authnz_eleven 0.1.0

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/multi_factor_authentication/challenge_test.rb.tt

@@ -0,0 +1,143 @@
+require "test_helper"
+
+class <%= identity.module_name %>::MultiFactorAuthentication::ChallengeTest < ActionDispatch::IntegrationTest
+<%- if sms_second_factor? -%>
+  include ActiveJob::TestHelper
+
+<%- end -%>
+  setup do
+    @user = <%= identity.plural %>(:bob)
+    <%= enroll_second_factor_expr("@user") %>
+  end
+<%- if password? -%>
+
+  test "signing in with a second factor enrolled diverts to the challenge" do
+    sign_in_with_password
+    assert_redirected_to <%= enrolled_second_factor_challenge_path %>
+    assert cookies[:<%= identity.cookie_name %>].blank?, "no session until the second factor is cleared"
+  end
+<%- if totp? -%>
+
+  test "a correct TOTP code clears the challenge and signs in" do
+    sign_in_with_password
+    post <%= identity.route_scope %>_mfa_challenge_totp_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a wrong TOTP code does not sign in" do
+    sign_in_with_password
+    post <%= identity.route_scope %>_mfa_challenge_totp_path, params: { code: "000000" }
+    assert_redirected_to new_<%= identity.route_scope %>_mfa_challenge_totp_path
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "the authenticator challenge refuses an account that is not enrolled" do
+    sign_in_with_password
+    @user.update!(totp_enrolled_at: nil)
+
+    post <%= identity.route_scope %>_mfa_challenge_totp_path, params: { code: ROTP::TOTP.new(@user.totp_secret).now }
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?,
+           "every account carries a totp_secret from birth, enrolled or not"
+  end
+<%- end -%>
+
+<%- if sms_second_factor? -%>
+
+  test "the texted code clears the challenge and signs in" do
+    enroll_sms
+    sign_in_with_password
+    get new_<%= identity.route_scope %>_mfa_challenge_sms_path
+
+    patch <%= identity.route_scope %>_mfa_challenge_sms_path, params: { code: issued_code }
+
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a wrong texted code does not sign in" do
+    enroll_sms
+    sign_in_with_password
+    get new_<%= identity.route_scope %>_mfa_challenge_sms_path
+
+    patch <%= identity.route_scope %>_mfa_challenge_sms_path, params: { code: "000000" }
+
+    assert_response :unprocessable_entity
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+
+  test "the challenge refuses a factor the account no longer holds" do
+    enroll_sms
+    sign_in_with_password
+    get new_<%= identity.route_scope %>_mfa_challenge_sms_path
+    code = issued_code
+    @user.update!(sms_enrolled_at: nil)
+
+    patch <%= identity.route_scope %>_mfa_challenge_sms_path, params: { code: code }
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert cookies[:<%= identity.cookie_name %>].blank?,
+           "a handoff says the first factor was met, not which second factor to accept"
+  end
+
+  test "landing on the challenge twice does not text a second code" do
+    enroll_sms
+    sign_in_with_password
+
+    assert_enqueued_jobs 1, only: SmsDeliveryJob do
+      get new_<%= identity.route_scope %>_mfa_challenge_sms_path
+      get new_<%= identity.route_scope %>_mfa_challenge_sms_path
+    end
+  end
+<%- end -%>
+
+  test "a valid recovery code clears the challenge and signs in" do
+    @user.recovery_codes.create!(code: "recovery-code-1")
+    sign_in_with_password
+    post <%= identity.route_scope %>_mfa_challenge_recovery_codes_path, params: { code: "recovery-code-1" }
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+
+  test "a recovery code is single-use" do
+    @user.recovery_codes.create!(code: "recovery-code-1")
+    sign_in_with_password
+    post <%= identity.route_scope %>_mfa_challenge_recovery_codes_path, params: { code: "recovery-code-1" }
+    delete <%= identity.route_scope %>_sign_out_path
+
+    sign_in_with_password
+    post <%= identity.route_scope %>_mfa_challenge_recovery_codes_path, params: { code: "recovery-code-1" }
+    assert cookies[:<%= identity.cookie_name %>].blank?, "a spent code must not sign in again"
+  end
+
+  test "recovery codes are never stored in a readable form" do
+    @user.recovery_codes.create!(code: "recovery-code-1")
+    assert_not_includes @user.recovery_codes.pluck(:code_digest), "recovery-code-1"
+  end
+<%- if bannable? -%>
+
+  test "a suspended account is barred before the challenge is issued" do
+    @user.ban!
