authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/session_lifecycle_test.rb.tt

@@ -0,0 +1,102 @@
+require "test_helper"
+
+class <%= identity.module_name %>::SessionLifecycleTest < ActionDispatch::IntegrationTest
+<%- if timeoutable? -%>
+  include ActiveSupport::Testing::TimeHelpers
+
+<%- end -%>
+  setup { @user = <%= identity.plural %>(:bob) }
+<%- if timeoutable? -%>
+
+  test "an idle session is destroyed and the owner is bounced to sign in" do
+    sign_in_as @user
+    get <%= identity.settings_helper_prefix %>_sessions_path
+    assert_response :success
+
+    travel <%= identity.config_reference %>.session.idle_timeout + 1.second do
+      get <%= identity.settings_helper_prefix %>_sessions_path
+      assert_response :redirect
+    end
+
+    assert_empty @user.sessions.reload, "the timed-out session should be destroyed"
+  end
+<%- end -%>
+<%- if last_seenable? && test_drivable_door? -%>
+
+  test "signing in stamps last_seen_at" do
+    assert_nil @user.last_seen_at
+    sign_in_as @user
+    assert_not_nil @user.reload.last_seen_at
+  end
+<%- end -%>
+<%- if rememberable? && password? -%>
+
+  test "'remember me' gives the session cookie an explicit lifetime" do
+    sign_in_as @user, remember: true
+    assert_match(/expires=/i, session_cookie_header,
+                 "a remembered session cookie should persist past the browser session")
+  end
+
+  test "without 'remember me' the session cookie lasts only for the browser session" do
+    sign_in_as @user
+    assert_no_match(/expires=/i, session_cookie_header)
+  end
+<%- end -%>
+<%- if max_sessions_evict? -%>
+
+  test "a sign-in past the concurrent-session cap signs out the least-recently-active session" do
+    limit = <%= identity.config_reference %>.session.concurrent_limit
+    oldest = @user.sessions.create!
+    oldest.update_column(:updated_at, 1.year.ago)
+    (limit - 1).times { @user.sessions.create! }
+    assert_equal limit, @user.sessions.count
+
+    sign_in_as @user
+
+    assert_equal limit, @user.sessions.count, "the cap should still hold after a new sign-in"
+    assert_not <%= identity.session_class %>.exists?(oldest.id),
+               "the least-recently-active session should have been signed out"
+  end
+<%- end -%>
+<%- if max_sessions_prompt? -%>
+
+  test "a sign-in past the concurrent-session cap holds the user until they sign one out" do
+    limit = <%= identity.config_reference %>.session.concurrent_limit
+    limit.times { @user.sessions.create! }
+    sign_in_as @user
+    assert_not @user.within_session_limit?
+
+    get <%= identity.settings_helper_prefix %>_sessions_path
+    assert_response :success
+    get <%= identity.settings_helper_prefix %>_path
+    assert_redirected_to <%= identity.settings_helper_prefix %>_sessions_path
+
+    @user.sessions.order(:created_at).first.destroy!
+    assert @user.within_session_limit?
+    get <%= identity.settings_helper_prefix %>_path
+    assert_response :success, "released once back at the cap"
+  end
+<%- end -%>
+
+  private
+
+<%- if password? -%>
+  def sign_in_as(user, remember: false)
+    post <%= identity.route_scope %>_sign_in_path,
+      params: { <%= sign_in_field %>: user.<%= login_field %>, password: "quilted-lantern-moss-97", remember_me: (remember ? "1" : "0") }
+  end
+<%- else -%>
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+<%- end -%>
+<%- if rememberable? && password? -%>
+
+  def session_cookie_header
+    # Rack may return Set-Cookie as one string or an array, so normalize both forms.
