authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/multi_factor_authentication/management_test.rb.tt

@@ -0,0 +1,222 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::MultiFactorAuthentication::ManagementTest < ActionDispatch::IntegrationTest
+<%- if sms_second_factor? -%>
+  include ActiveJob::TestHelper
+
+<%- end -%>
+  setup { @user = <%= identity.plural %>(:bob) }
+<%- if sms_second_factor? -%>
+
+  test "enrolling by text turns MFA on only for a correct code" do
+    sign_in_as @user
+    get new_<%= identity.settings_helper_prefix %>_mfa_sms_path
+    assert_response :success
+
+    post <%= identity.settings_helper_prefix %>_mfa_sms_path
+
+    patch <%= identity.settings_helper_prefix %>_mfa_sms_path, params: { code: "000000" }
+    assert_not @user.reload.sms_enrolled_at?, "a wrong code must not enable MFA"
+
+    patch <%= identity.settings_helper_prefix %>_mfa_sms_path, params: { code: issued_code }
+    assert @user.reload.sms_enrolled_at?
+
+    assert_response :success
+    assert_equal <%= identity.config_reference %>.second_factor.recovery_code_count,
+                 response.body.scan(%r{<code>([a-z0-9]+)</code>}).flatten.length
+  end
+
+  test "turning the texted factor off clears the flag and the recovery codes with it" do
+    sign_in_as @user
+    enable_sms
+    assert @user.recovery_codes.any?
+
+    delete <%= identity.settings_helper_prefix %>_mfa_sms_path
+    assert_not @user.reload.sms_enrolled_at?
+    assert_empty @user.recovery_codes.reload,
+                 "codes guarding nothing are live sign-in secrets"
+  end
+<%- end -%>
+<%- if totp? -%>
+
+  test "enrolling turns MFA on only for a correct code" do
+    sign_in_as @user
+    get new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_response :success
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: "000000" }
+    assert_not @user.reload.totp_enrolled_at?, "a wrong code must not enable MFA"
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+    assert @user.reload.totp_enrolled_at?
+
+    assert_response :success
+    assert_equal <%= identity.config_reference %>.second_factor.recovery_code_count,
+                 response.body.scan(%r{<code>([a-z0-9]+)</code>}).flatten.length
+  end
+<%- if both_second_factors? && admin_mfa_gate? && password_rotatable? -%>
+
+  test "TOTP enrollment removes the obsolete instruction before rendering recovery codes" do
+    @user = <%= identity.plural %>(:alice)
+    @user.update_column(:password_changed_at, (<%= identity.config_reference %>.password.maximum_age + 1.day).ago)
+    sign_in_as @user
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path,
+      params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+
+    assert_response :success
+    assert_select "h1", "Save your recovery codes"
+    assert_nil flash[:alert]
+  end
+<%- end -%>
+<%- if both_second_factors? -%>
+
+  test "enrolling an authenticator leaves recovery codes that already exist alone" do
+    sign_in_as @user
+    @user.webauthn_credentials.create!(name: "Key", external_id: "ext-1", public_key: "pk"<%= factor_attr(:second_factor) %>)
+    before = <%= identity.recovery_code_class %>.regenerate_for(@user)
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+
+    assert @user.reload.totp_enrolled_at?