+    sign_in_with_password
+
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "Your account has been suspended.", flash[:alert]
+  end
+<%- end -%>
+
+  private
+
+  def sign_in_with_password
+    post <%= identity.route_scope %>_sign_in_path, params: { <%= sign_in_field %>: @user.<%= login_field %>, password: "quilted-lantern-moss-97" }
+  end
+<%- if sms_second_factor? -%>
+
+  def enroll_sms
+    @user.update!(sms_enrolled_at: Time.current)
+  end
+
+  def issued_code
+    enqueued_jobs.reverse.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+  end
+<%- end -%>
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/omniauth/registrations_controller_test.rb.tt

@@ -0,0 +1,138 @@
+require "test_helper"
+
+class <%= identity.module_name %>::Omniauth::RegistrationsControllerTest < ActionDispatch::IntegrationTest
+<%- if omniauth_registration_verifies_phone? -%>
+  include ActiveJob::TestHelper
+
+<%- end -%>
+  setup do
+    OmniAuth.config.test_mode = true
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(
+      provider: "developer", uid: "first-login",
+      info: { email: "provider-user@example.com" }
+    )
+<%- if invite_only? -%>
+    invitation = <%= identity.invitation_class %>.create!(sent_to: "provider-user@example.com"<%= %(, sent_to_channel: "email") if multi_channel_invitable? %>, inviter: <%= identity.plural %>(:alice))
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.generate_token_for(:invitation))
+<%- end -%>
+  end
+
+  teardown do
+    OmniAuth.config.mock_auth[:developer] = nil
+    OmniAuth.config.test_mode = false
+  end
+
+  test "a first-time provider login is sent to the completion form, no account yet" do
+    assert_no_difference [ "<%= identity.class_name %>.count", "<%= identity.omniauth_identity_class %>.count" ] do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to new_<%= identity.route_scope %>_omniauth_registration_path
+  end
+
+<%- if omniauth_registration_verifies_phone? -%>
+  test "the number the form collects is verified before the account exists" do
+    post "<%= omniauth_callback_test_path %>"
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    end
+    assert_redirected_to <%= identity.route_scope %>_verify_phone_path
+
+    code = enqueued_jobs.reverse_each.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+    assert_difference [ "<%= identity.class_name %>.count", "<%= identity.omniauth_identity_class %>.count" ], 1 do
+      patch <%= identity.route_scope %>_verify_phone_path, params: { code: code }
+    end
+
+    user = <%= identity.class_name %>.last
+    assert user.phone.present?
+    assert_equal "developer", user.omniauth_identities.sole.provider
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- else -%>
+  test "completing the form creates the account with the provider's email" do
+    post "<%= omniauth_callback_test_path %>"
+    assert_difference [ "<%= identity.class_name %>.count", "<%= identity.omniauth_identity_class %>.count" ], 1 do
+      post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    end
+    user = <%= identity.class_name %>.last
+    assert_equal "developer", user.omniauth_identities.sole.provider
+<%- if principals.email -%>
+    assert_equal "provider-user@example.com", user.email
+<%- end -%>
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- if principals.email -%>
+
+  test "completing the form with an address that already has an account is refused" do
+    <%= identity.plural %>(:alice).update_column(:email, "provider-user@example.com")
+
+    post "<%= omniauth_callback_test_path %>"
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_nil cookies[:<%= identity.cookie_name %>].presence
+  end
+<%- end -%>
+
+  test "a provider account that finished signing up elsewhere is sent to sign in" do
+    post "<%= omniauth_callback_test_path %>"
+    <%= identity.plural %>(:alice).omniauth_identities.create!(provider: "developer", uid: "first-login")
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+<%- end -%>
+<%- if principals.username -%>
+
+  test "a taken username is refused on the form, and the sign-up waits" do
+    post "<%= omniauth_callback_test_path %>"
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post <%= identity.route_scope %>_omniauth_registration_path,
+        params: <%= omniauth_profile_params_literal %>.merge(username: <%= identity.plural %>(:alice).username)
+    end
+    assert_response :unprocessable_entity
+  end
+<%- end -%>
+
+<%- if principals.email&.required? -%>
+  test "a provider that reports no address is turned away at the callback" do
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(
+      provider: "developer", uid: "addressless", info: {}
+    )
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "That provider didn't share an email address, try signing up another way.", flash[:alert]
+  end
+
+<%- end -%>
+  test "the form without a provider sign-up in progress bounces to sign in" do