+    Array(response.headers["Set-Cookie"])
+      .flat_map { |line| line.to_s.split("\n") }
+      .find { |line| line.start_with?("<%= identity.cookie_name %>=") }.to_s
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/api_tokens_controller_test.rb.tt

@@ -0,0 +1,61 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::ApiTokensControllerTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "shows the secret once and stores only its digest" do
+    sign_in_as @user
+
+    assert_difference "@user.api_tokens.count", 1 do
+      post <%= identity.settings_helper_prefix %>_api_tokens_path,
+        params: { name: "Deployment"<%= sudo_test_params_pair %> }
+    end
+    assert_response :created
+    assert_includes response.headers["Cache-Control"], "no-store"
+    token = @user.api_tokens.last
+    secret = response.body[/ae11_[A-Za-z0-9_-]{43}/]
+    assert secret
+    assert_equal token, <%= identity.api_token_class %>.authenticate(secret)
+    refute_includes token.attributes.values, secret
+
+    get <%= identity.settings_helper_prefix %>_api_tokens_path
+    assert_response :success
+    refute_includes response.body, secret
+    assert_includes response.body, "Deployment"
+  end
+
+  test "an unauthenticated visitor cannot create a token" do
+    assert_no_difference "<%= identity.api_token_class %>.count" do
+      post <%= identity.settings_helper_prefix %>_api_tokens_path, params: { name: "Unexpected" }
+    end
+    assert_response :redirect
+  end
+
+  test "revoking a token invalidates it" do
+    sign_in_as @user
+    token, secret = <%= identity.api_token_class %>.issue!(user: @user, name: "Old")
+
+    assert_difference "@user.api_tokens.count", -1 do
+      delete <%= identity.settings_helper_prefix %>_api_token_path(token)
+    end
+    assert_redirected_to <%= identity.settings_helper_prefix %>_api_tokens_path
+    assert_nil <%= identity.api_token_class %>.authenticate(secret)
+  end
+
+  test "cannot revoke someone else's token" do
+    sign_in_as @user
+    stranger = <%= identity.plural %>(:alice)
+    token, = <%= identity.api_token_class %>.issue!(user: stranger, name: "Other")
+
+    assert_no_difference "<%= identity.api_token_class %>.count" do
+      delete <%= identity.settings_helper_prefix %>_api_token_path(token)
+    end
+    assert_response :not_found
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/authentications/events_controller_test.rb.tt

@@ -0,0 +1,17 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::Authentications::EventsControllerTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "you can see your own authentication events" do
+    sign_in_as @user
+    get <%= identity.settings_helper_prefix %>_authentications_events_path
+    assert_response :success
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/email_verifications_controller_test.rb.tt

@@ -0,0 +1,39 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "a resend goes to the address being verified, not the one on file" do
+    @user.update!(pending_email: "moved@example.com")
+    sign_in_as @user
+
+    assert_emails 1 do
+      post <%= identity.settings_helper_prefix %>_email_verification_path
+    end
+
+    assert_equal [ "moved@example.com" ], ActionMailer::Base.deliveries.last.to
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_email_path
+  end
+
+  test "a resend with nothing outstanding sends nothing" do
+    sign_in_as @user
+
+    assert_no_emails do
+      post <%= identity.settings_helper_prefix %>_email_verification_path
+    end
+
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_email_path
+<%- if coy? -%>
+    assert_equal "We sent you another link.", flash[:notice],
+      "a build with nothing outstanding must answer exactly as one with a link in flight"
+<%- end -%>
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/invitations_controller_test.rb.tt

@@ -0,0 +1,157 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::InvitationsControllerTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+  include ActiveJob::TestHelper
+
+  setup { @user = <%= identity.plural %>(:bob) }
+<%- if teams? -%>
+
+  test "choosing a team attaches the invitation to it" do
+    sign_in_as @user
+    post <%= identity.settings_helper_prefix %>_invitation_path,
+      params: { sent_to: <%= email_invitable? ? %("invitee-#{SecureRandom.hex(4)}@example.com") : %("+1415555#{rand(1000..9999)}") %>, team_id: <%= identity.teams_table %>(:acme).id }
+
+    assert_equal <%= identity.teams_table %>(:acme), <%= identity.invitation_class %>.last.team
+  end