+    assert before.all? { |code| <%= identity.recovery_code_class %>.redeem(user: @user, code:) },
+           "a set the user is holding must survive enrolling another factor"
+  end
+<%- end -%>
+<%- end -%>
+
+  test "regenerating replaces your recovery codes" do
+    sign_in_as @user
+    post <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    before = @user.recovery_codes.pluck(:code_digest).sort
+    assert_not_empty before
+
+    post <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_not_equal before, @user.recovery_codes.reload.pluck(:code_digest).sort
+  end
+
+  test "the codes are shown once, are real, and are never shown again" do
+    sign_in_as @user
+    post <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_response :success
+
+    codes = response.body.scan(%r{<code>([a-z0-9]+)</code>}).flatten
+    assert_equal <%= identity.config_reference %>.second_factor.recovery_code_count, codes.length
+
+    get <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_response :success
+    assert_no_match codes.first, response.body, "a later visit must not show them again"
+    assert_equal codes.length, @user.recovery_codes.count, "looking must not mint a new set"
+
+    assert <%= identity.recovery_code_class %>.redeem(user: @user, code: codes.first)
+  end
+
+  test "the forms that mint recovery codes opt out of Turbo" do
+    sign_in_as @user
+<%- if totp? -%>
+
+    get new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_match 'data-turbo="false"', response.body
+<%- end -%>
+<%- if sms_second_factor? -%>
+
+    get new_<%= identity.settings_helper_prefix %>_mfa_sms_path
+    assert_match 'data-turbo="false"', response.body
+<%- end -%>
+
+<%- if security_keys? -%>
+<%- if sudoable? -%>
+<%= test_clear_sudo_body %>
+<%- end -%>
+    get new_<%= identity.settings_helper_prefix %>_mfa_security_key_path
+    assert_match 'data-turbo="false"', response.body
+
+<%- end -%>
+    get <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_match 'data-turbo="false"', response.body
+  end
+
+  test "every URL the codes render at answers GET" do
+    sign_in_as @user
+<%- if totp? -%>
+
+    get <%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_response :redirect, "reloading the enrollment result must not 404"
+<%- end -%>
+<%- if sms_second_factor? -%>
+
+    get <%= identity.settings_helper_prefix %>_mfa_sms_path
+    assert_response :redirect, "reloading the enrollment result must not 404"
+<%- end -%>
+
+<%- if security_keys? -%>
+    get <%= identity.settings_helper_prefix %>_mfa_security_keys_path
+    assert_response :success, "reloading the security-key enrollment result must not 404"
+
+<%- end -%>
+    get <%= identity.settings_helper_prefix %>_mfa_recovery_codes_path
+    assert_response :success, "reloading the regenerate result must not 404"
+  end
+<%- if totp? -%>
+
+  test "a code submitted while enrolled checks the app and changes nothing" do
+    sign_in_as @user
+    enable_mfa
+    before = @user.recovery_codes.pluck(:code_digest).sort
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+    assert_redirected_to new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_equal "That code is correct.", flash[:notice]
+    assert_equal before, @user.recovery_codes.reload.pluck(:code_digest).sort
+    assert @user.reload.totp_enrolled_at?
+  end
+
+  test "a wrong code while enrolled says so, and still changes nothing" do
+    sign_in_as @user
+    enable_mfa
+    before = @user.recovery_codes.pluck(:code_digest).sort
+
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: "000000" }
+    assert_redirected_to new_<%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_match "didn't match", flash[:alert]
+    assert_equal before, @user.recovery_codes.reload.pluck(:code_digest).sort
+    assert @user.reload.totp_enrolled_at?, "a failed check must not turn MFA off"
+  end
+
+  test "turning MFA off clears the flag and the recovery codes with it" do
+    sign_in_as @user
+    enable_mfa
+    assert @user.recovery_codes.any?
+
+    delete <%= identity.settings_helper_prefix %>_mfa_authenticator_path
+    assert_not @user.reload.totp_enrolled_at?
+    assert_empty @user.recovery_codes.reload,
+                 "codes guarding nothing are live sign-in secrets"
+  end
+<%- end -%>
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+<%- if totp? -%>
+
+  def enable_mfa
+    post <%= identity.settings_helper_prefix %>_mfa_authenticator_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+    @user.reload
+  end
+<%- end -%>
+<%- if sms_second_factor? -%>
+
+  def enable_sms
+    post <%= identity.settings_helper_prefix %>_mfa_sms_path
+    patch <%= identity.settings_helper_prefix %>_mfa_sms_path, params: { code: issued_code }
