end
+
+  test "missing expired and revoked tokens are rejected" do
+    get :index
+    assert_response :unauthorized
+
+    @request.headers["Authorization"] = "Bearer #{@secret}"
+    @token.update!(expires_at: 1.second.ago)
+    get :index
+    assert_response :unauthorized
+
+    @token.update!(expires_at: 1.day.from_now)
+    @token.destroy!
+    get :index
+    assert_response :unauthorized
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/credential_enrollment_test.rb.tt

@@ -0,0 +1,84 @@
+require "test_helper"
+
+class <%= identity.module_name %>::CredentialEnrollmentTest < ActionDispatch::IntegrationTest
+  test "an unfinished registration does not create an account" do
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    end
+
+<%- if invite_only? -%>
+    assert_not <%= identity.pending_registration_class %>.exists?, "admission is required before staging"
+<%- else -%>
+    assert <%= identity.pending_registration_class %>.exists?
+<%- end -%>
+  end
+
+<%- if pre_account_password_enrollment? -%>
+  test "password and account commit together" do
+    registration = stage_registration_awaiting_credential
+
+    assert_difference -> { <%= identity.class_name %>.count }, 1 do
+      post <%= identity.route_scope %>_registration_password_path,
+        params: { password: "Correct horse battery staple 42!", password_confirmation: "Correct horse battery staple 42!" }
+    end
+
+    assert_not <%= identity.pending_registration_class %>.exists?(registration.id)
+  end
+
+  test "the password step enforces the password rules" do
+    stage_registration_awaiting_credential
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_registration_password_path, params: { password: "a", password_confirmation: "a" }
+    end
+    assert_response :unprocessable_entity
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      post <%= identity.route_scope %>_registration_password_path,
+        params: { password: "Correct horse battery staple 42!", password_confirmation: "Something else entirely 42!" }
+    end
+    assert_response :unprocessable_entity
+  end
+<%- end -%>
+<%- if pre_account_provider_enrollment? -%>
+
+  test "connecting a provider from the finish-setup page completes the sign-up" do
+    request_validation = OmniAuth.config.request_validation_phase
+    OmniAuth.config.request_validation_phase = nil
+    OmniAuth.config.test_mode = true
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(provider: "developer", uid: "finishing-setup")
+    stage_registration_awaiting_credential
+
+    assert_difference -> { <%= identity.class_name %>.count }, 1 do
+      post "<%= omniauth_path_prefix %>/developer?registration_intent=1"
+      follow_redirect!
+    end
+    assert <%= identity.omniauth_identity_class %>.exists?(uid: "finishing-setup")
+    assert cookies[:<%= identity.cookie_name %>].present?
+  ensure
+    OmniAuth.config.mock_auth[:developer] = nil
+    OmniAuth.config.test_mode = false
+    OmniAuth.config.request_validation_phase = request_validation
+  end
+<%- end -%>
+
+  private
+<%- if pre_account_password_enrollment? || pre_account_provider_enrollment? -%>
+
+  def stage_registration_awaiting_credential
+    post <%= identity.route_scope %>_sign_up_path, params: sign_up_params
+    registration = <%= identity.pending_registration_class %>.last
+<%- if email_verifiable? -%>
+    registration.update!(email_verified_at: Time.current)
+<%- end -%>
+<%- if phone_verifiable? -%>
+    registration.update!(phone_verified_at: Time.current)
+<%- end -%>
+    registration
+  end
+<%- end -%>
+
+  def sign_up_params
+    <%= sign_up_fixture_literal(indent: 4) %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/guest_access_test.rb.tt

@@ -0,0 +1,113 @@
+require "test_helper"
+
+class <%= identity.module_name %>::GuestAccessTest < ActionDispatch::IntegrationTest
+<%- if timeoutable? -%>
+  include ActiveSupport::Testing::TimeHelpers
+
+<%- end -%>
+  class ProbeController < <%= identity.controller_superclass %>
+    allow_guest_access
+
+    def show
+      render plain: "#{<%= identity.current_class %>.user&.id}:#{<%= identity.current_class %>.user&.guest?}:#{authenticated?}"
+    end
+
+    def sign_in
+      <%= sign_in_call("#{identity.class_name}.find(params[:id])", via: :second_factor, may_challenge: false) %>
+      head :ok
+    end
+  end
+
+  setup { @<%= identity.singular %> = <%= identity.plural %>(:bob) }
+
+  test "an anonymous visitor is admitted and given a guest identity" do
+    with_probe_routes do
+      assert_difference -> { <%= identity.class_name %>.guests.count }, +1 do
+        get "/guest_probe"
+      end
+
+      assert_response :success
+      assert_equal "#{<%= identity.class_name %>.guests.last.id}:true:false", response.body
+      assert_equal "guest", <%= identity.class_name %>.guests.last.sessions.sole.via,
+        "creating a guest does not sign them in"
+    end
+  end
+
+  test "a guest cookie persists until the guest expires" do
+    with_probe_routes do
+      get "/guest_probe"
+      guest = <%= identity.class_name %>.guests.last
+      expires = Time.httpdate(session_cookie_header[/expires=([^;]+)/i, 1])
+
+      assert_in_delta (guest.created_at + <%= identity.config_reference %>.guest.ttl).to_f,
+        expires.to_f, 1
+    end
+  end
+
+  test "the same guest is reused across requests" do
+    with_probe_routes do
+      get "/guest_probe"
+      first = response.body
+
+      assert_no_difference -> { <%= identity.class_name %>.guests.count } do
+        get "/guest_probe"
+      end
+
+      assert_equal first, response.body
+    end
+  end
+<%- if timeoutable? -%>
+
+  test "a guest outlives the idle timeout that would expire a signed-in session" do
+    with_probe_routes do
+      get "/guest_probe"
+      guest = response.body
+
+      travel <%= identity.config_reference %>.session.idle_timeout + 1.day do
+        get "/guest_probe"
+
+        assert_equal guest, response.body, "the guest should still be the same row"
+        assert_nil flash[:alert], "a guest was never signed in, so nothing expired"
+      end
+    end
+  end
+<%- end -%>
+
+  test "signing in absorbs the guest and destroys it" do
+    with_probe_routes do
+      get "/guest_probe"
+      guest = <%= identity.class_name %>.guests.last
+
+      assert_difference -> { <%= identity.class_name %>.guests.count }, -1 do
+        post "/guest_probe/sign_in/#{@<%= identity.singular %>.id}"
+      end
+
+      assert_no_match(/expires=/i, session_cookie_header,
+        "signing in must not inherit the guest cookie's persistence")
+      assert_nil <%= identity.class_name %>.find_by(id: guest.id),
+        "the guest row is destroyed once its state has been handed to the account"
+
+      get "/guest_probe"
+      assert_equal "#{@<%= identity.singular %>.id}:false:true", response.body
+    end
+  end
+
+  private
+
+  def session_cookie_header
+    Array(response.headers["Set-Cookie"])
+      .flat_map { |line| line.to_s.split("\n") }
+      .find { |line| line.start_with?("<%= identity.cookie_name %>=") }.to_s
+  end
+
+  def with_probe_routes
+    # Keep requests and assertions inside this block; with_routing uses a separate integration session and discards its cookies afterward.
+    with_routing do |set|
+      set.draw do
+        get "guest_probe", to: ProbeController.action(:show)
+        post "guest_probe/sign_in/:id", to: ProbeController.action(:sign_in)
+      end
+      yield
+    end
+  end
+end