+
+  test "choosing no team invites to the app itself" do
+    sign_in_as @user
+    post <%= identity.settings_helper_prefix %>_invitation_path,
+      params: { sent_to: <%= email_invitable? ? %("invitee-#{SecureRandom.hex(4)}@example.com") : %("+1415555#{rand(1000..9999)}") %>, team_id: "" }
+
+    assert_nil <%= identity.invitation_class %>.last.team
+  end
+
+  test "an existing account can be invited to a team" do
+    sign_in_as @user
+    existing = <%= identity.plural %>(:alice)
+    team = <%= identity.team_class %>.create!(name: "Beta")
+    team.memberships.create!(<%= identity.singular %>: @user)
+
+    post <%= identity.settings_helper_prefix %>_invitation_path,
+      params: { sent_to: existing.<%= email_invitable? ? "email" : "phone" %>, team_id: team.id }
+
+    assert <%= identity.invitation_class %>.exists?(sent_to: existing.<%= email_invitable? ? "email" : "phone" %>, team:)
+  end
+<%- unless coy? -%>
+
+  test "you cannot invite someone already on the team" do
+    sign_in_as @user
+    existing = <%= identity.plural %>(:alice)
+
+    post <%= identity.settings_helper_prefix %>_invitation_path,
+      params: { sent_to: existing.<%= email_invitable? ? "email" : "phone" %>, team_id: <%= identity.teams_table %>(:acme).id }
+
+    assert_response :unprocessable_entity
+    assert_not <%= identity.invitation_class %>.exists?(sent_to: existing.<%= email_invitable? ? "email" : "phone" %>)
+  end
+<%- end -%>
+
+  test "you cannot invite into a team you don't belong to" do
+    sign_in_as @user
+    post <%= identity.settings_helper_prefix %>_invitation_path,
+      params: { sent_to: <%= email_invitable? ? %("invitee-#{SecureRandom.hex(4)}@example.com") : %("+1415555#{rand(1000..9999)}") %>,
+                team_id: <%= identity.team_class %>.create!(name: "Someone Else's").id }
+
+    assert_response :not_found
+  end
+<%- end -%>
+<%- if email_invitable? -%>
+
+  test "sending an email invitation emails the invitee" do
+    sign_in_as @user
+    address = " Invitee-#{SecureRandom.hex(4)}@EXAMPLE.COM "
+<%- if phone_invitable? -%>
+    assert_no_enqueued_jobs only: SmsDeliveryJob do
+<%- end -%>
+      assert_enqueued_emails 1 do
+        post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: address }
+      end
+<%- if phone_invitable? -%>
+    end
+<%- end -%>
+    assert_equal address.strip.downcase, <%= identity.invitation_class %>.last.sent_to
+  end
+<%- end -%>
+<%- if phone_invitable? -%>
+
+  test "sending a phone invitation texts the invitee" do
+    sign_in_as @user
+    suffix = format("%04d", rand(10_000))
+    submitted = "(415) 555-#{suffix}"
+    number = "+1415555#{suffix}"
+
+    invitation_delivery = ->(args) {
+      args.one? && args.first[:to] == number && args.first[:body].include?("invited you")
+    }
+    assert_no_enqueued_emails do
+      assert_enqueued_with(job: SmsDeliveryJob, args: invitation_delivery) do
+        post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: submitted }
+      end
+    end
+  end
+<%- end -%>
+<%- if coy? -%>
+
+  test "the invite form answers identically for a destination on file and one that isn't" do
+    sign_in_as @user
+<%- if phone_invitable? -%>
+
+    stranger = "+1415555#{rand(1000..9999)}"
+    assert_enqueued_with(job: SmsDeliveryJob) do
+      post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: stranger }
+    end
+    stranger_notice = flash[:notice].sub(stranger, "ADDRESS")
+
+    assert_no_enqueued_jobs only: SmsDeliveryJob do
+      post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: @user.phone }
+    end
+    on_file_notice = flash[:notice].sub(@user.phone, "ADDRESS")
+<%- else -%>
+
+    stranger = "invitee-#{SecureRandom.hex(4)}@example.com"
+    assert_enqueued_emails 1 do
+      post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: stranger }
+    end
+    stranger_notice = flash[:notice].sub(stranger, "ADDRESS")
+
+    assert_no_enqueued_emails do
+      post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: @user.email }
+    end
+    on_file_notice = flash[:notice].sub(@user.email, "ADDRESS")
+<%- end -%>
+
+    assert_equal stranger_notice, on_file_notice,
+      "the invite form must not reveal whether a destination already has an account"
+  end
+<%- end -%>
+<%- unless coy? -%>
+
+  test "you cannot invite an address that already has an account" do
+    sign_in_as @user
+    existing = <%= identity.plural %>(:alice)
+
+    post <%= identity.settings_helper_prefix %>_invitation_path, params: { sent_to: existing.<%= email_invitable? ? "email" : "phone" %> }