+    @user.reload
+  end
+
+  def issued_code
+    enqueued_jobs.reverse.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/omniauth_identities_controller_test.rb.tt

@@ -0,0 +1,57 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::OmniauthIdentitiesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @identity = @user.omniauth_identities.create!(provider: "developer", uid: "bobs-login")
+    @other = <%= identity.plural %>(:alice).omniauth_identities.create!(provider: "developer", uid: "someone-elses-login")
+  end
+
+  test "the page lists your connected accounts and nobody else's" do
+    sign_in_as @user
+    get <%= identity.settings_helper_prefix %>_omniauth_identities_path
+
+    assert_response :success
+    assert_match "Developer", response.body
+  end
+
+  test "a connected account may only be unlinked when another way in survives" do
+    sign_in_as @user
+
+    if @user.last_sign_in_method?(:omniauth)
+      assert_no_difference -> { @user.omniauth_identities.count } do
+        delete <%= identity.settings_helper_prefix %>_omniauth_identity_path(@identity)
+      end
+      assert_match "only way into your account", flash[:alert].to_s
+    else
+      assert_difference -> { @user.omniauth_identities.count }, -1 do
+        delete <%= identity.settings_helper_prefix %>_omniauth_identity_path(@identity)
+      end
+    end
+    assert_redirected_to <%= identity.settings_helper_prefix %>_omniauth_identities_path
+  end
+
+  test "a connected account can be unlinked once another one exists" do
+    spare = @user.omniauth_identities.create!(provider: "developer", uid: "a-spare-login")
+    sign_in_as @user
+
+    assert_difference -> { @user.omniauth_identities.count }, -1 do
+      delete <%= identity.settings_helper_prefix %>_omniauth_identity_path(spare)
+    end
+  end
+
+  test "you cannot unlink somebody else's connected account" do
+    sign_in_as @user
+
+    assert_no_difference -> { <%= identity.omniauth_identity_class %>.count } do
+      delete <%= identity.settings_helper_prefix %>_omniauth_identity_path(@other)
+    end
+    assert_response :not_found
+  end
+
+  private
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/settings/phone_verifications_controller_test.rb.tt

@@ -0,0 +1,146 @@
+require "test_helper"
+
+class <%= identity.settings_module %>::PhoneVerificationsControllerTest < ActionDispatch::IntegrationTest
+  include ActiveJob::TestHelper
+
+  NEW_NUMBER = "+14158264010".freeze
+
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @original = @user.phone
+    sign_in_as @user
+  end
+
+  test "requesting a change texts the new number but does not adopt it yet" do
+    request_change_to NEW_NUMBER
+
+    assert_equal @original, @user.reload.phone, "the number must not move until it's verified"
+    assert_equal NEW_NUMBER, @user.pending_phone
+    assert @user.sms_challenge?(to: NEW_NUMBER)
+    assert_redirected_to new_<%= identity.settings_helper_prefix %>_phone_verification_path
+  end
+
+  test "confirming the code adopts the new number" do
+    request_change_to NEW_NUMBER
+
+    patch <%= identity.settings_helper_prefix %>_phone_verification_path, params: { code: issued_code }
+
+    assert_equal NEW_NUMBER, @user.reload.phone
+    assert_nil @user.pending_phone
+    assert_not @user.sms_challenge?(to: NEW_NUMBER), "a redeemed code must not survive"
+    assert_redirected_to <%= identity.settings_helper_prefix %>_path
+  end
+
+  test "a wrong code leaves the old number in place" do
+    request_change_to NEW_NUMBER
+
+    patch <%= identity.settings_helper_prefix %>_phone_verification_path, params: { code: "000000" }
+
+    assert_equal @original, @user.reload.phone
+    assert_equal NEW_NUMBER, @user.pending_phone
+    assert_response :unprocessable_entity
+  end
+
+  test "a re-send goes to the pending number, not the one on file" do
+    request_change_to NEW_NUMBER
+    post <%= identity.settings_helper_prefix %>_phone_verification_path
+
+    assert_equal NEW_NUMBER, texted_numbers.last
+  end
+
+<%- if coy? -%>
+  test "requesting a number that belongs to someone else is answered identically and texts no one" do
+    taken = <%= identity.plural %>(:alice).phone
+
+    assert_no_enqueued_jobs(only: SmsDeliveryJob) do
+      request_change_to taken
+    end
+    assert_equal @original, @user.reload.phone
+    assert_equal taken, @user.pending_phone
+    taken_status, taken_location = response.status, response.location
+    follow_redirect!
+    taken_body = response.body.gsub(taken, "SUBMITTED")
+
+    request_change_to NEW_NUMBER
+    assert_equal taken_status, response.status
+    assert_equal taken_location, response.location
+    follow_redirect!