+    post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+<%- if channel_less_registration? -%>
+
+  test "a provider that reports no address completes the sign-up outright" do
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(
+      provider: "developer", uid: "addressless", info: {}
+    )
+    post "<%= omniauth_callback_test_path %>"
+
+    assert_difference [ "<%= identity.class_name %>.count", "<%= identity.omniauth_identity_class %>.count" ], 1 do
+      post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    end
+
+    user = <%= identity.class_name %>.last
+    assert_nil user.email
+    assert_equal "developer", user.omniauth_identities.sole.provider
+    assert_equal [ :omniauth ], user.sign_in_methods
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- end -%>
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/omniauth_controller_test.rb.tt

@@ -0,0 +1,97 @@
+require "test_helper"
+
+class <%= identity.module_name %>::OmniauthControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    OmniAuth.config.test_mode = true
+    mock_provider(uid: "returning-user", email: "bob@example.com")
+    @user = <%= identity.plural %>(:bob)
+    @user.omniauth_identities.create!(provider: "developer", uid: "returning-user")
+  end
+
+  teardown do
+    OmniAuth.config.mock_auth[:developer] = nil
+    OmniAuth.config.test_mode = false
+  end
+
+  test "a returning provider account signs in" do
+    post "<%= omniauth_callback_test_path %>"
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- if invite_only? && phone_invitable? -%>
+
+  test "a provider email cannot accept a phone invitation" do
+    invitation = <%= identity.invitation_class %>.create!(sent_to: "+14155552671", inviter: @user)
+    get <%= identity.namespaced? ? "#{identity.route_scope}_accept_invitation_path" : "accept_invitation_path" %>(token: invitation.generate_token_for(:invitation))
+    mock_provider(uid: "phone-invite", email: "phone-invite@example.com")
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    refute_predicate invitation.reload, :accepted?
+  end
+<%- end -%>
+<%- if !omniauth_registration? && !invite_only? -%>
+
+  test "a provider account nobody has seen registers" do
+    mock_provider(uid: "brand-new", email: "brand-new@example.com")
+
+    assert_difference [ "<%= identity.class_name %>.count", "<%= identity.omniauth_identity_class %>.count" ], 1 do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert cookies[:<%= identity.cookie_name %>].present?
+  end
+<%- if principals.email&.required? -%>
+
+  test "a provider that reports no address is told so, not told the address is taken" do
+    mock_provider(uid: "no-address", email: nil)
+
+    assert_no_difference "<%= identity.class_name %>.count" do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_equal "That provider didn't share an email address, try signing up another way.", flash[:alert]
+  end
+<%- end -%>
+<%- end -%>
+
+  test "a signed-in <%= identity.singular %> links a new provider account instead of signing in" do
+    sign_in_as @user
+    mock_provider(uid: "a-second-login", email: "whatever@example.com")
+
+    assert_difference "@user.omniauth_identities.count", 1 do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to <%= identity.settings_helper_prefix %>_omniauth_identities_path
+  end
+
+  test "linking a provider account owned by someone else is refused, not moved" do
+    owner = <%= identity.plural %>(:alice)
+    owner.omniauth_identities.create!(provider: "developer", uid: "someone-elses-login")
+    mock_provider(uid: "someone-elses-login", email: "whatever@example.com")
+    sign_in_as @user
+
+    assert_no_difference [ "@user.omniauth_identities.count", "owner.omniauth_identities.count" ] do
+      post "<%= omniauth_callback_test_path %>"
+    end
+    assert_redirected_to <%= identity.settings_helper_prefix %>_omniauth_identities_path
+    assert_equal owner.id, <%= identity.omniauth_identity_class %>.find_by!(provider: "developer", uid: "someone-elses-login").<%= identity.foreign_key %>
+  end
+
+  test "the failure endpoint returns to sign in" do
+    get "<%= omniauth_failure_test_path %>", params: { message: "invalid_credentials" }
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+
+  private
+
+  def mock_provider(uid:, email:)
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(
+      provider: "developer", uid: uid, info: { email: email }
+    )
+  end
+
+  def sign_in_as(user)
+<%= test_sign_in_body %>
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/password_resets_controller_test.rb.tt

@@ -0,0 +1,58 @@
+require "test_helper"
+
+class <%= identity.module_name %>::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
+  include ActionMailer::TestHelper
+
+  setup { @user = <%= identity.plural %>(:alice) }
+
+  test "requesting a reset for a known account emails a link" do
+    assert_enqueued_emails 1 do
+      post <%= identity.route_scope %>_reset_password_path, params: { email: @user.email }
