practical 0.1.0

data/app/lib/practical/test/shared/auth/passkeys/controllers/registrations/self_destroy.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Practical::Test::Shared::Auth::Passkeys::Controllers::Registrations::SelfDestroy
+  extend ActiveSupport::Concern
+
+  included do
+    test "destroy deletes the given resource when reauthenticated" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      reauthentication_token = response.parsed_body["reauthentication_token"]
+      params = params_for_destruction(reauthentication_token: reauthentication_token)
+
+      resource_id = resource_instance.id
+
+      assert_difference "#{resource_class}.count", -1 do
+        destroy_registration_action(params: params)
+        assert_redirected_to destroy_success_url
+      end
+
+      assert_nil resource_class.find_by(id: resource_id)
+    end
+
+    test "destroy requires a reauthentication token" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      reauthentication_token = "   "
+      params = params_for_destruction(reauthentication_token: reauthentication_token)
+
+      resource_id = resource_instance.id
+
+      assert_no_difference "#{resource_class}.count" do
+        destroy_registration_action(params: params)
+        assert_response :bad_request
+        assert_not_reauthenticated_message
+      end
+
+      assert_not_nil resource_class.find_by(id: resource_id)
+    end
+
+    test "destroy requires the reauthentication token to match the stored value" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      reauthentication_token = SecureRandom.hex
+      params = params_for_destruction(reauthentication_token: reauthentication_token)
+
+      resource_id = resource_instance.id
+
+      assert_no_difference "#{resource_class}.count" do
+        destroy_registration_action(params: params)
+        assert_response :bad_request
+        assert_not_reauthenticated_message
+      end
+
+      assert_not_nil resource_class.find_by(id: resource_id)
+    end
+
+    test "destroy ignores an attmept to delete a different resource" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      reauthentication_token = "   "
+      params = params_trying_to_destroy_other_resource(reauthentication_token: reauthentication_token)
+
+      resource_id = resource_instance.id
+
+      assert_no_difference "#{resource_class}.count" do
+        destroy_registration_action(params: params)
+        assert_response :bad_request
+        assert_not_reauthenticated_message
+      end
+
+      assert_not_nil resource_class.find_by(id: resource_id)
+    end
+  end
+end

data/app/lib/practical/test/shared/auth/passkeys/controllers/registrations/self_signup.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+module Practical::Test::Shared::Auth::Passkeys::Controllers::Registrations::SelfSignup
+  extend ActiveSupport::Concern
+
+  included do
+    test "new registration challenge action returns a registration challenge" do
+      email = Faker::Internet.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+    end
+
+    test "new registration challenge action requires an email" do
+      email = ""
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :bad_request
+      assert_email_missing_error_message
+    end
+
+    test "new registration challenge action requires a passkey_label" do
+      email = Faker::Internet.email
+      passkey_label = "   "
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :bad_request
+      assert_passkey_label_missing_error_message
+    end
+
+    test "new registration action renders successfully" do
+      new_registration_action
+      assert_response :ok
+    end
+
+    test "create registration action creates a new resource" do
+      email = Faker::Internet.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+
+      client = webauthn_client
+      challenge = expected_stored_challenge
+      raw_credential = create_credential_and_return_payload_from_challenge(client: client, challenge: challenge)
+
+      params = params_for_registration(email: email, passkey_label: passkey_label, raw_credential: raw_credential)
+
+      assert_difference "#{passkey_class}.count", +1 do
+      assert_difference "#{resource_class}.count", +1 do
+        create_resource_action(params: params)
+        assert_redirected_to expected_success_url
+      end
+      end
+
+      new_resource = resource_class.last
+      credential = hydrate_response_from_raw_credential(client: client, relying_party: webauthn_relying_party, raw_credential: raw_credential).credential
+
+      new_passkey = new_resource.passkeys.last
+      assert_equal passkey_label, new_passkey.label
+      assert_equal Base64.strict_encode64(credential.id), new_passkey.external_id
+      assert_not_nil new_passkey.public_key
+      assert_not_nil new_passkey.last_used_at
+    end
+
+    test "create registration action does not create a duplicate resource" do
+      email = existing_resource.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+
+      client = webauthn_client
+      challenge = expected_stored_challenge
+      raw_credential = create_credential_and_return_payload_from_challenge(client: client, challenge: challenge)
+
+      params = params_for_registration(email: email, passkey_label: passkey_label, raw_credential: raw_credential)
+