+    assert_equal taken_body, response.body.gsub(NEW_NUMBER, "SUBMITTED"),
+      "a taken number and a free one must leave the same page behind, not just the same redirect"
+
+    get <%= identity.settings_helper_prefix %>_path
+    assert_select "a[href=?]", new_<%= identity.settings_helper_prefix %>_phone_verification_path
+  end
+
+  test "a re-send after a rejected number texts nobody" do
+    request_change_to <%= identity.plural %>(:alice).phone
+
+    assert_no_enqueued_jobs(only: SmsDeliveryJob) do
+      post <%= identity.settings_helper_prefix %>_phone_verification_path
+    end
+  end
+<%- else -%>
+  test "requesting a number that belongs to someone else is refused" do
+    assert_no_enqueued_jobs(only: SmsDeliveryJob) do
+      request_change_to <%= identity.plural %>(:alice).phone
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal @original, @user.reload.phone
+  end
+<%- end -%>
+
+  test "too many wrong guesses destroy the code" do
+    request_change_to NEW_NUMBER
+    code = issued_code
+
+    (<%= identity.config_reference %>.sms.max_attempts + 1).times do
+      patch <%= identity.settings_helper_prefix %>_phone_verification_path, params: { code: "000000" }
+    end
+    patch <%= identity.settings_helper_prefix %>_phone_verification_path, params: { code: code }
+
+    assert_equal @original, @user.reload.phone, "the real code must stop working once the cap is hit"
+    assert_equal NEW_NUMBER, @user.pending_phone
+  end
+
+  test "an expired code is refused" do
+    request_change_to NEW_NUMBER
+    code = issued_code
+    travel <%= identity.config_reference %>.tokens.sms_code + 1.minute
+
+    patch <%= identity.settings_helper_prefix %>_phone_verification_path, params: { code: code }
+
+    assert_equal @original, @user.reload.phone
+    assert_equal NEW_NUMBER, @user.pending_phone
+  end
+<%- if principals.phone.optional? -%>
+
+  test "clearing your number takes effect immediately" do
+    patch <%= identity.settings_helper_prefix %>_phone_path, params: {
+      phone: ""<%= settings_credential_pair %>
+    }
+
+    assert_nil @user.reload.phone
+  end
+<%- end -%>
+
+  private
+
+  def request_change_to(number)
+    patch <%= identity.settings_helper_prefix %>_phone_path, params: {
+      phone: number<%= settings_credential_pair %>
+    }
+  end
+
+  def issued_code
+    enqueued_jobs.reverse.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+  end
+
+  def texted_numbers
+    enqueued_jobs.filter_map { |job| job.to_s[/\+\d{6,}/] }
+  end
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/teams_controller_test.rb.tt

@@ -0,0 +1,83 @@
+require "test_helper"
+
+class <%= identity.nested_module("TeamsControllerTest") %> < ActionDispatch::IntegrationTest
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    @team = <%= identity.teams_table %>(:acme)
+  end
+
+<%- if team_gated_page -%>
+  test "a teamless <%= identity.singular %> is held on the team list" do
+    leave_every_team
+    sign_in_as @user
+    get <%= team_gated_page %>
+    assert_redirected_to <%= identity.nested_helper("teams_path") %>
+  end
+
+<%- end -%>
+  test "the team list is reachable while held" do
+    leave_every_team
+    sign_in_as @user
+    get <%= identity.nested_helper("teams_path") %>
+    assert_response :success
+  end
+
+  test "creating a team lifts the hold" do
+    leave_every_team
+    sign_in_as @user
+    post <%= identity.nested_helper("teams_path") %>, params: { <%= identity.teams_table.singularize %>: { name: "Initech" } }
+    assert_response :redirect
+    assert @user.reload.on_a_team?
+  end
+<%- if scope_teams? -%>
+
+  test "a team's pages carry its id" do
+    sign_in_as @user
+    get <%= team_root_helper %>(team_id: @team)
+    assert_response :success
+    assert_match @team.name, response.body
+  end
+
+  test "a team you don't belong to is a 404" do
+    other = <%= identity.team_class %>.create!(name: "Someone Else's")
+    sign_in_as @user
+    get <%= team_root_helper %>(team_id: other)
+    assert_response :not_found
+  end
+<%- end -%>
+<%- if session_carries_team? -%>
+
+  test "you can switch to a team you belong to" do
+    sign_in_as @user
+    post <%= identity.nested_helper("active_team_path") %>, params: { team_id: @team.id }
+    assert_response :redirect
+  end
+
+  test "losing a membership clears that team from your sessions" do
+    sign_in_as @user
+    post <%= identity.nested_helper("active_team_path") %>, params: { team_id: @team.id }
+    assert_equal @team, @user.sessions.sole.reload.team
+
+    @user.memberships.find_by(team: @team).destroy!