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+
+<%- if coy? -%>
+  test "requesting a reset for an unknown email gives nothing away" do
+    assert_no_enqueued_emails do
+      post <%= identity.route_scope %>_reset_password_path, params: { email: "nobody-#{SecureRandom.hex(4)}@example.com" }
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+  end
+<%- else -%>
+  test "requesting a reset for an unknown email is told no account exists" do
+    assert_no_enqueued_emails do
+      post <%= identity.route_scope %>_reset_password_path, params: { email: "nobody-#{SecureRandom.hex(4)}@example.com" }
+    end
+    assert_redirected_to <%= identity.route_scope %>_forgot_password_path
+  end
+<%- end -%>
+
+  test "a valid reset token opens the change-password form" do
+    token = @user.generate_token_for(:password_reset)
+    get <%= identity.route_scope %>_reset_password_path(sid: token)
+    assert_response :success
+  end
+
+  test "a valid reset token changes the password" do
+    token = @user.generate_token_for(:password_reset)
+    patch <%= identity.route_scope %>_reset_password_path(sid: token),
+      params: { password: "heron-basalt-drift-41", password_confirmation: "heron-basalt-drift-41" }
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert @user.reload.authenticate("heron-basalt-drift-41"), "the new password should verify"
+  end
+
+  test "a reset link is dead once it has been used" do
+    token = @user.generate_token_for(:password_reset)
+    patch <%= identity.route_scope %>_reset_password_path(sid: token),
+      params: { password: "heron-basalt-drift-41", password_confirmation: "heron-basalt-drift-41" }
+
+    get <%= identity.route_scope %>_reset_password_path(sid: token)
+    assert_redirected_to <%= identity.route_scope %>_forgot_password_path
+  end
+
+  test "an invalid or expired reset link is refused" do
+    get <%= identity.route_scope %>_reset_password_path(sid: "not-a-real-token")
+    assert_redirected_to <%= identity.route_scope %>_forgot_password_path
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/registrations/email_verifications_controller_test.rb.tt

@@ -0,0 +1,102 @@
+require "test_helper"
+<%- confirming_completes = sign_up_fixture_can_sign_in? &&(invite_only? || !phone_gated_registration?) -%>
+
+class <%= identity.module_name %>::Registrations::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
+  test "opening the link is inert" do
+    registration, token = begin_registration
+
+    assert_no_changes -> { registration.reload.email_verified_at } do
+      get <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+
+    assert_response :success
+    assert <%= identity.pending_registration_class %>.exists?(registration.id)
+  end
+
+  test "only the browser that started the registration can confirm it" do
+    registration, token = begin_registration
+    other_browser = open_session
+
+    assert_no_changes -> { registration.reload.email_verified_at } do
+      other_browser.patch <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+    assert_equal <%= identity.route_scope %>_sign_up_url, other_browser.response.location
+  end
+
+  test "a sign-up left untouched past its lifetime cannot be confirmed" do
+    registration, token = begin_registration
+    registration.update_column(:updated_at, <%= identity.config_reference %>.tokens.pending_registration.ago - 1.minute)
+
+    assert_no_changes -> { registration.reload.email_verified_at } do
+      patch <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+    assert_redirected_to <%= registration_entry_path %>
+  end
+
+  test "confirmation timestamps the verified address before completing or enrolling" do
+    registration, token = begin_registration
+
+<%- if confirming_completes -%>
+    assert_difference -> { <%= identity.class_name %>.count }, 1 do
+      patch <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+    assert_not <%= identity.pending_registration_class %>.exists?(registration.id)
+    assert cookies[:<%= identity.cookie_name %>].present?
+<%- else -%>
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      patch <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+    assert registration.reload.email_verified_at?
+    assert <%= identity.pending_registration_class %>.exists?(registration.id)
+<%- end -%>
+  end
+<%- if confirming_completes -%>
+
+  test "an address taken since sign-up is sent to sign in, not into that account" do
+    registration, token = begin_registration
+    <%= identity.plural %>(:alice).update_column(:email, registration.email)
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      patch <%= identity.route_scope %>_verify_email_path(sid: token)
+    end
+    assert_redirected_to <%= identity.route_scope %>_sign_in_path
+    assert_not <%= identity.pending_registration_class %>.exists?(registration.id)
+    assert cookies[:<%= identity.cookie_name %>].blank?