+      assert_no_difference "#{passkey_class}.count" do
+      assert_no_difference "#{resource_class}.count" do
+        create_resource_action(params: params)
+        assert_response :unprocessable_entity
+      end
+      end
+    end
+
+    test "create registration action requires an email" do
+      email = Faker::Internet.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+
+      client = webauthn_client
+      challenge = expected_stored_challenge
+      raw_credential = create_credential_and_return_payload_from_challenge(client: client, challenge: challenge)
+
+      params = params_for_registration(email: "   ", passkey_label: passkey_label, raw_credential: raw_credential)
+
+      assert_no_difference "#{passkey_class}.count" do
+      assert_no_difference "#{resource_class}.count" do
+        create_resource_action(params: params)
+        assert_response :bad_request
+      end
+      end
+    end
+
+    test "create registration action requires a passkey_label" do
+      email = Faker::Internet.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+
+      client = webauthn_client
+      challenge = expected_stored_challenge
+      raw_credential = create_credential_and_return_payload_from_challenge(client: client, challenge: challenge)
+
+      params = params_for_registration(email: email, passkey_label: "   ", raw_credential: raw_credential)
+
+      assert_no_difference "#{passkey_class}.count" do
+      assert_no_difference "#{resource_class}.count" do
+        create_resource_action(params: params)
+        assert_response :bad_request
+      end
+      end
+    end
+
+    test "create registration action requires a passkey_credential" do
+      email = Faker::Internet.email
+      passkey_label = SecureRandom.hex
+
+      params = params_for_registration_challenge(email: email, passkey_label: passkey_label)
+      new_registration_challenge_action(params: params)
+      assert_response :ok
+      webauthn_id = response.parsed_body["user"]["id"]
+      user_data = expected_user_data_for_challenge(email: email, webauthn_id: webauthn_id, name: email)
+
+      assert_passkey_registration_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        relying_party_data: expected_relying_party_data,
+        user_data: user_data,
+        credentials_to_exclude: []
+      )
+
+      client = webauthn_client
+      challenge = expected_stored_challenge
+      raw_credential = create_credential_and_return_payload_from_challenge(client: client, challenge: challenge)
+
+      params = params_for_registration(email: email, passkey_label: passkey_label, raw_credential: "   ")
+
+      assert_no_difference "#{passkey_class}.count" do
+      assert_no_difference "#{resource_class}.count" do
+      assert_raises NoMethodError do
+        create_resource_action(params: params)
+      end
+      end
+      end
+    end
+  end
+end

data/app/lib/practical/test/shared/auth/passkeys/controllers/registrations/update.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module Practical::Test::Shared::Auth::Passkeys::Controllers::Registrations::Update
+  extend ActiveSupport::Concern
+
+    included do
+    test "edit renders successfully for the resource" do
+      sign_in_as_resource
+      edit_registration_action
+      assert_response :ok
+    end
+
+    test "edit does not render a different resource" do
+      sign_in_as_resource
+      attempt_to_edit_other_resource_action
+      assert_response :ok
+      assert_not_includes response.body, other_resource.email
+    end
+
+    test "update updates the resource after reauthentication" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      new_email = Faker::Internet.email
+
+      reauthentication_token = response.parsed_body["reauthentication_token"]
+      params = params_for_updating_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_json_redirected_to expected_update_success_url
+      end
+
+      resource_instance.reload
+      assert_equal new_email, resource_instance.email
+    end
+
+    test "update requires a reauthentication token" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      old_email = resource_instance.email
+      new_email = Faker::Internet.email
+
+      reauthentication_token = ""
+      params = params_for_updating_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_response :bad_request
+        assert_not_reauthenticated_message
+      end
+
+      resource_instance.reload
+      assert_equal old_email, resource_instance.email
+    end
+
+    test "update requires the reauthentication token to match the stored value" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      old_email = resource_instance.email
+      new_email = Faker::Internet.email
+
+      reauthentication_token = SecureRandom.hex
+      params = params_for_updating_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_response :bad_request
+        assert_not_reauthenticated_message
+      end
+
+      resource_instance.reload
+      assert_equal old_email, resource_instance.email
+    end
+
+    test "update renders an error if the email is missing" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      old_email = resource_instance.email
+      new_email = "  "
+
+      reauthentication_token = response.parsed_body["reauthentication_token"]