+
+    assert_nil @user.sessions.sole.reload.team
+  end
+
+  test "you cannot switch to a team you don't belong to" do
+    other = <%= identity.team_class %>.create!(name: "Someone Else's")
+    sign_in_as @user
+    post <%= identity.nested_helper("active_team_path") %>, params: { team_id: other.id }
+    assert_response :not_found
+  end
+<%- end -%>
+
+  private
+
+  def leave_every_team
+    @user.memberships.destroy_all
+  end
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/email_verifications_controller_test.rb.tt

@@ -0,0 +1,74 @@
+require "test_helper"
+
+class <%= identity.module_name %>::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
+  setup { @user = <%= identity.plural %>(:bob) }
+
+  test "opening the link changes nothing until it is confirmed" do
+    original = @user.email
+    @user.update!(pending_email: "moved@example.com")
+    token = @user.generate_token_for(:email_change_verification)
+
+    get <%= identity.route_scope %>_verify_email_change_path(sid: token)
+
+    assert_response :success
+    assert_equal original, @user.reload.email
+    assert_equal "moved@example.com", @user.pending_email
+  end
+
+  test "confirming a change adopts the new address without signing anyone in" do
+    @user.update!(pending_email: "moved@example.com")
+    token = @user.generate_token_for(:email_change_verification)
+
+    patch <%= identity.route_scope %>_verify_email_change_path(sid: token)
+
+    assert_equal "moved@example.com", @user.reload.email
+    assert_nil @user.pending_email
+    assert_not cookies[:<%= identity.cookie_name %>].present?, "proving an address is not a reason to hand out a session"
+  end
+
+  test "a link is good for exactly one use" do
+    @user.update!(pending_email: "moved@example.com")
+    token = @user.generate_token_for(:email_change_verification)
+
+    patch <%= identity.route_scope %>_verify_email_change_path(sid: token)
+    patch <%= identity.route_scope %>_verify_email_change_path(sid: token)
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "That confirmation link is invalid or has expired.", flash[:alert]
+  end
+
+  test "replacing the pending address invalidates its old link" do
+    original = @user.email
+    @user.update!(pending_email: "first@example.com")
+    token = @user.generate_token_for(:email_change_verification)
+    @user.update!(pending_email: "second@example.com")
+
+    patch <%= identity.route_scope %>_verify_email_change_path(sid: token)
+
+    assert_equal original, @user.reload.email
+    assert_equal "second@example.com", @user.pending_email
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+
+  test "an invalid or expired link is refused" do
+    patch <%= identity.route_scope %>_verify_email_change_path(sid: "not-a-real-token")
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "That confirmation link is invalid or has expired.", flash[:alert]
+  end
+<%- if email_gated_registration? -%>
+
+  test "a sign-up link is refused at the email-change endpoint" do
+    registration = <%= identity.pending_registration_class %>.new(email: "fresh@example.com"<%= staged_registration_invitation(%("fresh@example.com")) %>)
+    registration.save!(validate: false)
+    token = registration.generate_token_for(:registration_email_verification)
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      patch <%= identity.route_scope %>_verify_email_change_path(sid: token)
+    end
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "That confirmation link is invalid or has expired.", flash[:alert]
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/magic_link_controller_test.rb.tt

@@ -0,0 +1,90 @@
+require "test_helper"
+
+class <%= identity.module_name %>::MagicLinkControllerTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @user = <%= identity.plural %>(:alice) }
+
+  test "requesting a link for a known account emails one" do
+    assert_enqueued_emails 1 do
+      post <%= identity.route_scope %>_magic_link_path, params: { email: @user.email }
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+
+<%- if coy? -%>
+  test "requesting a link for an unknown email gives nothing away" do
+    assert_no_enqueued_emails do
+      post <%= identity.route_scope %>_magic_link_path, params: { email: "nobody-#{SecureRandom.hex(4)}@example.com" }
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+<%- else -%>
+  test "requesting a link for an unknown email is told no account exists" do
+    assert_no_enqueued_emails do
+      post <%= identity.route_scope %>_magic_link_path, params: { email: "nobody-#{SecureRandom.hex(4)}@example.com" }
+    end
+    assert_redirected_to <%= identity.route_scope %>_new_magic_link_path
+  end
+<%- end -%>
+
+  test "opening a magic link signs nobody in, and the button signs in" do
+    token = @user.generate_magic_link
+
+    # GET must not consume the link or create a session because mail scanners follow links.
+    get <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert_response :success
+    assert cookies[:<%= identity.cookie_name %>].blank?
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a used magic link cannot create another session" do
+    token = @user.generate_magic_link
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: token)
+    delete <%= identity.route_scope %>_sign_out_path
+    patch <%= identity.route_scope %>_magic_link_path(sid: token)
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "requesting a new link invalidates the old one" do
+    first = @user.generate_magic_link
+    second = @user.generate_magic_link
+    refute_equal first, second
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: first)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: second)
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a missing cache entry rejects an otherwise valid link" do
+    token = @user.generate_magic_link
+    Rails.cache.delete(@user.magic_link_nonce_key)
+
+    get <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "an expired magic link is refused by both halves and signs nobody in" do
+    token = @user.generate_magic_link
+    travel <%= identity.config_reference %>.tokens.magic_link + 1.minute
+
+    get <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+
+    patch <%= identity.route_scope %>_magic_link_path(sid: token)
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+end