+
+    assert_response :unprocessable_entity
+    assert_not <%= identity.invitation_class %>.exists?(sent_to: existing.<%= email_invitable? ? "email" : "phone" %>)
+  end
+<%- end -%>
+
+  test "deleting an account deletes the invitations it sent and the one it accepted" do
+    @user.sent_invitations.create!(sent_to: <%= email_invitable? ? %("sent-#{SecureRandom.hex(4)}@example.com") : %("+1415555#{rand(1000..4999)}") %>)
+    accepted = <%= identity.plural %>(:alice).sent_invitations.create!(sent_to: <%= email_invitable? ? %("accepted-#{SecureRandom.hex(4)}@example.com") : %("+1415555#{rand(5000..9999)}") %>)
+    accepted.update_column(:invitee_id, @user.id)
+
+    assert_difference -> { <%= identity.invitation_class %>.count }, -2 do
+      @user.destroy
+    end
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/management_test.rb.tt

@@ -0,0 +1,256 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::ManagementTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "authentication is required unless allowed" do
+    get <%= identity.settings_helper_prefix %>_path
+    assert_response :redirect
+
+    follow_redirect!
+    assert_response :success
+  end
+
+  test "you can sign one of your sessions out" do
+    sign_in_as @user
+    session = @user.sessions.reload.last
+    assert_difference -> { @user.sessions.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_session_path(session)
+    end
+  end
+<%- if password? -%>
+
+  test "you can change your password" do
+    sign_in_as @user
+    patch <%= identity.settings_helper_prefix %>_password_path,
+      params: { password_challenge: "quilted-lantern-moss-97", password: "heron-basalt-drift-41", password_confirmation: "heron-basalt-drift-41" }
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_password_path
+    assert @user.reload.authenticate("heron-basalt-drift-41"), "the new password should verify"
+  end
+<%- end -%>
+
+  test "deleting your account has a page of its own" do
+    sign_in_as @user
+    get <%= identity.settings_helper_prefix %>_user_path
+    assert_response :success
+  end
+<%- if password? && !sudoable? -%>
+
+  test "deleting your account requires the current password" do
+    sign_in_as @user
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      delete <%= identity.settings_helper_prefix %>_user_path,
+        params: { confirmation: "DELETE ACCOUNT", password_challenge: "wrong-password" }
+    end
+  end
+<%- end -%>
+
+  test "deleting your account takes the phrase, typed exactly" do
+    sign_in_as @user
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "delete account"<%= settings_credential_pair %> }
+    end
+    assert_redirected_to <%= identity.settings_helper_prefix %>_user_url
+  end
+
+  test "you can delete your account" do
+    sign_in_as @user
+    assert_difference -> { <%= identity.class_name %>.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_user_path, params: { confirmation: "DELETE ACCOUNT"<%= settings_credential_pair %> }
+    end
+  end
+<%- if email_changeable? -%>
+
+  test "you can change your email" do
+    sign_in_as @user
+    address = "changed-#{SecureRandom.hex(4)}@example.com"
+    patch <%= identity.settings_helper_prefix %>_email_path,
+      params: { email: address<%= settings_credential_pair %> }
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_email_path
+<%- if email_verifiable? -%>
+    assert_not_equal address, @user.reload.email
+    assert_equal address, @user.pending_email
+<%- else -%>
+    assert_equal address, @user.reload.email
+<%- end -%>
+  end
+<%- if email_verifiable? -%>
+
+  test "re-submitting the address already on file stages nothing" do
+    sign_in_as @user
+    assert_no_enqueued_emails do
+      patch <%= identity.settings_helper_prefix %>_email_path,
+        params: { email: <%= identity.plural %>(:bob).email<%= settings_credential_pair %> }
+    end
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_email_path
+    assert_nil @user.reload.pending_email
+  end
+<%- end -%>
+<%- if principals.email.required? || contactable_validation? -%>
+
+  test "a removal this account can't afford is refused in words" do
+    sign_in_as @user
+<%- if contactable_validation? -%>
+    @user.update!(phone: nil)
+<%- end -%>
+    patch <%= identity.settings_helper_prefix %>_email_path, params: { email: ""<%= settings_credential_pair %> }
+    assert_response :unprocessable_entity
+<%- if contactable_validation? -%>
+    assert_includes response.parsed_body.text, "Add <%= channel_keys_article_phrase %>."