+      params = params_for_updating_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_response :unprocessable_entity
+        assert_form_error_for_email(message: "can't be blank")
+      end
+
+      resource_instance.reload
+      assert_equal old_email, resource_instance.email
+    end
+
+    test "update renders an error if the email is a duplicate" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      old_email = resource_instance.email
+      new_email = other_resource.email
+
+      reauthentication_token = response.parsed_body["reauthentication_token"]
+      params = params_for_updating_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_response :unprocessable_entity
+        assert_form_error_for_email(message: "has already been taken")
+      end
+
+      resource_instance.reload
+      assert_equal old_email, resource_instance.email
+    end
+
+    test "update ignores when trying to update a different resource" do
+      sign_in_as_resource
+
+      client = webauthn_client
+      create_passkey_for_user_and_return_webauthn_credential(user: resource_instance)
+
+      new_reauthentication_challenge_action
+      assert_response :ok
+      assert_reauthentication_token_challenge
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      reauthenticate_action(params: {passkey_credential: credential.to_json})
+      assert_response :ok
+      assert_equal expected_stored_reauthentication_token, response.parsed_body["reauthentication_token"]
+      assert_nil expected_stored_reauthentication_challenge
+
+      new_email = Faker::Internet.email
+
+      reauthentication_token = response.parsed_body["reauthentication_token"]
+      params = params_trying_to_update_other_resource(email: new_email, reauthentication_token: reauthentication_token)
+
+      assert_no_difference "#{resource_class}.count" do
+        update_registration_action(params: params)
+        assert_json_redirected_to expected_update_success_url
+      end
+
+      resource_instance.reload
+      assert_equal new_email, resource_instance.email
+    end
+  end
+end

data/app/lib/practical/test/shared/auth/passkeys/controllers/sessions/base.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Practical::Test::Shared::Auth::Passkeys::Controllers::Sessions::Base
+  extend ActiveSupport::Concern
+
+  included do
+    test "new: renders successfully" do
+      get_new_session_url
+      assert_response :ok
+    end
+
+    test "new_challenge: does not require the resource to be authenticated and sets the session variable that stores the new challenge" do
+      get root_url
+      assert_resource_not_signed_in
+      issue_new_challenge_action
+      assert_response :ok
+      assert_equal get_session_challenge, response.parsed_body["challenge"]
+    end
+
+    test "new_challenge: overrides the session variable that stores the new challenge" do
+      issue_new_challenge_action
+      assert_response :ok
+
+      old_session_challenge = get_session_challenge
+
+      issue_new_challenge_action
+      assert_response :ok
+
+      assert_not_equal old_session_challenge, get_session_challenge
+      assert_not_equal old_session_challenge, response.parsed_body["challenge"]
+    end
+
+    test """create:
+      - logs the resource in
+      - clears the challenge session variable
+      - sets the remember cookie value
+    """ do
+      issue_new_challenge_action
+      assert_response :ok
+
+      assert_passkey_authentication_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        credentials_to_allow: []
+      )
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      assert_nil remember_cookie_value
+
+      authenticate_action(params: {resource_key => {passkey_credential: credential.to_json}})
+      assert_redirected_to root_url
+
+      assert_resource_signed_in
+      assert_resource_remembered
+      assert_nil get_session_challenge
+    end
+
+    test """create:
+      - raises an error if the challenge does not match what is in the session
+      - clears the challenge session variable
+    """ do
+      issue_new_challenge_action
+      assert_response :ok
+
+      assert_passkey_authentication_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        credentials_to_allow: []
+      )
+
+      challenge = SecureRandom.hex
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      authenticate_action(params: {resource_key => {passkey_credential: credential.to_json}})
+      assert_response :unprocessable_entity
+
+      assert_nil get_session_challenge
+      assert_resource_not_signed_in
+    end
+
+    test """create:
+      - raises an error if the credential is invalid
+      - clears the challenge session variable
+    """ do
+      issue_new_challenge_action
+      assert_response :ok
+
+      assert_passkey_authentication_challenge(
+        data: response.parsed_body,
+        stored_challenge: expected_stored_challenge,
+        credentials_to_allow: []
+      )
+
+      challenge = response.parsed_body["challenge"]
+      credential = get_credential_payload_from_challenge(client: client, challenge: challenge)
+
+      invalidate_all_credentials
+
+      authenticate_action(params: {resource_key => {passkey_credential: credential.to_json}})
+      assert_response :unprocessable_entity
+
+      assert_nil get_session_challenge
+      assert_resource_not_signed_in
+    end
+  end
+end