+  end
+<%- end -%>
+<%- if principals.username -%>
+
+  test "a username taken before confirming can be replaced on the confirmation page" do
+    registration, token = begin_registration
+    <%= identity.plural %>(:alice).update_column(:username, registration.username)
+
+    patch <%= identity.route_scope %>_verify_email_path(sid: token), params: { username: registration.username }
+    assert_response :unprocessable_entity
+    assert_not registration.reload.email_verified_at?
+
+    replacement = "#{registration.username}_2"
+    patch <%= identity.route_scope %>_verify_email_path(sid: token), params: { username: replacement }
+<%- if confirming_completes -%>
+    assert <%= identity.class_name %>.exists?(username: replacement)
+<%- else -%>
+    assert_equal replacement, registration.reload.username
+    assert registration.email_verified_at?
+<%- end -%>
+  end
+<%- end -%>
+
+  private
+
+  def begin_registration
+    attributes = <%= sign_up_fixture_literal(indent: 4) %>
+<%- if password_form_optional? -%>
+    attributes.merge!(password: "", password_confirmation: "")
+<%- end -%>
+<%- if invite_only? -%>
+    <%= accept_test_invitation(%("+14158264077")) %>
+<%- end -%>
+    post <%= identity.route_scope %>_sign_up_path, params: attributes
+    registration = <%= identity.pending_registration_class %>.last
+    [ registration, registration.generate_token_for(:registration_email_verification) ]
+  end
+end

data/lib/generators/authnz_eleven/templates/test_unit/controllers/users/registrations/phone_verifications_controller_test.rb.tt

@@ -0,0 +1,69 @@
+require "test_helper"
+
+class <%= identity.module_name %>::Registrations::PhoneVerificationsControllerTest < ActionDispatch::IntegrationTest
+  include ActiveJob::TestHelper
+<%- unless typed_phone_gated_registration? -%>
+
+  teardown do
+    OmniAuth.config.mock_auth[:developer] = nil
+    OmniAuth.config.test_mode = false
+  end
+<%- end -%>
+
+  test "the code verifies its exact pending number" do
+    registration, code = begin_phone_verification
+
+<%- if !typed_phone_gated_registration? || sign_up_fixture_can_sign_in? -%>
+    assert_difference -> { <%= identity.class_name %>.count }, 1 do
+      patch <%= identity.route_scope %>_verify_phone_path, params: { code: code }
+    end
+    assert_not <%= identity.pending_registration_class %>.exists?(registration.id)
+<%- else -%>
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      patch <%= identity.route_scope %>_verify_phone_path, params: { code: code }
+    end
+    assert registration.reload.phone_verified_at?
+<%- end -%>
+  end
+
+  test "a wrong code creates no account" do
+    begin_phone_verification
+
+    assert_no_difference -> { <%= identity.class_name %>.count } do
+      patch <%= identity.route_scope %>_verify_phone_path, params: { code: "000000" }
+    end
+    assert_response :unprocessable_entity
+  end
+
+  private
+
+  def begin_phone_verification
+    clear_enqueued_jobs
+<%- if typed_phone_gated_registration? -%>
+<%- if invite_only? -%>
+    <%= accept_test_invitation(%("invitee@example.com")) %>
+<%- end -%>
+    post <%= identity.route_scope %>_sign_up_path, params: <%= sign_up_fixture_literal(indent: 4) %>
+    registration = <%= identity.pending_registration_class %>.last
+<%- if email_verifiable? -%>
+    registration.update!(email_verified_at: Time.current)
+<%- end -%>
+    registration.request_phone_verification
+<%- else -%>
+    OmniAuth.config.test_mode = true
+    OmniAuth.config.mock_auth[:developer] = OmniAuth::AuthHash.new(
+      provider: "developer", uid: "phone-verification", info: { email: "provider-user@example.com" }
+    )
+<%- if invite_only? -%>
+    <%= accept_test_invitation(%("provider-user@example.com")) %>
+<%- end -%>
+    post "<%= omniauth_callback_test_path %>"
+    post <%= identity.route_scope %>_omniauth_registration_path, params: <%= omniauth_profile_params_literal %>
+    registration = <%= identity.pending_registration_class %>.last
+<%- end -%>
+    code = enqueued_jobs.reverse_each.filter_map { |job| job.to_s[/(\d{6}) is your/, 1] }.first
+    raise "verification code was not enqueued" unless code
+
+    [ registration, code ]
+  end
+end