+<%- else -%>
+    assert_includes response.parsed_body.text, "Email can't be blank"
+<%- end -%>
+    assert_equal <%= identity.plural %>(:bob).email, @user.reload.email
+  end
+<%- end -%>
+
+<%- if coy? -%>
+  test "an already-registered email is answered exactly like a free one" do
+    sign_in_as @user
+    taken = <%= identity.plural %>(:alice).email
+    free = "free-#{SecureRandom.hex(4)}@example.com"
+
+    patch <%= identity.settings_helper_prefix %>_email_path,
+      params: { email: taken<%= settings_credential_pair %> }
+    taken_status, taken_location = response.status, response.location
+    follow_redirect!
+    taken_body = response.body.gsub(taken, "submitted@example.com")
+
+    patch <%= identity.settings_helper_prefix %>_email_path,
+      params: { email: free<%= settings_credential_pair %> }
+    assert_equal taken_status, response.status
+    assert_equal taken_location, response.location
+    follow_redirect!
+    assert_equal taken_body, response.body.gsub(free, "submitted@example.com"),
+      "a taken address and a free one must leave the same page behind, not just the same redirect"
+  end
+<%- else -%>
+  test "changing to an already-registered email is called out" do
+    sign_in_as @user
+    patch <%= identity.settings_helper_prefix %>_email_path,
+      params: { email: <%= identity.plural %>(:alice).email<%= settings_credential_pair %> }
+    assert_response :unprocessable_entity
+    assert_equal <%= identity.plural %>(:bob).email, @user.reload.email
+  end
+<%- end -%>
+<%- end -%>
+<%- principals.select { |p| p.channel? && p.permanent? }.each do |principal| -%>
+
+  test "there is no way to change a permanent <%= principal.column %>" do
+    sign_in_as @user
+    patch "#{<%= identity.settings_helper_prefix %>_path}/<%= principal.column %>", params: { <%= principal.column %>: "<%= principal.type == :email ? "moved@example.com" : "+14158264010" %>" }
+    assert_response :not_found
+    assert_equal <%= identity.plural %>(:bob).<%= principal.column %>, @user.reload.<%= principal.column %>
+  end
+<%- end -%>
+<%- if phone_changeable? -%>
+
+  test "you can change your phone" do
+    sign_in_as @user
+    patch <%= identity.settings_helper_prefix %>_phone_path,
+      params: { phone: "+1 415 826 4010"<%= settings_credential_pair %> }
+<%- if phone_verifiable? -%>
+    assert_redirected_to new_<%= identity.settings_helper_prefix %>_phone_verification_path
+    assert_equal "+14158264010", @user.reload.pending_phone
+    assert @user.sms_challenge?(to: "+14158264010")
+<%- else -%>
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_phone_path
+    assert_equal "+14158264010", @user.reload.phone
+<%- end -%>
+  end
+<%- if phone_verifiable? -%>
+
+  test "re-submitting the number already on file stages nothing" do
+    sign_in_as @user
+    patch <%= identity.settings_helper_prefix %>_phone_path,
+      params: { phone: <%= identity.plural %>(:bob).phone<%= settings_credential_pair %> }
+    assert_redirected_to edit_<%= identity.settings_helper_prefix %>_phone_path
+    assert_nil @user.reload.pending_phone
+    assert_not @user.sms_challenge?
+  end
+<%- end -%>
+<%- if contactable_validation? -%>
+
+  test "a phone removal this account can't afford is refused in words" do
+    sign_in_as @user
+    @user.update!(email: nil)
+    patch <%= identity.settings_helper_prefix %>_phone_path, params: { phone: ""<%= settings_credential_pair %> }
+    assert_response :unprocessable_entity
+    assert_includes response.parsed_body.text, "Add <%= channel_keys_article_phrase %>."
+    assert_equal <%= identity.plural %>(:bob).phone, @user.reload.phone
+  end
+<%- end -%>
+
+  test "changing to an already-registered phone <%= coy? ? "reveals nothing" : "is called out" %>" do
+    sign_in_as @user
+    patch <%= identity.settings_helper_prefix %>_phone_path,
+      params: { phone: <%= identity.plural %>(:alice).phone<%= settings_credential_pair %> }
+<%- if coy? -%>
+    assert_redirected_to new_<%= identity.settings_helper_prefix %>_phone_verification_path
+    assert_equal <%= identity.plural %>(:alice).phone, @user.reload.pending_phone
+    assert_not @user.sms_challenge?(to: <%= identity.plural %>(:alice).phone)
+<%- else -%>
+    assert_response :unprocessable_entity
+<%- end -%>
+    assert_not_equal <%= identity.plural %>(:alice).phone, @user.reload.phone
+  end
+<%- end -%>
+
+<%- if password_removable? -%>
+<%- if (omniauth? || passkey?) && !magic_link? && !sms_code? -%>
+  test "the last way into the account is not removable" do
+    sign_in_as @user
+    assert_equal [ :password ], @user.sign_in_methods, "fixture should hold only a password"
+
+    assert_no_changes -> { @user.reload.password_digest } do
+      delete <%= identity.settings_helper_prefix %>_password_path
+    end
+    assert_match "only way into your account", flash[:alert].to_s
+  end
+<%- end -%>
+
+  test "a password can be given up once something else can let you in" do
+    <%= password_optional_second_door_setup %>
+    sign_in_as @user
+
+    delete <%= identity.settings_helper_prefix %>_password_path
+
+    assert_nil @user.reload.password_digest
+    assert_not @user.authenticate("quilted-lantern-moss-97"), "a removed password must stop working"
+  end
+
+  test "a password can be set again afterwards, with no current password to pose" do
+    <%= password_optional_second_door_setup %>
+    sign_in_as @user
+    @user.update_columns(password_digest: nil<%= password_rotatable? ? ", password_changed_at: nil" : "" %>)
+<%- if webauthn_credentials? -%>
+    @user.webauthn_credentials.create!(name: "Lost key", external_id: "ext-lost-key", public_key: "pk"<%= factor_attr(:first_factor) %>)
+<%- end -%>
+
+    post <%= identity.settings_helper_prefix %>_password_path,
+      params: { password: "heron-basalt-drift-41", password_confirmation: "heron-basalt-drift-41" }
+
+    assert @user.reload.authenticate("heron-basalt-drift-41"), "the new password should verify"
+  end
+<%- end -%>
+<%- if password_nullable? -%>
+
+  test "a rejected first password is asked for again, not challenged" do
+    sign_in_as @user
+    @user.update_columns(password_digest: nil<%= password_rotatable? ? ", password_changed_at: nil" : "" %>)
+
+    post <%= identity.settings_helper_prefix %>_password_path, params: { password: "short", password_confirmation: "short" }
+
+    assert_response :unprocessable_entity
+    assert_no_match(/Current password/, response.parsed_body.text)
+    assert_nil @user.reload.password_digest
+  end
+<%- end -%>
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end